It's 11.30, so go ahead and get started. My name is Eric Brown. I am an open source engineering manager at VMware. I manage a small team of folks that contributes 100% of their time doing patches upstream. But prior to being in management, I also did quite a bit with security, specifically with linters and tooling. So today, we're going to talk about your open source security liners suite. And I wanted to dive into why this is important, why, you know, what the heck is static code analysis and what tools are available. I saw this on a recent hike. So I thought this was a very security-mining person. He's got eight locks to lock this gate to nowhere. Pretty much exemplifies the message nowadays that we need more security and we need to have that mindset with the software that we develop. So why is it so costly? So in the development life cycle, with any bug, the sooner you find it, the cheaper it is to fix, right? And this is a chart way back from 1996. And this totally still applies today, except for those crazy low-price numbers. But when it comes to security, it becomes even more expensive to fix post-release. And it actually damages the reputation of your business, too. So in terms of business impact, it's very costly. Like you've probably heard about a lot of the breaches with Target and other companies.  And they pay huge sums, but at the top there is a million dollars. So it's very essential we try to secure our code as much as possible before they enter into mainstream. And the types of security bugs keeps changing year to year. And so we need to educate ourselves on the types of issues that can arise in your code. Nowadays, you see a variety of these attacks where they use multiple techniques at once. It isn't necessarily important to know the percentage of attacks per year, but it is important to educate yourself to know how these things occur. So what is the struggle in fixing this? So there was a survey done that said only 26% of companies ignore the security bugs just because they don't have the time to do them. And I've seen this with development teams a lot where security is kind of put on the back burner, right? And the feature function is the priority. So security is actually more important to get in place earliest in the dev cycle and plan for it not being an afterthought. So as I said, education is essential, right? And it's the first way as a developer that we can better address these problems. And there's a plethora of coursework out there. You go to YouTube, Pluralsight, whatever it may be. There's plenty of courses out there to learn up that every developer should learn about. Supply to front-end developers, back-end developers, whatever it may be. Books are good, but books become outdated rather quickly. So reading a book from 2005 on security probably is not going to help you much today. But if you want that in-depth knowledge of how something happens, it's good to read. And then finally, attending these conferences, attending sessions like this to learn more is essential, I feel. As far as tooling, so education is good, but you always have developers that don't necessarily aren't as educated about potential problems. You can catch some things in code reviews and peer review. But tooling is an excellent aid to supplement finding these problems. And number one, I tell everyone, is unit test, right? Every bit of code, you essentially don't know how much code works until you've unit tested it. And target, like, 80% coverage when you do that. And you'll flush out a lot of the problems that may occur. Secondly, one of the high priority things to do nowadays is your code may be perfect, but, however, you may depend on numerous number of packages that aren't. And GitHub, and there's a plethora of other tools that do dependency checking. And will notify you of potential packages that you need to upgrade. So definitely, that should be part of your tooling in your product. And then finally, the static code analysis, which I want to talk about today, is the other tool in your tool chest, I guess I should say. So what is a linter? So linter is a source code analysis. You don't have to build the code. You just give the source. You use something called the abstract syntax tree, which is the same as what a compiler uses to look at your code. So it's more sophisticated than just grepping your code. They tend to focus on common mistakes, right? And some of the examples that you'll see per language, like if you're a Python guy or a girl, you might be Pylint, Java, CheckStyle, ESLint for JavaScript, and Golint for Go. And these are the ones that focus mostly on style, not so much security. But we should be running these linters, like I said before, as early in the development life cycle as possible. So integrate them into your IDEs. There are a lot of plugins out there for existing tools. So integrate those, fix them as you code. And then secondly, they should be in your CI system in some form or fashion. So if you use Travis CI, if you're open source and you use Travis CI, Jenkins, whatever, there are a lot of plugins to integrate various linters into them. The downside, the number one downside is false positives, right? You may get quite a bit of false positives. The more code you scan, the more false positives you gotta go through and look for, and that takes a lot of time to do. There are ways to mitigate that by looking at only high severity or looking at only the high confidence issues because there usually is a level like that. But these tools are just tools and they're not meant to replace humans. So they're meant to supplement the human code review. And there is a marginal time that your CI system would also have to run these tools, but that's pretty marginal. So the first tool I wanna talk about is Bandit. The last one is pretty near and dear to me because I work on it as a maintainer. I was there from the very beginning back in 2015. So it started when a group of OpenStack developers like myself went to a local meetup for OpenStack with a security mindset and they identified that there was no real good linter when it came to Python. So over the course of that week, they integrated it into Git. We integrated it into several of the projects in OpenStack, started running with it, found a bunch of bugs, which is great, and it got those fixed. But now it's migrated out of OpenStack just because there was nothing specific to OpenStack, so it's now part of the Python code quality authority. And it runs on all major versions of Python, including a testing of 3.8, which is still in development, runs on Linux and Mac. It probably runs on Windows, but we don't officially test it on Windows, so we don't claim that support, but it would probably work just fine. And it's very pluggable, so you can write new plugins to extend it. One of the plugins that was added was company lift, same one, your ride sharing service. They added a plugin to look for high entropy strings so they can find private key files and check into code, which is pretty neat. And it runs quickly with minimal resource, so it works rather well with your CI. So the types of issues it can find are use of cert. Some people don't realize in Python that if you have an assert as a conditional, that will get compiled out. So it'll flag that, checks for hard-coded passwords against a set of patterns there. In some cases, you'll find code that tries to write files to slash temp as a hard-coded name, when you should be using the API to do that. So there is a check for that. And weak cryptography, so like legacy algorithms like DAZ or just using two small keys, it'll find insecure protocols like Telnet, FTP, things like that, it'll flag. One of the big ones that comes up a lot is, you'll find code that isn't doing proper certificate validation. And developers tend to get a little bit lazy when they make these connections or if they have self-signed certificates in place. And to avoid the errors, they just turn that flag off and say verify false. And then that gets into production and then it's not, then you have a vulnerability and as a result, because you're susceptible to a man in the middle attack. So the output goes to standard out by default, but there are a lot of output formatters that you can customize or choose to use, depending on whatever integration you're gonna plan for. And one of the cool extra ones with Bandit is this custom one, so you can actually create a template and within that template define whatever type of format you want. But it covers all the major output formats you would probably see or need. So you can filter by severity and confidence, which is quite useful. You may want to only look at high and high confidence, high severity. You can create plugins where you can customize just about everything that Bandit does under the covers. So you can customize a specific test that looks for certain functions and you can modify which functions it looks for. So in the output, which I'll show a little later, it'll group the snippet of the code and the offending code and you can change the lines of output of that. So if you just want to see one line, you can do that to make your report smaller. Group the results, you know, pretty basic, but to address the problem with false positives, it does have this technique where you can add this comment that says no sex on that line and Bandit will effectively ignore that line. So this is what a typical config looks like. This I grabbed from GitHub, from Netflix. So they're using Bandit inside their TOX INI file. So TOX is similar to a May file kind of system. And what's slick here is they're using the INI config to do like command line parameters and then just referencing itself in the TOX.INI. So they have this Bandit section where they're skipping one of the tests. So a pretty slick way they're using that, but it makes it pretty convenient to have that feature. But if you really want to get for the power user of Bandit, you can customize through this Bandit YAML and that's where you can run this Bandit config generator file and it'll dump out a Bandit YAML and you can customize the plugins however you like. And there's some documentation too that defines how some of these things work. So in terms of use, Bandit is used quite heavily. So these are stats from GitHub and there are over 1200 repositories on GitHub that are using Bandit to scan their code. So pretty cool. If you want to integrate Bandit into your IDE, it does support Sublime, VS Code and Flake8 and Jenkins. There's this thing called PI report card, which is equivalent to Go report card if you're familiar with that, but it'll give you a report of the health of a project. And so it runs various linters and other things to determine this health and actually Bandit is part of that health metric. So this is what it looks like when you integrate it into Sublime. So right within your code, as you're typing, it will show this red or yellow dot that will show the flag, the line of sending code. In this case, the RSA key size was too small. And if you look on the package control for Sublime, it's like over 15,000 downloads so far. It's pretty good use. But VS Code is similar. It shows a red highlighted line of the offending code. And then this is a sample bit of code. I think I either took this or crafted it myself, I can't remember. But I wanted to ask if anybody can tell me what may be wrong with it or what Bandit might flag in this small, if you can see it. Hope it's not too small. Any ideas? Anyone? I heard, not in this case. So there are two offending lines. So the first is the auto add policy. So this bit of code is using Paramiko, which is an SSH client. And what it's doing is automatically accepting whatever host it connects to, whatever host key is presented. So if you use, I'm sure most people have used SSH. You make a connection, you get a response that shows the fingerprint. This is effectively ignoring that fingerprint and not displaying it to the user at all. So you have no validation that the crew you're connecting to is actually the proper person. So in the HTTP world, this would be the equivalent of ignoring the certificate. On the second flag is it's flagging a potential for command injection by using exact commands. So this is a little anime gif running Bandit on that slice of code. And it flags those two problems, I'm sorry so tight. But it does find both of those issues. If you go into the code, and in the case of the auto add, and I change the policy to reject, the ideal scenario here is that you would tell the user the host key as a fingerprint. So you rerun Bandit. And in this case, I'm also skipping the second test because maybe as a developer, I know that second case is a false positive, right? And then you'll get a clean Bandit scan for that bit of code. But alternatively, you can go into the code, like in this example, and modify that line, and basically add that no sec comment. And that'll also tell Bandit to ignore that line. That's what this is doing. Go to that exact command, so the comment no sec, save it, rerun Bandit. And voila, you have a passing test. So that covers Bandit. It is open source, of course. I am one of the maintainers, and we welcome all new contributors. So please, if you have ideas to share, please go. The documentation probably could use some work, so that's one of the ideas to help out. New integrations would be nice, with some other IDEs like Dim, maybe or Emacs, if you guys use that. One of the things that's kind of new and cool is, I've seen this with like ESLint, but not only identifying a problem, but also suggesting a fix for the problem, right? A lot of these tools will just point to documentation, and sometimes that's not the best thing to resolve the issue. It may be confusing, but it'd be nice if it actually offered a solution, rather than just removing that line of code. So the second linear I want to talk about was GoSec. This is your Golang security linter. And this was started by one of the guys who also created Bandit, like a year later, and it runs on Linux Mac and Windows. It's pluggable. It has a lot of similar Bandit, just because of the creator of it, but it'll find hard-coded credentials. One of the things it'll know is binding to all interfaces, so a lot of people don't realize that when you have a service and you listen on the 0.0.0 address, you're effectively listening on every interface that is on your system, and usually you only wanted one public interface, and that can lead to trouble. But it also looks for injection, and weak cryptography, bad versions of SSL and TLS, and ignoring host keys with SSH and such. It has slightly less in terms of four matters, but it does cover all the ones that people generally use, like JSON, YAML, and it only allows you to filter by severity, which is unfortunate. It would be nice to be able to filter on the confidence because it does give you a confidence factor, so that would be something to add for a future item. But you can create profiles just like Bandit to customize how it runs and add it to your project, and you can group by severity. The actual, the way it resolves false pauses is exactly the same way as Bandit, so it uses a no-sec comment. One of the differences, too, is that it has a tool to generate TLS rules. So if you've ever posted like an Apache server or some kind of HTTPS server, there's this long list of ciphers and algorithms and key sizes that you need to place in there, and you have to keep that up to date constantly. This provides a nice little tool that'll generate the code snippet for all of that based on the Mozilla recommendations, so it's pretty slick. But one of the drawbacks of GoSec is it does rely on the GoPath, so whatever your scan has to be in your GoPath, you can't just take an ad hoc Go file and then pass it into GoSec, it won't work. It'll say it can't find it.  