Dungeons,Dragons &Security
Tiphaine Romand-Latapie

1Who, why & how• About me:• Currently: Airbus Group Innovations (joined May 2016)• Before: Orange Labs as a Project Security Team Leader (job: convincepeople to do security)• Why:• RPG design for and by myself to train my interlocutors• How:• Design• Test on family, friends & coworkers (redesign)• Used on ~70 people at Orange: Project manager, Top manager,Retails, Customer Support, Call Center2

Neophyte view of InfoSec• “We do not need to protect ourselves from hardware levelattacks. If the user opens his product, he loses the warranty
anyway.”• “We don’t risk a thing: it’s in the LAN”
• “I don’t know why we even bother, we’ve never been hacked!”3

Let’s go train them!
• “That’s not an API; an API is the thing we publish on ourwebsite.”• “I do not think that the kernel is essential.”• “In case of massive network failure, we want to send a message
to all customer devices indicating that there is a massivenetwork failure.”4

Let’s go train them…
• …without talking about technical aspects…

• “We do not need to protect ourselves from hardware level attacks. If theuser opens his product, he loses the warranty anyway.”• “I don’t know why we even bother, we’ve never been hacked!”
ARE NOT TECHNICAL MISUNDERSTANDING ISSUES
5

Learning• When can you decide whether or not to trust an entity/a person? And for what ?
• What is in-depth defense?
• Bad attacker, bad!
• his motivations• stereotype versus reality (he is not necessarily a “genius hacker” – sorry )• money, money, money• Who’s the security team (beside obnoxious nerdy people who don’t know real life andprevent people from working)?

6

Neophytes have good instincts…
… when it comes to physical security:• They close their doors in the morning• They have insurance (auto, home, fire, liability, disability, etc.)• They even hide valuables before leaving home for an extended period of time
• They don’t let just any stranger enter their home
• They are OK with security when they feel it protects / benefits them (home alarm, locks,cameras, etc.…)

7

Core Idea
• Using neophyte knowledge in physical security to teach them about computer / infosecurity• Requirements:• Not another boring mandatory security training session…
• Make it FUN!
• No heavy technical aspects• Learn the basics• We want trainees to learn to think « infosec » by themselves

ü RPG in physical security
8

Game & Settings
You need:• One meeting room and one paperboard / drawing board• 4 to 8 players• Energy• 90 to 120 minutes (more if you’re up to it)• No Dice / No Dragon
You (The Security something):• Are the Game Master• Conduct the game during 30 to 45 minutes• Then explain the parallel between what happened in the game and the InfoSec world

9The Game?

•At the beginning of the game, the building is no
secure at all•Two teams:• The attackers must steal the object• The attackers propose an attack, thedefenders a mitigation, in an iterative way10

The Rules

tack team:

Defense team:oals: steal the object without being caught
ther during or after)

Goals: prevent the theft or collect data allowin
you to catch the attackers.

ules: unlimited budget, limited number of humanackers in the game (no more than 10 people).
ws of physics apply (gravity, no Deadpool, etc.).

Rules: unlimited budget, unlimited staff, laws
physics apply, the law must be respected,
employees must be able to work in the buildin
during office hours (and use the object)...

11

Real session minutes (synthetized)
Get in, steal, get out
Guards at the front door, safe in the object’sroom, badge reader at the room entrance
Access to safe key & room : 3 managers of
the team needing access to the object

Kidnap of one of the managers, steal badge
and safe key. Enter building through parking
lot12

Real session minutes (synthetized)
The safe key never leaves the building,
CCTV everywhere (except bathrooms!!),CCTV surveillance 24/7 by externalcompany
Hack the CCTV (video loop), enter with themanager’s badge then steal the key of thesafe
Badge associated with facial recognition

