getting out of the trenches

Getting Out Of The Trenches

Martin Fisher

SecureWorld - Atlanta

Email: armorguy@gmail.comTwitter: @armorguy

Much can be learned about information security by evaluating historical battles and warfare...

Today, information technology in general, and information security in particular, look like warfare as conducted during World War One...

“Those who do not learn from history are doomed to repeat it.” - George Santayana

Double-You Tee Eff???

Double-You Tee Eff???So, Why Is What I Think Worth A Preso???

20 years in IT and Security

Military History minor / ROTC Graduate

Enlisted, Cadet, and Officer in US Army

Idea + PowerPoint + Time = Preso

World War 1 Trench Warfare... Does It Look Familiar?

Highly structured and lengthy perimeters....

World War 1 Trench Warfare... Does It Look Familiar?

Losses can be catastrophic...

World War 1 Trench Warfare... Does It Look Familiar?

Less than optimal working conditions...

World War 1 Trench Warfare... Does It Look Familiar?

Cool new technologies get deployed – but nobody is really sure how to best use them

What Broke The Trench Stalemate???

Allied effective deployment and tactics for tracked armored

vehicles.

Through combining revolutionary and evolutionary tactics, techniques, and technology in new ways both sides were able to redefine the battlespace and get themselves out of

the killing fields...

Not Convinced???

Not Convinced???

So, How Do We Break Out Of Today's Trenches??

Adopt new technologies & use

them in new ways...but not all

technologies can be 'game changers'...

Know your own rules inside and out. Be prepared to throw

them out the window – if required.

Respect the conventional

wisdom. Do not allow yourself to be overly constrained

by it.

Understand the adversary. Know his rules better than he

does.

Know your own rules inside and out. Be prepared to throw them out the window – if required.

Formal education is the basis for understanding – but a degree/cert/letters-after-your-name isn't knowledge

Understand the culture and informal rules of your org... Develop your “cred”...

Captain George S. Patton, Jr.

Realize that every technology, every process, every way-of-doing-things has a lifespan – and teach that to others

When the time is right, the right technology is in place, the right people are on your side, and you are facing the right situation you need to throw the rules out and re-write them.

Understand the adversary. Know his rules better than he does.

Don't just sit there. Get out there and find out what they're doing.

Develop a “Red Team” / “Blackhat” mentality.

Know the capabilities of the adversary – and realize they publicize them (if you know where to look).

Never, never, NEVER expose something to get nothing.

Adopt new technologies & use them in new ways...but not all technologies can be 'game changers'...

Constantly review and evaluate new technologies. The 'cutting edge' is where the newest best solutions are going to come from.

Look at use cases – not just 'the directions'. Leverage systems for everything they can provide.

Some of your choices will end up being bad ones. Accept it, deal with it, move on.

Constantly look to integrate new processes and procedures to go with new technologies.

Respect the conventional wisdom. Do not allow yourself to be overly constrained by it.

Conventional wisdom was revolutionary at one time. There's a reason people follow it – it probably works pretty well right now.

Significant improvements only come through disruptive change. Disruptive change is the enemy of conventional wisdom.

Too much of either one serves you poorly.

There can very a very high price to pay for attempting to disruptively change an organization before it's ready for it.

What Are The Characteristics Of Those Who Can Get Out Of The Trenches?

They read and understand history.

They can apply lessons learned from disciplines not obviously related to their own.

They embrace change – but not just for the sake of change.

They have the courage of their convictions.

They can effectively communicate their intent, direction, and purpose.

They realize they are usually never the smartest person in the room – and find a different room if they are...

Major-General JFC Fuller, CB, CBE, DSO

So What?

Those who can get out of the trenches differentiate themselves from their peers.

Staying in the trenches means you are condemned to fighting the same fight every day with no real chance of success.

The infosec leaders of tomorrow know that the war against the adversary can only be won by taking the battle to the next level – and they want to take it there.

Let's face it... Trenches Are Not Fun.

Questions?