One of the things I would like to see it added to is the Go report card. A lot of the major projects have this Go report card that shows the health of a project, so I think Kubernetes has that. But it'd be nice if GoSec was part of that health rating. You'll see that badge on, in readmease of GitHub projects, a lot of times with Go. I'll try to, I'll post the slides too, but it'll help. This is what the Go report card looks like. This is actually a report of GoSec itself, so a little bit of inception there. And this is what it looks like in the Linter, or in the IDEs, so in Sublime. It looks pretty much the same as Bandit, and pretty much the same with Visual Studio Code, if that's your preferred idea of choice. And then here's another sample bit of code. It's a little bit smaller, so maybe you guys could help me out and identify what may be wrong in this bit. That's one. They're actually cute. That is, not in this particular case that has been brought up before. The other one's a little, maybe not so much security related, but in this case that same, the same line where the key size is too small, it's also not handling the error that can come out of that at all. So if you run GoSec on that snippet of code, those two errors, it doesn't give you a color output, so it's not as pretty, but it does give you the essential information you need, including a summary of the errors and the lines of code it scanned and whatnot. When you go into the code and we wanna increase that key size, right? That's way too small for RSA, maybe that's 512, set it to something like 2048 bits. Rerun GoSec. And I think in this case, yeah. And then it clears the, oh, sorry, the other error is still flagged because I didn't skip it or I think in this example is I go and you can actually specify whether you wanna skip that entire test.  I can slow. Here we go. Run GoSec and you get a clean report. Yep. When you, that you, you could, someone could potentially do that, right? I thought, oh, you have. I have seen that before and that has been, there's nothing in GoSec itself that would enforce that. Maybe it should, but I totally agree. That would be useful to have the reason why you're excluding. Yeah. Yeah, I totally agree. And that could be a future enhancement. I have seen people put reasons just because they're like, hey, why are you ignoring this? And in this case, so GoSec abandoned, don't go to the granularity to like say, NoSec for test, you know, code block, but you'll find that ESLint and some others do. So that would be another great enhancement to have in these tools. So, you know, definitely something I'd like to see. There might be issues on that already open on GitHub, but I'd have to double check. Yeah. Yeah, in that case, you're. Right, exactly. Yeah. I totally agree. That's something needed. These tools are rather new, so I think you use improvement. And we're always looking for new developers to do this. So, one of the ways GoSec differentiates, though, is it has that TLS config. So when you run that, this is the code snippy yet. You get a full set of the, the algorithms as actual code that you can just simply import into your HTTPS server. So pretty slick. However, in TLS 1.3, which I think Go just mess of these algorithms is totally very simplified. So I highly recommend reading up on that. It's kind of a void having to do with this big mess. So, of course, open source. I'm very much proponent of using open source tooling for these kinds of things. And we're always looking for contributions in this case. I am not a maintainer in this project, but I do know one of the maintainers. So I do like to go in and help out every once in a while or find issues or recommend feedback. The documentation is a little weak. That's one of the areas I'd like to see improved. And maybe the, you know, like was brought up here. I'll take that back to something to enhance. So the third one I want to talk about is ESLint. It has, so ESLint is for JavaScript of course, but it has a plugin specifically designed for security. And this project started around the same time as these others coincidentally, but it runs on all the platforms you can imagine. It uses a different system to ignore false positives. It just says ESLint disable line. But, however, it gives you that granularity to define, I want to ignore this line and for this error code. So you get that granularity. So it's a little better in that regard. And it uses a config file system also. And I think you can do it without it, but you define it in your project and it works quite nicely. One of the things it does that I really think is cool is it has this auto-fix feature so it'll suggest fixes based on what's reported. So in the case of like weak cryptography, you might say, I don't think it's a scam for that, but if it offered like, hey, you should be using a higher bits here, that would be awesome. In terms of formatters, it pretty much supports the world of formatters, just everything you can imagine because they've integrated it into everything you can imagine because ESLint is very widely used. The issues are fine. So a lot of these are kind of UI kinds are related. So that cross-site scripting problems, like if you didn't escape your markup, you'll find issues with that. Types of injection are slightly different here. So if you have like a variable that you're passing to a require statement or a reject, it'll flag that. And it flags timing tax, which is kind of interesting too. You don't see that with other inlinters. So it's integrated into Sublime, into VS Code and to Atom. So it covers a lot of the major IDEs that people use. Looks just like the others, right? This is Sublime. Flags is the line of code. One of the weird things about this specific plugin is that everything comes through as a warning. There is no differentiating on the severity level. So that's unfortunate. But this is what VS Code has native ability to suggest a fix. So if you click on the quick fix button, it'll actually tell you how to resolve this error, which is neat. In this case, it's not quite handily pretty nicely because it ends up saying to comment out that line, which, you know, it'd be better to get a more appropriate. Okay, here's another quiz. So this is JavaScript this time. So anyone have any ideas? There are actually three problems in this one. Any JavaScript pros in the audience? File path? You know what, it does not, and it probably should. Unfortunately, that isn't one of the things this plugin is scanning for, but yeah, totally agree. MD5 isn't something people should be using nowadays. Yes, that's one. So if we look, if I blur out the rest, yeah, so either require on that. So there's a variable being passed through the require, that's bad. There's a variable being passed into this load, which is applied for object injection. So if that variable came from input from a user, that's potentially super bad. And that pseudo random bytes, right? That's something not to use. You should use the true random. And when you run it, I don't have a video this time, but when you run it, this is what you get. Like I said, they all come out as warning, which is unfortunate, so there's no way to know which is more important than the other. Put the flags off three. Again, open source. One of the major downsides in this case is this was maintained pretty well up until recently, and now the maintainer's kind of been ghosting the community, I would say. There's questions on whether or not it's still being maintained, and there are actually issues asking about that and not getting a response. So that's rather worrisome, because there really isn't much in this space otherwise. And I already mentioned how the severity is a little lacking. But additional tests like this MD5 would be really useful to add to that. So at this point, I'm getting pretty repetitive with the different liners, so I just wanted to point you guys and gals to other sources of information. So if you go to the awasp.org, there is a really great list here of all the open source static analysis tools. So if you see, it recommends a foie finder.  And there's Ruby in there, and there's a bunch of others, but I definitely recommend going to there and learning more. Finally, I wanted to talk about precaution. So this is a project that we started. It's totally open source. It started within VMware, but we threw it out on the web on GitHub. And what we try to do is create an abstraction to take all of these existing linters and run them within a GitHub app. So that's what it is. We started late last year, so it's very new. It uses a new API that GitHub provides called the Chex API. Travis, CI, and these others have this Chex API that they integrate into in order to annotate code in your pull request. So it will, whenever someone smits a new piece of code to your repo, once this is installed, it'll automatically run various linters, depending on what languages you're using, flag the issues right in the code changes. So I can show you some snapshots of that, but it only supports Python and Go at the moment, but we're adding ESLint, and we want to add a wide spectrum of languages. This is a, let me play the video. This is a short video of me creating a pull request on this file. So this file already has some issues. This is Python again. But it's using weak cartography. I'm going to go in and make it even weaker, change even more lines, and create a commit out of it. Almost done. There we go.  Create the pull request, and boom, this is the pull request created, and if you wait a few seconds, it'll actually start precaution, so you see that precaution is starting. It takes only three seconds to run, which is pretty quick. If you click on the details, it'll take you to the checks tab, and that's where you get the summary of all the issues found, and a total count of these issues, including more information. But what's really cool about this, I find, is that you click on the code changes tab, and then you can get, then you can see line by line what may be introduced in your code stream. So as a code reviewer, this is a great tool to run, because I have a tool that's automatically gonna scan code from other people prior to me reviewing it, and flag potential issues. And you can actually, so actually if you need more information, there are links that'll link to whatever linter you're using on the covers, so in this case it's using Bandit, links to the Bandit documentation from there. But yeah, the whole purpose of this is to make it even easier for people to use and secure their code when you're using things like GitHub. And so finally, this is an open source project too, so we welcome contributions. And we wanna add further languages, we probably Java's next, C++ is next after that. And it really lacks a configuration mechanism right now, so we need to add something along both lines. But one of the neat things is you can add a branch protection rule, just like you would with Travis CI or something in your GitHub, and when percussion runs, that can prevent any pull requests from merging if it finds problems. And that's all I have, there's my contact information if you wanna reach out, and otherwise thank you for your time. I'll take any questions, yeah? Any questions? I wanted to. I think the OWAS recommends spot bugs, so I haven't tried it out myself yet, but we'll definitely be looking into it soon. So I'll give that a shot at first. Here was the other one, yeah. Yeah, I am not entirely sure, 2008, this one. I think some of these exploits just didn't exist at the time, like maybe new techniques were fine. Yeah, I think that's why. Yeah, I mean there were some technologies that didn't exist back to the server, but that's actually kinda, I don't know, my question. Anything else? All right, guys, thank you. Test, ooh, all right. We're gonna do this to actually start for a couple of minutes. Hope everybody's scale is going well. And I know this is the first presentation after lunch and the last day, so I'll try to be quiet so I can get a nap in if you need to, but I don't promise to actually achieve that, I'll just try. Do you wanna thank you for, oh, see? Do you wanna thank you for coming out? I do have a few, I'm doing this on my own, so I do have a few giveaways I'll give away as we go. I stole a penguin from Linux Journal. Anybody wanna penguin from Linux Journal? Ooh, you can see why I was second team in court in football. And then I also have some GNU Coasters that I made. So we'll give, we'll toss these, well, I'll not toss them out, but maybe I want a GNU Coaster. Yeah, what do I do? I'll give you one, but you gotta, one of you has to earn it by taking it to the other one. One person come get it, all right. Okay, I've got two more of those. If I forget, come get them afterwards. There's one here and I put one on display. Hey, so, all right. Let's see if we, oh, we've hit the point of time. We could actually start. I'll give it just a second.  So again, thank you for coming out to scale and sticking it out through the last day. As a start, I do wanna go ahead and plug software freedom conservancy. A lot of the fans will be, Bradley's doing a presentation right now over in the other building, so they probably have a bunch of people over there. But they do a great job of helping us with software freedom, and they are non-profits, so if you'd like to support that, Software Freedom Conservancy is a good organization to make some donations to. And then where do I come from? So I've been, I've done everything in technology. I've been a system administrator, I've been developer, I've been a manager. I've been CTO for a small company. I've done a lot of different things over the years. DBA, taught at a community college. Taught at a lot of different companies, internal training. So I've been doing just basically free software, work everything for many, many years. And I've also been doing presentations at conferences, scale has been fantastic. I've presented here for 10 or 12 years or something like that. So, but I also have spoke the last few years at Siegel. Last year, it was actually an awesome, I got an opportunity to speak, to go to a library planet and they accepted to talk. So I really had to show up, that was really nice. And over the summer, I actually got to speak for the first time on a different continent. And I got to speak at Tubics and do a couple of presentations in German. One that I did here last year, and then a new presentation on one of the tools I'm gonna bring up. So anyway, so I've got a bunch of stuff with that. And I've been trying to do more evangelism and advocacy for free software on my own time. For that, I started the Flock's Advocate. And my idea behind Flock's is we talk about free, liberate, open, but it's not just the software. I mean, we've been doing software stuff a long time. But we also need open hardware, we need open firmware. You need the whole stack because if your software is open but your hardware is spying on you, or your hardware is just doing things you don't know about, you can't fix, we will talk about the evil of IoT, then it's good to have, to look at that whole thing. So my idea was X is everything. So free, liberate, open, everything. All right, so those are both masses on instances. So you can get ahold of me that way. At the end, I'll have some more information about IRC and other ways of getting hold of me if you want to. All right, start off, I am not a lawyer. Specifically, I am not your lawyer. So I'm gonna talk about security. I'm gonna make, my suggestions have to do with technology and technology decisions. Some things, depending on who you are, where you work, et cetera, might have legal implications. If they do have legal implications, don't talk to me. Talk to somebody else. For instance, EFF is probably not your lawyer, as we have an EFF jacket out here, but maybe they can be. So