BSidesIA 2017 Track1: Defense Wins Championships – Ben Schmitt
Channel: BSidesIowa
Date: 23/04/2017

BSides Iowa 2017 - Track 1
Title: "Defense Wins Championships"
Speaker: Ben Schmitt

My name is Ben and I play defense. Let me tell you why I think defense wins championships.

My father is a retired firefighter and I often times naturally think about the evolution of the fire service. The fire service has shifted from putting out fires as fast as possible with great equipment, carefully placed fire stations and rapid response to significant investments in fire prevention and survival such as education, inspections, building codes and careful design. Simply put: don’t just build faster and bigger fire trucks…focus on preventing or mitigating the damn fires in the first place.

So, what does this mean when compared to Information Security? Information Security has a current fascination with playing offense and for good reason. You can’t play great defense without knowledge of the offense. If you can’t run nmap, tcpdump or a proxy to meddle with things, it’s going to be hard to play defense. You need some knowledge of offense to make sure your defensive controls actually perform as-expected.

Despite the need for offensive knowledge, I am concerned with the industry’s absolute fascination with offense. Penetration testing is all the rage – breaking things, pivoting around an organization and pillaging sysadmins to uncover high-value data can be perhaps exciting? It seems that most resumes which cross my desk must include Kali Linux for a coolness factor. Maybe it is a result of Mr. Robot or maybe people just think breaking things is the pinnacle of achievement in a win/loss scenario.

We going to go point/counterpoint in this talk to focus on the glory of playing defense. Offense wants to sniff traffic, then defense ensures proper TLS is enforced. Offense wants to steal credentials, then defense ensures MFA is required. Offense wants to brute force a web app form, defense ensures throttling and CAPTCHAs. Offense wants to brute force password hashes offline, defense ensures Argon2 is waiting. Offense wants to spoof, tamper, repudiate, disclose information, denial of service or elevate privilege, defense performs threat modeling.

A football team’s defense keeps points off the board and can turn a fumble into an opportunity. Defense matters and wins championships. Let’s take some time to glorify the defenders out there.