Hack facial recognition DB before the theft

13

Real session minutes (synthetized)
Video loop detected by putting analog
clocks in front of all camera
Kill the manager and steal his face (actualface!!)
Iris scan to access the floor
Fire (all doors open), land in fake firemen
helicopter
The object is put back in the safe in case ofevacuation
14

Real session minutes (synthetized)
Open the safe with blowtorch
CCTV guard calls the police
Blackout (no more electricity)
Backup generator

15

Real session example• After all this: drone evacuation of the object, kidnapping ofguards’ families, GPS tracker, faraday cages, poison, etc.
• This is actually a “tame” scenario• Think about: James Bond, Mission: Impossible, Oceans 11 etc.
• That was fun, but… InfoSec anybody?

16Debriefing (synthetized)
Get in, steal, get out
Security operational & technical Guards at the front door, safe in the object’s
measures, access control, “leastroom, badge reader at the room entrance
privilege” principle, defense in
Access to safe key & room : 3 managers ofdepth, bad security measure
the team needing access to the object
deployment (nothing in the safe)

Kidnap one of the managers, steal badge
and safe key. Enter building through parking
lotSocial Engineering, password
theft, path of least resistance17

Debriefing (synthetized)
Hardware security– Supervision,
SOC

Hack the CCTV (video loop), enter with themanager’s badge then steal the key of thesafe

The safe key never leaves the building,
CCTV everywhere (except bathrooms!!),CCTV surveillance 24/7 by externalcompany

Log tampering, credential
theft

Biometry, multi-factor
authentication

Badge associated with facial recognition

Hack facial recognition DB before the theft
ACS attack18

Debriefing (synthetized)
Watchdogs/Keep alive (!!!!!)

Kill the manager and steal his face (actualface!!)

Hack account/computer. Reboundattacks

Biometry
Fire (all doors open), land in fake fire
department helicopter

Video loop detected by putting analog
clocks in front of all cameras

Iris scan to access the floor

Use of customer support/debug access– fail safe/fail secure

Hardware security

The object is put back in the safe in case ofevacuation19

Debriefing (synthetized)
Open the safe with blowtorch

Hardware attacks/ use of exploit
SOC/CERT

Blackout (no more electricity)

CCTV guard calls the police

DoS on security infra./supervision

Back up infra.

Back up generator

20

Other discussions examples- Cost of security (attack) VS. the object value- Constraints on employees (and tradeoffs)- Social engineering (they all do it!)
- Black Market:- Of data- Of exploit- Of video feeds- etc.

21

Physical Security != InfoSec• Time & Space:• Instantaneous testing (!= testing a key for a lock)• Geography (nearly) doesn’t matter• Copy & Paste:• Theft is actually copying• Without a trace22

Pro Tips• 6 to 8 players max• Too difficult to follow beyond this number• Ask who wants to attack• Defense is “forced” to respond• Switch teams• In case of “timid” attackers• You are the law• Kill all the trolls• Forget the rules• They’re just here to prevent “foul game”• Have fun23

Short term results• Attackers are bad: “We put the dogs to sleep, then we kill the guards”• People from Security Teams are fun: “Can we use missiles?”• And their work is hard: “That’s not fair! It’s too difficult to win if we have torespect the law”
• And they actually help users: “Can you tell me again how to choose apassword?”• Trainers have fun too: “Does a dead eyeball pass an iris scan?”• Does not work on: YOU24

Long term results• Actually working: “You’ve changed the life of my team, we don’t
go to the bathroom with our smartphone anymore”• (They’re too afraid of being recorded)• A lot of contact afterwards• To ask for the same training for coworkers• To ask for technical trainings• To ask for help
• To report possible incident• Trainers wants to train more people (!!!)
25

Thank You• And thanks to all my guinea pigs and trainees at Orange• You want to know more? White paper provided “NeoSens: …”• This work is licensed under the Creative Commons AttributionNonCommercial-NoDerivatives 4.0 International License.
• Please, try it and tell me about it:• @Flutsunami• aska.icoe@gmail.com

26