also, specifically, the surveillance self-defense guide from EFF is a great resource. I had proposed this talk to Liberty Planet and gotten the accepted Liberty Plan and I was working on it and I had a whole bunch of it written and then they announced the surveillance self-defense guide and I was like, oh, I can just tell people, go read that. We're done. So it is a fantastic resource and breaks down into detail. A lot of things, I'll cover a lot of things beyond what I'll cover today as well. So, all right. Also, I have another very huge time-saving tip for personal security. Just by New Harbor. Pipeline speculation happens. So for those of you that don't quite catch what that is, maybe the next slide will do you. Remember two words when we're talking about security nowadays? Meltdown Inspector, okay? So this is from a year ago. We learned about pipeline speculation where your CPUs are now able to spy on you for other people. It's awesome, great feature. In the last week, we've had a Meltdown Inspector related new bug come out where somebody was able to figure out a different way of exploiting pipeline speculation. So even our CPUs can't be trusted at this point. We're not even talking about firmware. We're talking about the actual CPU, the actual hardware is a problem. So that's part of why I said, I want to start doing blocks where we're talking about the whole stack, all right? So for this talk, there's actually two other words that are better for us to think about. And this is the thing that you should be thinking about in regards to everything I say and everything that you're, whenever you think of privacy and whenever you think of security, these are actually the words that are most important for you as an individual or for your organization, depending on what hat you're wearing. And that's threat model. So threat model is what are the likely security threats that you personally need to worry about, right? So for me, as a normal person, I want to worry about whether people are spying on me through my phone, whether somebody's trying to break into my SSH server or things like that, right? When I was an IS manager for Canonical, my credentials had access to the drives. So using my account and more knowledge than I admittedly have myself, you could go change any bit in the repos, all right? So my threat model went up quite a bit when I had that particular job. When I was going through and pulling student data for Cisco, I worked for Cisco for a while and I was pulling student data for people to go analyze how the coursework was going, my account had access to a whole bunch of private data that I needed to make sure was staying secure. I wrote an external article about that without specifying it. I said, if you have a compromised server, well, the compromised server was Cisco's own bastion host. Nobody had broken into it, but the guys that had root, the people that had root on that server did not have authorization to look at the student data. So I needed to be able to move data across that host without letting them hit that. The way I did it is I created an SSH tunnel that went directly from my box, my laptop, to my box inside the network using the bastion host as the crossover. But I needed to make sure I had a secure tunnel between those two boxes so that the bastion host couldn't read it, right? So you gotta think about the threat model for what your particular position is, both for your data and then the data for anybody that's entrusting you with their data by virtue of your job or your position. All right. So what is being threatened? This is a great article from Matt Honin. It's a few years old at this point, but it really points it out. So some guys thought Matt had Matt at Twitter.com or something like that. So he had a really short handle and had a couple guys that thought, oh, this would be cool if we could steal that and use it to post things about some, the cockroaches are gonna take over, whatever their political thing was, right? And so they broke into various accounts of his just to get control of his Twitter handle because they thought it would be fun. Well, once they got into his Gmail account, they could have used that then to send email from his account to all of his friends and family. Since his Gmail account was being used for his credentials for his bank and all these other things, they could have also started going after other accounts that he had using that. And then really one, the biggest one for him was that one of the two guys, just for giggles, decided to go through and start deleting all of his data. Amongst that data was the only pictures he had of his daughter that they were wiping out because everything was on the same service. Go read the article for information about the service and stuff like that. So, as a parent, I would hate that if somebody went through and destroyed all of the pictures I have of my kid, right? When my kid was born in the first 24 hours, we had more pictures of my kid than there are pictures of me up until now for my entire lifetime, right? And it would be, I would hate that if those were all gone. Luckily I spread them out amongst different places and stuff so I've, you know, aside from, you know, the city I live in completely ceasing to exist, I will have, you know, copies of them. And even there, I've got some copies outside of that area as well. So types of threats, theft, right? So we think about, you know, you hear a lot of people in digital say, oh, it's not really stealing because you still have a copy. Stealing means that they take your use of it. I haven't come up with a better, simple analogy. And then when it's your data and somebody has a copy of it you didn't want, that's still theft, I mean, from your perspective. Sure, maybe you still have a copy, right? If they hadn't deleted Matt's pictures, they could have still made copies of all of those, right? Now, unfortunately, they went into loss, right? Somebody destroyed his copies of it. And because he was a reporter for Wired, he was able to get quick responses from Google. He was able to get quick responses from Amazon and from Apple because of his position. Most of the rest of us don't have that, right? I come speak here every year for a decade plus and I go speak at these other conferences. If I was relying on Google, I'm not picking on Google, but if I was relying on Google for something and my Google account disappeared, I don't have a way of, I'm not in a high enough profile to get any attention whatsoever, right? Most of us aren't. So, you gotta think about what is that threat model to you for your particular data? So theft, somebody gets a copy of something you don't want them to have a copy of. Ask Mr. Bezos what that can entail. Loss, somebody destroys all your copies of it. Maybe he would prefer those copies were completely destroyed, never to surface again. And then spying. So somebody is looking at your devices and tracking you, right? So now spying, we already know that happens, right?  If you have any voice control devices in your home, those are spying on you. And I'm gonna bring this, I'm trying to remember to bring this up later on too. They're also spying on your guests. Or even if you don't have one, you go to somebody else's house. Their devices are spying on you, right? If you know people that have reading doorbells saying or whatever, they're spying on you. If your neighbors have that, they can track when you're coming and going because they can recognize your car. So all these other devices are spying on you, not just yours, other people's stuff as well. So those are things to think about for your threat model, right? What data do you have and then what kind of loss can you have? So what kind of attack might you take? Some threat model examples, TLA. So most people don't need to worry about a three-letter agency knowing who they are, right? Once a three-letter agency cares who you are, probably you've lost, at least in this country, right? If the NSA wants to know more about you, the NSA is gonna know more about you. They have more resources than you do, right? You know? So most of us don't need to worry about that. Mr. Snowden does as has come out and there's a few other people. Chelsea Manning got a reminder of that recently because she's doing some, she's in jail again, right? And then she's refusing to testify, right? But the fact that they cared, she's high enough profile, they can get more information if they want to, right? TSA, now this one actually caused me a problem. Theoretically, they just get your hardware for a short period of time as you're going through the check, right? Well, unfortunately, one time to me, they flipped an empty bin over the bin that had my laptops in it and walked away with both bins. So my laptops disappeared and I didn't catch it. So my own fault, I didn't realize what happened. I didn't realize that they took the bin with the laptops and I didn't realize that I had not repacked my laptops when I walked away. So they had my laptops for a while. I don't know what they did with it, right? I know that certain three-letter agencies have far more capable and knowledgeable people than I do, not to mention, boatload more resources, right? So that can be a problem. You've got to take personal accountability for your own devices and I failed there because I didn't realize what they were doing, what happened. I think it was just a mistake. I don't think they actually did it for nefarious reasons, but I can't prove that, right? You also have the aspect of like a nosy neighbor, somebody that keeping an eye on you, whether it be an office mate where they can see your system while you're in your cubicle or people that are walking by while you're at a cafe. So keep in mind, and nowadays it's not just a person, right? So the old, I think it was sneakers thing where they're able to zoom in and see what the password is when the guy types it and stuff. Nowadays we have surveillance devices everywhere. We have security cameras. Well, if you're typing a password, somebody can go through and zoom in with a security camera and figure out what your password was. So if they can track other information about you so that they can use your credential, tie that with other parts of your credentials, they can potentially get a hold of your account, take control of your account. Fishing, so we get two different types of fishing. We'll talk about fishing, spear fishing. So fishing is just casting a line net. Spam people and see what happens, right? This is the malicious software type of stuff. Also the, oh, you're running out of space in your account. You need to log in or somebody's attacking your bank. Follow this link that for some reason goes through Russia or China to get to your bank and log in so we can make sure your money's still there. Oh, guess what, it's not, right? So you get the fishing type of stuff. We also have the spear fishing as in this country both political parties have learned over the last few years as they've both been attacked. Also a bunch of different county recorders and so forth, so voting pieces. And a bunch of high profile companies have learned, right? Where somebody's gone through and gone for credentials from specific people, from specific roles within organizations so that they can break into the organization. And then espionage, directly and intentionally attacking you, this kind of goes with the spear fishing, but I'll give a specific example. So this happened a few years ago at Intel, more than a few years ago at this point. But a foreign agency, so foreign country, paid to send a bunch of their software engineers and hardware engineers over to the US to get jobs as janitors. And they wanted to make sure they had people that were sufficiently knowledgeable in order to look at the screens and figure out what would be good capture. And they basically, as they went through gathering the trash, they had the big trash cans, they mounted video cameras on the side of them. And they just went through and did video camera screen captures as they were wandering around Intel for, longer than Intel will admit. So if you've got those types of government resources, again, you've got that, so again, talking about threat model, most of us don't have to worry about that, but I wanted to cover the gamuts, right? And we just didn't have to worry about that because he pissed off enough people in the US government that, you know, there's significant resources after him. Julian Assange is getting a very, very direct reminder of that daily, I think, at this point. Threat modeling basics. So identify the assets at risk, envision potential attackers, determine the acceptable risks, right? You can't make things, a bank's job, when a bank is holding on to $2 billion with a gold bullion, the job isn't to make it to where people can't steal the $2 billion of bullion. The job is to make sure it costs $2.5 billion in order to steal the $2 billion of gold bullion, right? You can't make it impossible. The goal is to make it more costly than in what it's worth, right? So, you know, but it's gotta be what it's worth to the other people, right? So envision potential attackers at the acceptable risks, determine the acceptable precautions. What are the things you're willing to do, right? So you say, okay, I wanna make sure that people can't gather my password. Maybe I'll just put my hands over the keyboard while I type it, right? Maybe you say, I'll do two factors, right? Maybe you say, two factors, too much of a pain because I'm always losing my phone. So, you know, you gotta look at what are the acceptable cautions you're willing to take. And then AARP, because I'm getting kinda old so it seems like it's appropriate, assets, attackers, risk, and precautions. Those are the four things we're looking at. So determine your threats. I'm an older, not-svelte young man, right? So a heart attack is a big threat for me at this point in my life. What time of threats do I personally have? Now, several friends of mine recently have been diagnosed with diabetes. Did my threat of diabetes go up? My threat of diabetes didn't change. I'm still old fat male. I still have a pretty high threat of diabetes as well. But my awareness of the consequences of diabetes has gone up. And we see that a lot of times. Something comes up in the mail, oh, they're doing spear fishing or they're doing fishing attacks and we get worried about that. But think about what are your actual threats? What are the things that matter? And it's just because you're aware of it doesn't mean that you worry about it came up, right? Don't worry about the thing of the day. Look at the long term. Because if you think about the thing, it's the same thing with IT support, right? Do you spend your entire day chasing tickets as they come in? Or do you plan things out and take care of the problems? If you're just firefighting, you never get anything taken care of. You gotta fix the actual problem. So remember, for your security, for your privacy, think of it the same way. All right, some types of data, financial, banking, information, things like that. Locational, where are you? Does that, you know, it doesn't matter whether or not people know where you are and contract that over time. Medical, so your medical data you probably don't really want, you know, put on a billboard somewhere. And then authentication, your credentials, because those protect all the other types of data. Now privacy and security. Now notice I say bull. You hear a lot of people say, oh, it's a trade-off. Everything in life is a trade-off. But you can have both, right? Again, go back to what are the precautions you're willing to do. First of all, security updates, if we just see too much of it. Install your security updates, right? And use only trusted software sources.  Use this, get the security updates from your distribution. And I recommend going through and setting it up so you can get only security updates from that particular distribution if you can. See some of my posts elsewhere for how to, in fact, my talk on Thursday, for how to do that with Debian. Debian makes it easy and yet difficult. But you can get only security updates and make sure that you're getting those as quickly as possible. And then you can worry about other updates later on if it, whether or not they matter for you. And you wanna get those security updates as quick as possible. Especially nowadays where zero day is one of the favorite words in the language, right? Or we keep thinking things and coming out. And like I say, even the CPUs can't be trusted at this point, right? So encryption and privacy, you have at rest. So when you've got it sitting on a disk somewhere, and to some extent sitting on your monitor, right? In transit, you're copying data from one place to another place. So if you log into your bank, your credentials are going in transit back and forth. But also then, so is your banking data, as you're getting that from the web server to your web browser. And then third party, this is something I think that a lot of people don't, we talk about it, but we don't think about it in terms of threat model. And I like to do that. So I've got an account with a bank, but who are they sharing that data with, right? And my particular bank isn't doing too terribly much, but we have lots of other places where we have personal data that we might, so if you've got someplace where you're storing your pictures in the cloud somewhere, somebody's holding on to this for you, well, who else has access to these pictures? Your social media stuff. Your social media stuff might have your locational information, right? If you have a Fitbit or other type of device, who else is getting access to that location information, right? As it turned out for the Army, Al Qaeda, and that caused a problem for them. As the secret base that nobody knew about, suddenly everybody knew about. So where is that information getting shared? So third party, one of the things is cloud, right? Cloud is forever. When you put data in the cloud, there are certain things you go through and change it, and you think, oh, it's gone. Well, they have backups. They have retention and stuff like that. Last year I was talking to somebody about Dropbox, and Dropbox has a mechanism, apparently, where you can, two weeks after you've deleted data, you can get it restored without having to ask anybody. Well, up to six weeks after that, if I remember the numbers correctly, you can contact them and they can still get it. So that means that even though you deleted it, it's not gone, right? There's still copies of it up there. And not picking on Dropbox, just talking about their particular model. So think about, you know, when you, if you're using, if you keep a, if you have a password manager that you're using, and you find out that somebody's gotten your password on it, you go change the password on your password manager and update that to your cloud instances, there's still old copies with the old password on there. If somebody gets a hold of that, they, and they have the password, they can still use that old version of it, right? You updated your version, but doesn't mean all the other versions got updated. So don't rely on cloud. If you, if you wanna make sure your data's secure, make sure you're making sure your data's secure, but also don't rely on cloud to delete things to not have it anymore, right? Corporate affiliates. So who, who else is the company sharing data with? You know, and who else is getting, getting information off there? I will pick on a particular company in a little bit. Advertising networks, right? So which advertises somebody recently asked for all their data from QuantServe? And everybody, everybody know what QuantServe is? So QuantServe is a company that does tracking from site to site to help people for advertising and other things like that. It's one of the, one of the domains that I flat out block because I know exactly what they're doing, right? So this guy was a privacy person who, who should, you know, works for privacy international or something like that, went and asked for his QuantServe data and found out how many things he done. He's like, I didn't realize I'd been to that bar that many times and things like that, right? By, by pulling that. And it's spying at you from, from multiple sites and pulling all, pulling all that data together. And then IoT, the little spies who infiltrate. So I already talked about devices that listen to you, right? But you also have other pieces in there. IoT does not, does not get updated very well. They have lots of security problems and most of them are sending data to the cloud. At Seagull we had a talk, somebody who talked about getting camera, he got a little security camera and then started looking at what it was doing and it was sending all of his data to a site in China. It was unencrypted and it was non-random IDs or you know, not random enough IDs. So he could then figure out who other people's accounts were and start using their security camera to spy on their house for them, right? And there was no way to, to turn that off. There's a lot of IoT devices that if you just say, okay I'll fire while, so it can't talk to the internet, they don't work, right? So they're dependent on being able to get to that third-party service and if that third-party service goes away, like the company goes out of business or the FBI is like, oh we're tired of this and they shut them down, then that IoT device stops working, right? So they're taking that information and then like I say, depending on what the device is, if it's a camera, if it's something that's listing, it's spying on your friends, spying on people that visit you, spying on your neighbors or their devices are spying on you as well. And then we have the browser loophole, the email loophole is very similar but I'm going to talk specifically about the browser loophole. As I put here, it's like a first grader, it lives inside your firewall and imports lots of viruses, right? Brings whatever's in the playground into your home. Isn't that wonderful? Or into your workplace, as the case may be, right? So you can lock down your network. My local network, all my traffic, all my local traffic is over SSH. Everything I do is over SSH. But if I've got a browser that's compromised that then compromises my operating system, they can then use that access to spy on my SSH connections. And through my SSH connections, they can have access to all my other devices, right? So this is a significant issue. Browsers try to make sure that they're secure and they kind of do a good job at there's some other issues that are going on. So a couple of the trends that we have in browser, to me, privacy issues and stuff, there had been a spate in the last 18 months of people using JavaScript to crypto mine. So you go look at a webpage and it uses your computer to mine Bitcoin for them, right? So you're paying for it and they're getting the results out of it. You also have the ransom encryption stuff that's going on. Some of that has been JavaScript delivered, mostly on an operating system that hopefully most of us are not using, but there has been some of that. And of course there's spying. Again, the QuantServe and things like that, but also if they can use that to break out of the sandbox. And then IoT is also an internal outside risk. It's gathering data from inside your network and sending it off network. Cookies, oh there's so many options for cookies. Cookies are good, all right. So you get the traditional cookies, which is storing a small piece of data on your computer and then broadcasting that back to the site so they can track you, right? For QuantServe, it's coming from multiple sites back to QuantServe so they can track you across multiple sites. Not picking on them particularly, although I have no problem with that, just they're the ones that were in the news recently. So I recommend a browser plugin called UMatrix. I use that in Firefox, it's also available for Chrome and Chromium. And UMatrix, if anybody familiar with NoScript, it's been around for many, many years. NoScript is awesome, it was the absolute minimum browser plugins I had. When Firefox moved to the new model, NoScript was not quite available. So I looked around for other solutions because I'm like, I'm not going without a JavaScript blogger and a friend of mine recommended UMatrix and it's fantastic. It's like NoScript, but much easier to use and it also does cookies and a whole bunch of other things. So it blocks XHR, which is callbacks separate from JavaScript, JavaScript and some other things. Now I did find out recently, I had not realized this, the cookie blocking it does, it actually allows the cookies to be sent, it just doesn't allow them to send back to the corporation. So JavaScript can still look at, I'm kind of worried about a little bit of data exfiltration that way, but they're blocking the cookies from going back out straight. So anyways, it's great, it's easy to use, I do a presentation on it, but you can also find some good guides on it. Now Flash cookies, most of us should not have these anymore because we don't need Flash, but it finally, finally fees go away. But Flash cookies, Flash puts cookies in your home directory, so if you have multiple browser instances as I do, they are shared amongst all those browser instances that allow Flash. I actually have one browser instance that's allowed to do Flash, so I don't have to worry about it too much because only that one thing can. I haven't actually opened that instance over here, so I'm succeeding. Super cookie is what I'm calling the ISP based stuff. So Verizon was setting up a super cookie, so if you go through and browse something from your phone, basically external to your phone on the network, they add a cookie to your HTTP request, and that cookie is unique to your phone, so it doesn't matter what set you go to or anything else, it can be tracked back to a particular device, and you can't do anything about it because it's upstream of your phone. One of the things you can do is set up a VPN, so they're not seeing browser traffic, they're just seeing tunnel traffic. So your browser connection, that HTTP connect request doesn't actually go to Verizon, it goes to your VPN over the tunnel, and that way they're not going through and adding that, and Verizon isn't the only one doing it, they're just the ones that have been called out the most on it, and had some unfavorable responses publicly, as far as I'm concerned. Tracking pixels, also known as web bugs, beacons, clear pixels, and 400 million other marketing, so of course they have multiple terms for it. So again, U Matrix is one of the ways of blocking that, blocking those, but those are then sites that have just a single pixel, so again that external site can go through and look at you. An example I'll give is a company actually like, so I like New Egg, New Egg's done a lot of really good work to fight patent trolls, and they've done some nice stuff, and I've been mostly happy with their service, other than their web page sucks, their website sucks, it's gotten better, but it still sucks quite a bit.  Now those mostly don't affect me, because I have all that blocked, but if you ever go look at all the different calls they have, and all the different cookies they set, there's a lot of tracking on the new egg site, and I'm gonna keep saying things bad about them publicly until they change it, so which means they'll probably be, my final thing will be New Egg's site sucks, because I don't think they're gonna change, but I'm gonna keep trying, especially since I, as a customer, I would like them to be better. I avoid buying from them sometimes because I'm annoyed at their site. And then browser fingerprinting, and this is somebody who looks at all the data from your browser when you make a web request, and try to figure out if they can make a unique guest to how unique you are, right? So if you go through and make sure that you can have Icelandic and Caribou, your foreign language, I don't know if Caribou's an option, but let's say it is, then they can look at that and go, well how many other people have Icelandic and Caribou as foreign language options, right? They can look at what your dimensions are in your browser, a whole bunch of other things. Panopclick is a browser plugin from EFF that will help you see how unique your browser looks to that third-party web server. Broly, okay, oops, sorry. Privacy and security add-ons. So U Matrix I mentioned, no script plus plus. It's got a better UI, controls JavaScript, cookies, iframes. Go look at some more information on that. HTTPS everywhere, also from EFF, that is a tool, a plugin that will try to redirect all browser requests to an HTTPS, so a secure connection, if available. It's doing it via whitelist, and the reason they're doing it via whitelist is, let's say, okay, FSF, www.fsf.org, as it turns out, HTTP and HTTPS on that particular site return the same site, right? But for years, we often had things where the HTTPS site was only for internal stuff, so it was actually a different site. I think that was the foolish decision, because it's confusing, but that was still the case. So EFF is actually maintaining a whitelist of, when you go for www.fsf.org, oh, it's okay to use the secure site version of that, and they're doing that. But it also gets to where when you just type FSF.org, and then their plugin will say, okay, let's go look for the secure version of that particular site. If somebody links to the non-secure site, again, they will intercept that and try to go to the secure version of the site. So it helps you from inadvertently going to non-secure sites. And it does some stuff to block JavaScript and search as well. Since we're talking about, I'm talking about more client side, but if you're running a site, whether that be personal or for work, Let's Encrypt is doing a great job of making it easy to automatically and for no financial cost, get SSL certificates that work in the browsers. So if you have your own website, or if you have your own website for your local log or whatever else, you can use Let's Encrypt to go get a certificate so you can set up a secure site as well. All right. Privacy Badger, ad block, ghostry and other things like that are specifically set up to block trackers and block advertising. And that's what they're actually doing. I have used, I haven't actually used ad block plus, but I've used Privacy Badger and ghostry. I have actually mostly disabled those because I'm taking care of it through U-matrix, but I'm less concerned about ads and more concerned about spyware. I don't mean mind seeing the ad so much, but I just wanna make sure they can't do anything nefarious. Then Lightbeam is a really awesome plugin that will let you see what kind of third-party connections your browser's making. So when you go to, if you go to New Egg with U-matrix set up, or actually U-matrix is a lot more, so let's say NoScript is much better. So you go to New Egg with NoScript enabled, New Egg is bringing up a couple third-party sites. And then if you go through and enable all the JavaScript and NoScript and say just let it do all the things it wants, it goes poof. And that's when it starts talking to six different sites and sharing data with Facebook and Tinder and the NSA and whoever else that they're allowing to speak on their site, right? The Lightbeam is a great way of seeing that. You can go in it with it, your security stuff turned on and see what connections you've got. Disable your security stuff, reload the page and then go back to Lightbeam and see who's being allowed then. Sometimes you have to allow it a second time because it pulls up and goes, oh, we're gonna allow Facebook, but then Facebook allows something else and that allows something else. So you get multiple layers of third-party, so you get third-party, fourth-party, fifth-party type of spy stuff on there. This is the U-matrix interface that I mentioned. Just a quick sample of it. Again, for the SFS.org, by default, for the site that you're visiting. So what they call the first-party. So for fsf.org, by default, it allows all the things. It used to deny frames. I guess they're allowing that now. It allows all the things, so it's JavaScript, XHRs, and there's callbacks and stuff like that. And then it allows CSS an image for any site, but only those. It blocks all the other things for all the third-party sites. I go through and remove the rules that whitelist all those things. So even for the first-party site, I only allow CSS an image and then go enable JavaScript if I need to. So for the fsf.org site, I think it works just fine without JavaScript, if I remember correctly. There are lots of sites that do, but some of them, it's just the nature of how the site works. So you can, if you need to go to the site, you have to allow it in order to work. But again, this makes it fairly easy to see what's going on, and you click at the top to enable, click at the bottom to disable for each of the things. Play with it, and it's fairly intuitive. Browser profiling. So one of the things I do is I use multiple profiles. For my bank, I have a profile that only talks to my bank. It doesn't talk to Facebook, doesn't talk to any other site, so that if I get broken into because of some JavaScript issue, it's my bank's fault. They're the one that was hosting the malicious JavaScript, or one of their partners. And since I block most of their partners, I don't have to worry about that too much either. My particular bank actually doesn't have partner stuff except for a couple of services where they go off site for it. And then I also have one, so I do a lot of mastodont stuff. I have an instance just for mastodont. Actually, I have multiple mastodont accounts, so I have an instance for each of the mastodont accounts for different reasons. I have an instance that I do all my web searching on that doesn't allow any cookies or JavaScript or anything from anybody, and I keep getting ads for completely irrelevant things. So it seems to be working in that I don't keep getting ads for the things I searched for yesterday. It's one of the reasons I don't mind the ads so much because it's my way of tracking the tracking. I get to see what I'm getting through. If I start getting ads for stuff I looked for yesterday, I know they're able to better track me and better target me. Use different profiles for different things. And say if you're using web mail, same thing, we use Gmail for some of the stuff for scale. So I have a Gmail account set up and the only things that go into that particular browser instance are the scale related G products because we use a couple of other products besides the mail. And if you want, I didn't link it anywhere, but I actually have a script that I wrote and I put on GitLab that makes it easy to create new profiles and to choose a profile from the command line. And if you have to have Flash, set that in one profile and don't allow it for any other profile. Pan up, click, I mentioned. Another way of doing that is setting up a bunch of different profiles. There's Firefox containers. So I've been doing the different profiles with that script for a decade plus. Firefox containers are relatively new. I think they've only been around for like five or six years. So that's a way where the browser is keeping that isolation for you. It has not worked the way I need it to work for my particular personal use, but it might work well for you. I'm actually trying to figure out a way to use the two together so I can, some of my one-off profiles and I don't need to have a completely separate profile. And then of course you've got OS containers and virtual machines. I actually, for some of my browser profiles that I want to keep extra separate, I keep those in a container and then I SSH into the container and bring the browser and it's just back to my desktop. So I make sure that even if something happens that it's even harder for them to escape the sandbox because there's a sandbox inside a sandbox inside a sandbox. If you've got hardware that's supported, you want to play Cubes. I hear a lot of good things. I haven't used it myself, but that is trying to make it very automated to where everything that you open up starts up in its own VM and you can do firewall rules and they're trying to make it really, really easy to go through and do security stuff without having to be an expert in firewalls and stuff. Authentication, password manager, please, please. Use a password manager and unique strings everywhere. I had, you know, you get in the mail recently about we know what your password is. I don't. My password manager does. I have never seen it. When I see that email, that might be the very first time I've ever seen that password if they did actually get my password from some site, right? So key pass X, key pass XC, the C is a community edition where they're doing more changes faster. I've got some, there's a couple of bugs that are hitting me really hard right now, but it's a great tool and there's also available key pass droid. There's a couple other ones available for Android that will allow you to use it on your phones and tablets. Use random strings everywhere you can. User names, sub-addressing, if you don't know what sub-addressing is, go look at that. I think I've got an example later on. Use random strings for your security questions and answers, right? If it gives you a chance to say what is your security question, give them a random string, you know? What color elephants? You don't need that. Give them, you know, staple horse battles or whatever the thing is from XKCD, right? Yeah, correct, but yeah. And then the other is, if you do use security questions and answers, though, try to get something that's pronounceable. So multiple words is probably a good thing to do that instead of just complete random jid-rear string because you're gonna be using that on the phone. And especially some security questions, somebody needs to ask you that, be nice to them. They're probably not making that much money and if you're talking to them, you need them to do something for you. So give them something they can pronounce. Even if it doesn't make sense, give them something they can pronounce. And of course, birth dates. Why? Back to the, I'm not your lawyer, but why if you can? In my key past presentation I did last year, I point out, you know, I can get a free dinner at a restaurant every month of the year, right? Give them a random date. For certain organizations, banks, and things like that, you can't lie. But for the things that you can, where I had a thing for my kid recently, where they wanted to know what my telephone number was and what my birthday was. And I'm like, they need neither of those things. So I called the PTA, and it turned out to be a friend of mine that was in charge of this and said, hey, there's a problem. She's like, well, do what I didn't mind. I'm like, okay, but they shouldn't be asking the question. But yes, of course, that's what I'm gonna do. I think I was born in the 1920s for that particular application. All right. Oh, for the birth dates, do be cautious. I've got a one-liner that works pretty well. And if I remember correctly, my one-liner sets it up to where you've got to be at least 25 years old. So I had a place where, because I wasn't allowing JavaScript, I had to, and this was for work, I had to go back one month at a time to select my birth date. And so I clicked in. I was like, this is for work, so I'll try to get something appropriate, approximate, right? And I clicked for like 10 minutes. And I finally was like, okay, I know they're paying, but this is just wasting my time. I selected whatever date I had, right? Turned out I had chosen a date where I was 14, and I couldn't get access to the thing I needed to get access to, because it required being 18 in order to access it. And then there was no way to change it, because your birthday doesn't usually change. Luckily for me, it was in the hidden field, so I was able to bring up a web browser editor and change my date and hit reset or whatever submit, and it went through and changed my date that way. I'm like, oh, I should have done that way to begin with, it was easier. All right, but lie about your birthday, if you can. Lie about your shoe size, right? Multi-factor. So SMS is not safe. We got 400 examples of SMS as not safe, not secure. People can intercept it, people can give you spoof stuff. Don't use SMS for two-factor. If somebody's requiring that, remind them that was a bad idea. I had a previous recent employer that was the only option we had for it. I reminded in for a sec, it was a bad idea. I called them back and reminded them again. I had to use it, but I was like, if there's a problem, I'm gonna remind you it's your fault, right? Use time-based, multi-factor, TOTP, there's the Google Authenticator. There's a couple of free software applications that will take care of that. They work really well. That's what I use, what I recommend. Hardware tokens, they're doing the same type of thing. You can also get tokens that you use on your laptop. All right. Secure connections and tunneling. HTTPS everywhere, I've mentioned that. Tor browser, right? This is a chance to make it to where your browsing experience is anonymous. Keep in mind that cookies and JavaScript and other things like that can still track you, even though you're going through the securities route. So don't think of Tor browser as being an absolute, yes, you're anonymous on the internet. No, if you start getting on some forum and yelling at people and being mean, they probably might be able to still track you back, especially if they own the forum, right? If you go through and start making threats that three-letter agencies care about, go back to my early slide where I said, if they care about who you are, you've already lost, right? So don't think that just because you're on Tor, you're invulnerable, you're not. But it is a great tool and it does a lot of really good things towards helping you be anonymous and protect where you are and things like that, right? VPN, so this is what I call customer-ready service. So you can hook up your phone, they've got apps and stuff where you can get a VPN and it's giving you private connection from where you are, whether that be a cafe or your phone, to them. Now once you leave the VPN, it's just another ISP, right? So whoever is south of them in the data stream can start tracking you that way. They do some things to make it a little bit more difficult somewhere better than others. For the most part, we can't audit them, so you kind of just have to trust what they're doing. So that's their business model, ostensibly. Now I like SSH, but it does require a little bit more knowledge. Most of us here have that knowledge, so I put it in here. Using SSH and Foxy-Poxy with your browser is a great way of going through and doing stuff. Now in my case, I tunnel back to my home and do everything through that, so my ISP can be watching everything I do, but they already can do that anyway, so. And if I've got from my home, I've got a Tor node set up or something like that, I can combine these things, right? So there we are. VPN, does all traffic. So private internet access, they actually are sponsored this year, I forgot to update the wording, but they sponsored Scale last year, he had a huge booth, they sponsored LibrePlan as well. And I've been hearing good things about them for the most part. London Trust, which owns them and has been funding them, also bought FreeNode and has been funding them. So they're doing some good things in the public sphere. I'm gonna call that, I don't know what they're doing behind the scenes, so but I'll call it, they're supporting the community, which I think is important. Also at LibrePlanet last year, they announced that they were releasing their client code as free software. I haven't followed through to make sure they've done that and they've been following through on that, so. Email client internet access. So email clients should never run JavaScript. Email should not have JavaScript in it. Shouldn't also not allow cookies. And email clients should show you your full address. So last year or the year before, I guess at this point now, somebody decided to punk the new cabinet that took place in this country. And they said, hey, dear cabinet level person, this is Jared Kushner and this is my private email address. And then, and it said Jared Kushner. But if you looked at the email addresses, I'm not really Jared, I'm just trying to punk you at gmail.com, right? And a bunch of people responded and gave them information about what their private email addresses were, what their private phone numbers were, gave them information about things that were going on. Okay, so first of all, these are things that are supposed to be shared on non-government resources anyway, so that you really feel. But the problem was that their email clients were only showing Jared Kushner, which you can set to be anything you want. Cookie Monster, whatever, you know, some guy from Mars, you can set it to be whatever you want. So when you're getting email, you wanna see what the actual email address is and make sure it matters, right? If you know any, you know, I know it used to work for a guy named Tim Jones and everywhere he went where they wanted his name, he spelled Jones with a Z, because he said one of the places he went to, he said there were so many people named Tim Jones that their system crashed trying to pull up his account with his name just because there were too many matches for his particular name. So he had to spell with a Z so he could get in and buy things, you know, if you wanted to use the services stuff. So if you know multiple Tim Joneses, which one are you actually getting the message from? You need to be able to see that email address. So they should have an easy config that blocks all the email-driven network access just so there shouldn't be web bugs in your email, things where it says I can track whether or not somebody opened the email. That means they have a web bug in there, right? Your email client should not let that happen unless you want it to go in there. Same thing with remote images because those remote images are essentially web bugs. So nothing remote without approval. Gmail does block them. I'm told Gmail does block that to some extent, but if it's in your address book, they start allowing more things. I don't trust the people in my address book so please don't. All right, use sub-addressing, this is the thing I mentioned. In most places, Gmail specifically, you can use a plus after whatever your user name is for your email account, and then put whatever you want. So I have, for every company I work with, for scale, I have a unique email address using sub-addressing. So if I start getting a whole bunch of spam, if I start getting a whole bunch of things to that email address, I know who gave it out. And one, I can go block it, but I can also go through and make sure that if I know exactly who that email is coming from, I can go through and filter so that only email from that entity is allowed to send mail to that particular account. I have a presentation that goes into that much deeper stuff in my presentation last year. So again, email clients should never run JavaScript from the mail. I don't think they should be running JavaScript from anything, so that kind of blocks out web mail for me for the most part. Magigate ball, outlook is not good, please. If you are forced to use Outlook for some reason, please don't. It has been a crappy security problem since the very beginning. They haven't fixed it. It's been 20 years. If they haven't figured it out by now. Yeah, I mean, when the security things are old enough to drive, stop using the thing. Please, if you can find any way, don't use it. All right. Client configuration. Show if you mail an email address. Here's some things on stuff I've done. I've only done cursory testing with it. I was gonna bring a couple examples, but I'm out of time for it. So look at your client and look. Does it show you fully email address before you open the mail, right? Can you block JavaScript? That should be default on everything. Can you block email, internet resources, and can you see what the URL that's linked the actual URL is? Notice I say yes for Alpine, all of those. Guess what mail client I use. All right. Phones and tablets. So if you want a full and free distro, live them five. Should it be released someday? I had to talk with them about that earlier today. So they have a booth in the expo hall. It's too late to get back to there because they're closing, they're closed already. So sorry about that. But Purism's doing a really good job with publicly with the things they're doing. I like their goals. We'll see if the product matches up, right? And then you have some freedom-respecting forks like Replicant and LineaJet OS. LineaJet OS used to be called Cyanogen Mod. They changed the name long enough to go hopefully everybody's recognizing LineaJet OS at this point. Phones and tablets security. Use a password or a pass pattern to get in. Don't just leave it open so anybody can open up your phone and get onto it. So if you forget it at a cafe or something else like that, you make it to where people can't just get in and start cruising through all your contacts and your bank and whatever else that you've got automatically set up. Encrypt the file system on the phone and then do regular backups. So while we were here, my wife's phone fell apart, physically fell apart. I haven't backed it up in a few weeks so we're gonna lose some pictures and stuff and I will have a price to pay when I get home because I'm not gonna be able to restore everything on that. So make sure you're getting regular backups of anything that matters. Apps for phones and tablets. So Snowden has from where he's at in Russia in undisclosed location in Russia. He has been working on a couple of projects, introspection engine and Haven introspection engine is a physical add-on for your phone that tries to look at your radio traffic. Whether that be Wi-Fi, Bluetooth, et cetera, or your GPS or your phone connection and look at what's going on and what you're actually sending upstream. And then Haven is the thing if you've got an extra device, you can put it on top of other things and if they get moved, it starts screaming and starting things and starts taking pictures of stuff. For those of you that saw the guy that put out the package for people to steal so he could get pictures of them and glitter bombs and stuff like that, he could've been using Haven for that because it's already set up to where, you know, go through, but the difference was he wanted to go off when the package got opened rather than just when it got picked up. Check package permissions before installing an application. The flashlight apps do not need internet access but there was a thing a couple of years ago about the number one exfiltrator or phone information was this some fast flashlight app. It was grabbing all this data off the phones and sending it off to some third party in a different continent than we're on right now. Doesn't need internet access, so don't allow it. FDroid is an awesome repository for free software. A lot of the tools we like are available both in the Google Play Store and in Asteroid. Get them from Asteroid if you can but also go through and look at that. So like I say, instead of using Google Authenticator, go use one of the applications available from Asteroid. Firefox and Tor browsers, use those on your phone. Firefox has a, I forgot to put this in here but a specific security or privacy related release for phones and then also on Firefox you can add this plugin. So one of my Firefox instances on my phone also has U-matrix on it. Kind of a pain to control on the phone so we need to get some work on that. It's not really ready for use but I like that I have that option. And of course you can use a VPN on your phone as well. Cameras and microphones, this is Liberium 5. Liberium 5 has a physical switch that turn off the camera to turn off the microphone. I believe it's the same switch for both of them. I would like just the microphone separated but you've got a physical switch for it so you know that it's off, which is great. My microphone needs to be off 95% of the time. I don't spend that much time on the phone. I would like to only have it physically on when I'm actually on the phone. And you need a, but I like to say I want an internal switch that takes care of it instead of something that can be controlled by software because it can be controlled by software, people can listen in. Sonic Tracker's, for those of you who've been paying attention to that, the McDonald's app had a thing to listen to stuff outside of human hearing so that when you were watching TV and it played a McDonald's ad, your phone would report that you were watching McDonald's ad. And my biggest question is, why do people have a McDonald's ad? I was like, what? All right, Wi-Fi is not secure. Like I said for SMS, just not secure. This has been a public service announcement. If you're gonna use Wi-Fi, it's great, use it. But make sure your device is encrypting the data going back and forth. Don't depend on the Wi-Fi for security. Data sharing, sharing the storage. Next Cloud, we had a couple really good presentations from Next Cloud. They had a booth. So they're doing private cloud where you can store your data but you've got control over it. And they're doing federations so you've got ways of sharing with other Next Cloud instances and stuff like that so you could set up a community thing or call your siblings and go, hey, I'm gonna put this little Raspberry Pi in your closet and you're gonna do backups for me, all right? You know, for those of you that have kids, I'm helping pay for your food.  Freedom Box is similar to Next Cloud. It's a slightly different way they're doing things but it's a similar type of thing. And of course SSH, I love SSH. I will always talk about it. Most IoT devices can't be audited. Most phone home, it should be internet of things. Keep things on inside my network. Put it on a separate network segment if you can. Block by default for access from that network segment so you're keeping it from phoning home, right? If you've got a printer, printers don't need to go talk to HP. HP thinks they do but they don't. So my printer's set up on a USB connection. It's talking to the internet and then if I need to talk to it from elsewhere, I use an SSH connection. SSH solves all my problems. All right. Well, SSH and installing Debian. Those two things solve most of my problems. All right, block by default. Use a proxy if IoT does need internet access both ways so you can have a little bit of control over what's there. Last year, scale had a really good but very depressing talk on IoT. So go look at last year's stuff if you want. Messaging, Signal, JMP Chat, which also sponsored over at Liberty Planet. Next button and matrix are all options. The last three are free software options for messaging. Signal's free-ish so go look at that your way. A couple of terms, man in the middle means that somebody can, so if I go talk to the FSF website, a man in the middle, if somebody sits on the network in between and can intercept the connections. The intersect the messages. If I'm not using a secure connection, that means they can read all the data. If I'm authenticating, they can capture my credentials. And end encryption is where it's encrypted from me to that server so they can't do that. All right, now I have, let's see what we got. Well, I've got several slides left. I'm over time. We've got a half hour break, but I am over time so I want to make sure everybody knows that. Presuming nobody's yelling at me, I'm gonna go ahead and continue. I'm sorry for running over. All right, so anti-social media. So we've heard a lot of things about Facebook in recent times. There was news last year, this is from last year, like, oh my gosh, Facebook is doing stuff we just learned about it. No, we've known about it the whole time. That is Facebook's model, right? So Cambridge Analytica was not a scandal, it was a proof of concept. I'm not, I'll say a lot of bad things about Facebook. I don't think that Facebook and Zuckerberg are evil per se, but the business model is to grab as much information about you and use it against, or use it for advertising. And Google's model isn't totally separate, but there's a lot of, I think there's a lot of difference between looking at search results and looking at all the other stuff. Both companies have recently gotten in trouble for their applications on phones that are spying on a lot more than they claimed that they were spying on. So keep that in mind, right? But just because I'm paranoid, and just because I wear a tinfoil hat and block wires, radio signals going in and out of my house, doesn't mean they're not trying to spy on me. We do have some options. And some of these are brand new options, some of them have been around for a while. We have options, and that's the main control we have over Facebook and Twitter, where one person, each of those companies, gets to decide, right? Mark Zuckerberg gets to decide what Facebook does and doesn't do. Now other people might be implementing it, and there's some other things in there, but in the end, he decides whether or not something can get on there. Twitter, one guy decides, hey, this one account is breaking all of our rules, all the things that we say we're gonna ban, but they're really famous, and we need them for people to use our service. So they get free reign, they can do whatever they want. So that one person gets to decide that. By using federated social media, you can choose an instance that has the rules that you want. You can choose an instance that says no Nazis, you can choose an instance that says all Nazis. What is it that you want? A lot of Tumblr, I think, has started one of these picture sharing things that says, okay, no more nudies. Well, they started up a whole bunch of pixel fed instances that are like, hey, we're fine with nude pictures. So people move that. If you don't want all the nude pictures, don't use those instances and block those instances, right? And that goes outside of your life, right? So you can have the different things and they can share or not share, which is a nice thing. So ActivityPob is a protocol that's actually W3C approved at this point that is meant for allowing different social media services to share data, share their microblogging messages. It allows pixel fed so that when you update it, add a new picture, you can then, you can send an update to Mastodon. And you can use Mastodon for doing comments on your pixel fed picture if you wanted to. I don't know how they're setting up the instances, but ActivityPob becomes the common standard between these different things. We're not quite there yet. Chris Limeleber, one of the people behind ActivityPob has been talking recently about what we're getting instead is getting, you know, federated versions of Twitter. We're getting federated versions of YouTube. We're getting federated versions of picture sharing right over, right? And he's like, data, ActivityPob says it's just data. I do different things. And what I would like to have is a service that can share whatever. And then on my clients, I can decide.  I want penguin pictures instead of cat pictures, but you know, same thing, right?   Let's go look at all the funny videos of cats or funny videos of penguins or whatever, right? So here's a bunch of different ones. A lot of them will talk to each other. Other ones are getting there. Some of them, I think like Diaspora, I think has said they're not gonna do activity pub, they're doing their own thing. That's, it's a free world. They're allowed to work with it or not. GNU Social, I believe is working on activity pub, and I believe Pump.io is as well, but all the other ones are all activity pub. Now, data liberation. It's your data. Can you get a copy of it? With Macedon, you definitely can. You can grab a copy of it.  Can, and then the other thing is the exported data will format it. So a couple of different proprietary services. One of them is an accounting company that I won't mention. We'll give you a dump of your data, but then it's in a proprietary format, binary format, so I was like, oh, I've got a copy of it, but the only place I can use it is into a different instance of your company, right? And Alan, I've heard from people that usually in order to restore it, not only is it, can you only do it to an instance of their company, but you have to buy a new license to restore it to the new instance, and usually a newer version of their software because only full-width compatible makes sense for backups. So anyway, so make sure you can get a copy of your data that you think is important. If you don't think it's important, don't worry about it, but if you think it's important, make sure you can get a copy of it. I was using a message on instance that had a crash and wiped out its databases and wiped out all of my data. I didn't care, but if I had cared about it, it was gone because I didn't have a local copy. So if you do care about your data, make sure you've got a local copy, whether it's on your home system or in the cloud or somewhere, but someplace that you control. Backups and just cloud all the things. Just take everything you take and put it in the cloud. That's awesome, right? Great service, it's free, must be secure. In practicality, there's a lot of things that just go in the cloud and it's not horde, but think about where you're putting it, what the circumstances are. And if you can go through and encrypt it so that it's encrypted, it can only be unlocked on your side if it's something you need to keep secure. Now data escrow, so escrow is an arrangement where something of value is held in trust by a trusted third party. So if you're uploading something to the cloud, you're doing escrow. But we think of, oh, we're just putting stuff up there. But think of it as an escrow as somebody's holding that data for you for some reason. Now remember what your reason is and what their reason is, and make sure you trust that. Now I like, so KeePass XC, it's password manager. So why do I talk about that for data escrow? Okay, well it's escrow for my passwords. But the other thing is you can add attachments. So I have a KeePass XC database instance that has my family information in it that we need. So that if I die on the way back home tomorrow, my wife can get in there and get the life insurance information, get the information about my car insurance, all that stuff. Except for I still haven't given her the password. But once I give her the password, she does have access to it, she just doesn't know it. So hopefully she can figure it out. But we're putting all the information in there. But we've got like social security numbers for the family, bank account information, all the things that we need for if my house burns down, these are the things I need to rebuild my life. I've gotten that KeePass file. My last car, I bought a car and they gave me a PDF of the purchase contract. I added that as an entry in KeePass XC. So now I have a copy of that. I don't have the home purchase contract in there yet. I still need to scan that in. But it's like 4,000 pages. Dreading that the six months is gonna take the scan that thing. All right, safekeeping data cloud, next cloud and other free software services allow you to provide your own service for that type of thing. And again, like I was talking about early at the beginning, old versions, they're still around depending on the service you're in. So think about that as far as your escrow and that it sticks around even if you don't want it to. If you do get compromised, do a full backup of your disk, your device, but then reinstall. There's all these Windows people, oh, I just did an anti-virus, removed all the viruses. No, you didn't. Reinstall the thing, whether that's your phone, your computer, whatever it is that they, if they broke into your car or computer, figure out how to get that thing redone, right? Whatever they broke into, go through and do a full reinstall on that thing. In IoT devices, that might mean you send it off to the crusher and have to get a new one, right? That one won't be secure either, unfortunately. And then, of course, change your passwords. So that, whatever they've gotten access to. Oh, I hit the end. Okay, so again, sorry for running over. I've got a couple of little slides I'm gonna do and I'll come back to this at the end in case you want to grab the contact information. But I wanted to point out, we have some free software companies that are doing things to support the community with their products and Purism was here and they also, Kyle Lankin was one of the speakers we had, their CTO. Tourist last night had a really awesome presentation. Nick, so that CZ and Czech Republic has a product project and product tourist, which is a home router. That was a really great presentation. I'm glad that they were here. I first found out about that project a year ago and I've been waiting for the last two months to go see that presentation and did not disappoint. And then, Think Penguin is a great organization. They had a booth. I didn't get a chance to stop and talk to them this year, but they were there. And then the resource, the EFS Surveillance Self-Defense Guide I mentioned earlier, there's a link to it here. My slides will go up online. And I will post out the link to both Plume and Mastinon. I usually put my URL in here and I forgot to do that, so sorry about that. All right, any questions? Yes, I have not. So, it says, Alias is the name of the project? Okay, so it's a DIY project called Alias that you can throw on top of your Alexa or Google Home product and it will then control what's being sent upstream. Okay, so what I was talking about in here, I said, set up a proxy, but it's a proxy specifically for those devices, so it can be monitoring those things specifically. Okay, that's awesome. No, I had not heard of it. I refuse to get those devices, so I've not had to investigate it, but that's good. So, Alias is the name of the project, right? Yep, okay. Any other questions, comments? Okay, well, you know, tell them to set up an Alexa in their bathroom and tell us what the results are. You know, so the thing is, you know, saying I don't care about privacy, I've got nothing, you know, it doesn't matter if people are looking at me. That's like saying that free speech is not important because you don't have anything you want to say right now. Well, what happens when you do wanna say something next week? Well, what happens when something you said last week now becomes a problem? Ask people in Venezuela right now whether or not free speech matters and whether things they said last week matter because things are changing, right? So, you know, hopefully we will never have that problem in this country, but we need to protect it not just for us, but for other places as well. And there are definitely places in this country where in my lifetime, we didn't really have free speech a lot of ways. I should have added that to the messaging. I forgot about that. I looked at Keybase a little bit. I'm not particularly interested in it myself, but I should add that to the list for those that might be interested. So, thank you. If you would message me, because I've got a really bad memory. And by the way, if anybody's got suggestions for talk things that I should have included or you have further questions, please do go ahead and message me. I do most of that through IRC and Massadon, but go ahead and message me and let me know because I want to improve the talk. Even if I never give it again, I want to improve the content. And I'm going to take some of the things and expand with blog posts and stuff too. Any other questions? No? Well, thank you again for coming to plug, or plug, where am I, scale. Thank you again for coming to scale. Thank you for sticking out when I ran over quite a bit. I appreciate that. Have a safe trip home, however far you're going to home. And I have two coasters and another penguin left. We have any you may want? Which coaster or penguin? All right, I won't throw the coaster. That's probably going to do some damage. In the back, what would you like? All right. Hold on.  Ooh, hey, it is. Check mark number one. Okay, I guess we can just get started. I don't know if there's a room captain or anything in here, so we'll just go for it, right? Okay, thank you for coming. Thank you for sticking around towards the exhausting end of the conference. So tired, oh my gosh. So this is building security into your flow with InSpec. InSpec is a product, project of Chef Software. We're familiar with Chef. We started out doing configuration management. This is one of our other projects that we're going to talk about today. After me, my name is Mandy Walsh. I am the technical community manager at Chef. I have been with the company seven and a half years, so like four internet lifetimes, right? If you'd like to get in touch with me, I have my email address. I'm pretty much LNXCHK on all your popular social media, except for Snapchat, because I'm like 20 years too old for that. We're going to talk about InSpec. And I do this talk and I do a workshop version and I've been based in Europe the past couple of years, so I've been shopping this around over there. Dean Wilson, who does a bunch of thought-leadering and things like this was very nice to unpaid, right? Tweet nice things about InSpec the last time I gave a workshop. So we'll hope that you find it as interesting as he does. So you're like, okay, well, you said this is a security product, but you're in the security track, like Chef does configuration management, so like what's the story here, right? So Chef, we know we've been working with large enterprises for the last five, six years. The Fortune 500, the Global 5000, big, big companies. A couple of years ago, we had the CIO of Alaska Airlines at our conference and he gave this amazing talk about what it means to be a modern business and the things that you have to care about to make your customers happy. And increasingly that means being super available over social media, like if you're complaining about an airline, you're probably doing it on Twitter, like all the time, right? And basically what he said was that they're gonna be a software company that has airplanes. You think about the capital overhead, the amount of money that they spend on equipment and berthed airports and like all the other things that go into running an airline, but the things that set them apart and the stuff that they associate with their positive interactions with their brand comes down to how they manage technology and how they improve that customer experience through technology. So there's a lot of companies out there doing all kinds of things with software that we weren't thinking about 10 years ago when Chef first got started. There's definitely pockets of holes in the marketplace for things that we need to do a little bit better, things we need to think about in a different way and those things ended up sort of being sort of plugged into what we do. If you saw my night last night, I picked out a couple of particularly heinous security problems over the past couple of years where I just kind of, we're just kind of boners, right? Like we make a sort of dumb mistake and it costs a lot of money. So this one, Honda, they had WannaCry, it's on their platform and it comes into their factory and they patch everything up and everything runs fine for a while. Well then they have to build some new machines to deploy something or a new production line or whatever it is and the image that they use to create those new systems wasn't patched. So what they thought they had mitigated and fixed in their platform snuck back in again because their security life cycle didn't include rebuilding all of their images that they needed. So it's not anything that's like super hacker. Like it's not razor and blade and it's hacking your gibs in. It's like crazy sort of things that sneak into the complexity of your day-to-day systems. This is another one I absolutely love, right? That's like where configuration management company and like they left a default setting on a new server and it cost them $2.14 million. That's a lot of money to not change the default configuration and not really be paying attention to the things that you're deploying, right? So what we wanna do, we're gonna try and help mitigate all of these things and it's too much for one person to keep in their head so we're gonna encode it into code and work with it that way. What we found working with these larger companies is that they have a lot of people who are really stakeholders in the entire security and compliance sort of ecosystem. The compliance office maybe is not necessarily the most technically savvy people. They're not the hackers on the keyboards usually. They have a checklist. They might have some consultants that they work with if you are working with like a PCI consultancy for audits or other government agencies and things like that. You have like security team and I worked at AOL for a long time and like our security team was like often some other building and like would send us random emails of things we needed to do every now and then and like they weren't always in our day-to-day. And then you have the folks like actually doing the day-to-day work of the operations of your systems and they all use different tools. Your compliance folks are probably working with large PDF files. When I worked at the government they come in with these binders and we go into the data center with our code form because we were gonna spend hours with the binder. And then your security folks, a lot of those tools come in in languages that are most portable. So usually shells, so things that you can do. Not necessarily an item potent sort of tool necessarily. And then we have our DevOps folks and they're using something else probably like maybe they're using a chef, maybe they're using other things that aren't chef but those are sort of a different generation of tools but they all have a part to play in the things that they need. So what we wanted to do is give everybody a local place or centralized location to deal with all of these things, right? The requirements that they have plus the greater ecosystem of badness in the internet. And what we're hoping to accomplish with Inspect is to get folks to that place where they have one central location where everybody can contribute the things that they need and get their goals met. So what is Inspect? We strive to make Inspect human readable and if you're a Ruby programmer or lived in the Ruby ecosystem for a while the spec probably tips you off, right? It's kind of built off of the RSpec testing language for Ruby. So we're looking for something that's human readable because some of our compliance folks like they're not necessarily used to Grockin code, right? And that's fine. They have other knowledge that we need so we need to be able to communicate with them. We wanna test our security and compliance components, right? There's lots of things we can test but we're specifically looking at how we have configured our learning systems to be as secure as possible. And we wanna be able to create, share and reuse these things because they're going to get pretty complex. Has anybody seen the CIS profiles for Linux, right? 836 pages of PDF, right? Like that's an extensive thing and you need a bit of knowledge to figure out which pieces of it you want and which pieces of it you don't want and they give you run the whole thing like the system isn't even connected to the network anymore so that's not totally useful but there's a lot of stuff in there. So we wanna be able to build to that sort of standard, right? That's what our compliance folks are sort of looking for as well. We also wanna be able to extend it for our stuff. So if I have things that my company has written I wanna be able to test those as well and make sure they're configured the way that I need them to be configured. And finally, we're gonna plug this into our existing stuff. So things like our CI CD pipelines so we can check these as often as possible. Before and after code gets shipped to production I wanna be able to test my new images and my old images and all these other things. So we want these tools to be pretty flexible. And has anybody heard of Test Kitchen? Has anybody used the chef people in the audience? Thank you. So Test Kitchen is a tool, I'm not gonna get into the Test Kitchen workflow in this talk but it's a tool for fast feedback on your laptop. So it uses Vagrant under the hood and allows you to fire up a little virtual machine and get fast feedback on it. So one of the other workflows for InSpec is actually doing unit testing of your chef or other configuration management codes so you get some fast feedback there. That's super useful if that's what you're doing and it's awesome. Like you can totally read about it on our website but I'm gonna talk about just how to be using InSpec sort of in its own right. So to get our life cycle, like I was assistant then for a long time in a very large organization, right? And every now and then you get these emails from the security folks in the next building over and they'd be like, hey, this CV came out, you need to patch all your systems, whatever, blah, blah, blah. And in the days before systems automation, like that's a bitch, like oh my gosh, okay.  And sometimes you get like just random emails in the middle of the week and they want it by Friday and all that great stuff and then they're gonna audit you and they're gonna publicly shame you for not doing it and all kinds of other dysfunctional things that organizations do. It's still important, that's just a better way to do it. So we've also worked with companies that do like the single big scans, right? The financial industry is really big on this. They do like a big scan once a year and it's all red. And then they spend like eight months paying contractors to fix all of it by hand and that's crazy too, right?  All that stuff sort of, it's really dysfunctional. Like you're making changes all the time if you're doing sort of modern workflows, right? Like stuff's gonna sneak in in between your audit and that's how the audits get read in the first place. So you wanna have some tool, we hope, that helps you fix these things as often as possible. So let's say we get something weird, right? Our version of Linux is sufficiently aged that it still has SSH support for two protocols, right? Most of the new ones in seven and eight on the CentOS side, I'm not sure where the Debian versions are beyond this. But the version we're running supports two different protocols. The original one, V1, we know is bad, right? It's subject to a whole bunch of security issues. We want everybody, no matter how many hosts you have, to update all your stuff and make sure in some way that that stays that way, right? So what do we do with this, right? Well, I have to figure out where the configuration file is. If I'm in a homogenous environment, it's probably in one place everywhere. If I have two or three different versions of various distributions, it might be in a similar place. If I've got two completely different versions, it might be in two places. If I've built my own because I wanted Kerberos or something weird in it, who knows where it is? It might be in slash OPT somewhere. But to find that file, I have to figure out the right setting is.  If not the whole thing, then at least a snippet so I can test for it. Now I'm gonna schedule my fix and restart and hope somebody upstream for me the next time I build a system has already fixed that image so that I don't have to worry about this again.  So it's craziness. Then do I need to actually test it? Do I have ETLs that need to SSH into things? I have to make sure it still work and like all this other stuff is going on. So there's a whole lot of things that go into this process when you have just sort of these crazy requirements and not a good way of sort of automatically fixing them. So let's take a look at what this actually would look like in something like Inspec, right? So Inspec has a series of what we call resources. We'll talk about them in a minute that are just components on the system. In this case, SSH D-config is significantly complex and useful enough that it's built in, right? Everybody on Linux has one somewhere, probably. And we can break down the things that we need. We can say how important it is. We can give it a title for talking about with our compliance officers or our security auditors. I can give it a description here to say, all right, this is what I was actually asked to do. If I get a JIRA ticket or a CVE or something like that, I can just plug that right in there and save that for later. And then it's gonna go into my file and it's gonna dig around and say, all right, here's the thing that you want me to look for, right? For a call. And then I have a series of matchers. In this case, I'm comparing it to the value of two. That was in the file, it could be like one comma two and that's not what I want. I want it to be two. So I can run this against as many machines as I need to. Inspec on the back end is doing all the hard work for me, right? It's finding the file if it's in a default location and figuring out where this is in the file and whether or not it compares.  Some Ruby classes that are helping us out do all this hard work rather than doing it by hand. So our resources examine common services and system stuff and different configurations and there's a whole bunch of them that are built in for Linux and for Windows. And they are really after the things that when you think about, okay, I need these ports not open. I need like the NFS demon should not be installed. Like those sort of common checklist security profiling. Super easy to encode with these resources. On Windows, you get stuff like registry keys are super important for certain fixes there. Lists, dig into the list of service packs and stuff like that to investigate the state of the system and make sure that it is in a good place. So just check all these characteristics. For files, you get like file size and owner and those sorts of things. For more complex stuff, there's actually these matcher classes that are digging down into config files and things like that. If you think about something like one that's built in is the HTTP config for Apache. And like I still have nightmares about crazy things you can do in that config but it is super useful to have looking in here, making sure my directory listings are turned off and other sort of security settings for that sort of thing and those sorts of resources are built in. We can also group resources into controls to make her to these logical connections. And we'll talk more about this in a minute but I'm basically saying like I have a whole bunch of things that AuditD needs to be set for and I can group them all together because AuditD has a lot of different stuff in it. There's maybe six or seven maybe more settings that I care about so I can actually group them together in one place so that they sort of all hang together. And then I group all those into profiles that's sort of the pack of stuff that I can then share out to the rest of my teams. So my resources include an item and how to look at it and then the parsers in the backend do the thing and what it looks like is like our specs. So uses this language called it's and should, right? And Ruby, idiomatic Ruby programmers have ways to talk about this and I'm not a Ruby programmer so I apologize if I send any Ruby programmers. When we're looking at simple things even like it should exist. If I have a file that should be just in the directory to flag for an action I need to be there. I have services or packages that should be installed on the system for that. I have a service that should be enabled, right? So it should start when the system reboots. I can dig down to config files as they are my max log files I should keep six. Like that's a pretty common setting that I wanna compare and figure out what that looks like. If I get a script or some kind of fix from my upstream vendor and sometimes they do give you a bash script to fix whatever CVE they've come across I can actually run that thing with inspect and then make sure that its exit status is good. So I'm not stepping completely away from my under workflow I'm actually incorporating it into this workflow and giving it sort of a better abstraction that way. I can also test for things like DID and that kind of stuff and on files like anything that comes out of stats and stuff like that. So it's super interesting that way. So then I get to my SSHD configuration. I have my resource, it's built in and then that's what inspect is gonna dig around in my file and find. So then I can run it and it's command line and you can do it a bunch of different ways. I have it installed locally on your workstation and then run it against remote targets or against your own system. You can run it as an agent on all the systems that you're looking at and you can run it on a regular basis if you'd like to for that in that way. Also run it, there's a reference shell that you can actually just get into and play around in so you can test out the things that you wanna be working on. So it comes in, it's a Ruby gem or it's also a part of ChefDK. If you're working in a Macintosh environment we also publish it through Homebrew so you can download it and run it from there. So let's say I have a basic test. I want to make sure temp is a directory because I have like some road process that continues to screw it up or do something weird to it. We also want it to be owned by Root but be totally open, right? And I wanna make sure this is all good stuff that the system needs to have done. So you can check out the file resource, right? We have lots of documentation on how all these work and the things that you can test on them for what it actually looks like. So for this kind of example, I have a file that I'm talking to and then I have a bunch of things I wanna ask about it. I wanna make sure it's there, number one. And then I wanna make sure it's a directory and there's a couple of different ways to do that. In this case I've picked this particular syntax but there's a couple of others. And then my owner and my mode. So let's go ahead and run it. Make sure I can switch my stuff here. There's my test file. Is this an RB file in this case? It doesn't have the extra like discussion part and those sorts of things in this simple test. So I've got basically like six lines of code here to just try this out. And on this case because the resource I'm talking to in this example is open to the world. I don't have to use sudo. If I was digging around in system files I would have to have extended privileges. In this case, I'm just gonna talk to run sec runs this thing. It comes back.  I have a checklist of all the things that I tested and it tells me that it was all successful. Now if I change this and I say, all right. Maybe we change this to, we know that's wrong. Let me run it. It tells us it's wrong, right? And it's gonna tell us how. And for things that you're sort of testing down into config files it'll give you a diff, right? So I know that whatever config file it is this is what's in it and this is what I told it I was looking for.  All kinds of targets. I'm running this on the command line. So in testing the local system from just doing in spec except. If I wanted to test a remote system that had SSH on it I can do that via the regular SSH flags. Dash I and with my keys or whatever else. If I wanted to do a window system it runs currently over WinRM. So I can talk to window systems remotely that way. And then I got a Docker container that I have access to on the system. I can also get into that and see what's going on there. So a number of different ways to talk to the systems that I might wanna look at. If I wanted to plug these tools into my workflow in Jenkins or other CI CD pipelines it works in a hopefully predictable way, right? When it, when you have failed tests you get a non-zero return code. So you know in your workflow that in fact failed and you can drop out. When all the tests have passed then I get zero as my return code and my workflow can continue. So it gives us something that's super easy and repeatable to use over the course of your different state. So when we work with this we kind of work through a bit of test-driven development for people that are comfortable with it. So if you've done any test-driven development you kind of have, you create the test first. You're allowed to fail. So I know, okay this port is open when it shouldn't be, that's fine. I know the test works because it failed. Then I make the change to my system, whatever it is. Close the port, take the service off, turn it off, whatever it is. And then I rerun my test to make sure that it passes after the change is made. This is super helpful for checking your assumptions about the state of the system. If you have a bunch of stuff that's hand-built and you're not sure what exactly is on it and how it got there and things like that you can actually start in this manner and say all right I know I have this port open and how do I accomplish that? I know I have this service running. How do I accomplish that? It's also super helpful if you're moving to a new version of an operating system where your settings might have changed or the syntax is slightly different or those sorts of things. You can sort of run that inspect test first and say oh this has changed the last version and now I need to change my assumptions along with it. So then we've used them very, very complex workflows that way. So when I have a lot of things that I want to be testing I can add a lot of information for the rest of my team. For folks who aren't necessarily hackers or into all this stuff all the time and we can help them out with how important things are and adding descriptions. So there's a lot of things that, there's a lot of sections for impact and if you have like, there's also commercial offerings that sit on top of inspect that help do reporting on some of these. But you can do super low ones, right? Information only. Like we know this is out there. We don't think it impacts our environment but we should know that it's there and in the future if it needs to be fixed we'll have record of that. And then we go up from there and so you get to critical which is usually stuff you should fix as soon as possible, right? Super important and it should be done. And then your description. You can give ticket numbers, CVEs, other descriptions, where the requirements are coming from is it related to your PCI requirements? Is it related to HIPAA? Is it related to any of the other things that you might be working on? And the example again, there is that our impact and all the description areas where I can be pretty verbose for everyone who needs to read it. So this all sort of comes into play when we start working with profiles. And you think about how long the CIS requirements are, right? How am I gonna get those 850 pages of PDF into these little bits of InSpec code, right? So InSpec profiles allow us to package all these sets up into repositories or however you wanna share them that way. And basically sets of InSpec tests and you can build them by specific applications like this is our requirements for Tomcat. These are our requirements for whatever else we're running. And then share them out to your folks. And they're made up of these controls that have the resources embedded in them. And the controls have resources and tests, priority and metadata, just like we saw in the last slide. So you name your controls, based on what they do, or you can link them to their written document. We'll take a look at that in a minute. Each profile can have lots of test files in it. So you have the ability to make them as simple or as complex as you need them to be depending on your requirements. So I have a, the host that I'm working on happens to be CentOS 7. It's in AWS, so it's their current version. And all I installed on it to get started was InSpec and Git, right? Git brings all its Pearl friends around, but that's all that's there. And I'm gonna work through this OS hardening piece with a Linux baseline that the InSpec community has put together. So dev-sec.io have links at the end. They have put together a bunch of these sort of example profiles just to give you an idea of how complex these can be and what they can accomplish for you. So I'm gonna work through this example. So the Linux baseline profile isn't as extensive as CIS or some of the others, but it has a lot of the highlights of those sort of industry standard profiles in them. So there's stuff that digs down in. We've got this one is, it has a name, right? So this corresponds to maybe a paper document, a PDF document somewhere that has a description. And I'm going to check owner permissions on EtsyShadow. Basic stuff that I'm not really assuming out of the box is wrong, but want to guarantee on my systems is always going to be right, right? So I'm looking forward that way. I am checking the permissions here, so I've got my description. I've got my file. This is a file that I'm talking about and these are the tests or a specific set of them, existing via file, be owned by root and have the rest of these setups. Now out of the box, I sort of assume this is probably correct on most of the OSes that I use, but I want to always guarantee that no one has gotten in here and installed something incorrectly or changed something so that it has diverged from my requirements. So I'm in my house here and because I'm going to talk to some system files, I want to do this with root privileges. So I'm going to run that Linux baseline. So Linux baseline, just a set of files there. All the cool stuff is under controls, but they're sort of packaged up together. So I think that relate to the operating system, so that's OS underscore spec. I think the deal with specific packages on the system, so we know certain characteristics of the packages the way they're installed by default, maybe don't meet our needs. And then the third one is dealing exclusively assist cuddle because it's a monster, right? So I can run all of these together as one big workflow. They're all packaged in that same directory, so I just tell inspect to go ahead and run all the controls that are included there. So I see a whole lot of red, oh my goodness. It's crazy, what happened? Remember this is just a box off the shelf, right? Out of the marketplace. So I'm talking to Etsy shadow and Etsy password and login definitions and there's other things in here that are kind of interesting. And stuff that I probably w