Hi. Good afternoon. I guess, given it's 3.40 on the last day of a five day conference, I should award you all some sort of achievement for turning up and not looking like you're kind of glaring into my soul wondering where the beer is, so thank you. My name is Laura Bell. I'm the founder and lead consultant at SafeStack, which is a specialist application security firm. And I'm here today to talk about security in an agile context.  When I say agile, I mean any sort of fast paced, normally highly innovative, slightly erratic development life cycle.  It's not all as it seems. Now, before I begin, I will break the rules of presenting and I will apologise. I'm really sorry. We borrowed a word from you guys a little while ago, and we've been really mistreating it. So, yeah, I'm going to use the word hacking liberally and incorrectly for the next 45 minutes. Okay, so get it out of your system now if it bugs you. Really sorry. Yeah, forgive us. Forgiveness is golden, they say, you know. The other thing, going back to Leslie's talk earlier in the conference, I may be a female presenter, but I am just as flawed as everyone else when it comes to using the wrong pronouns at the wrong times. So again, I will do my best on that front, but again, we're all learning. So sorry about all of that, but let's move on and let's tell a story. So once upon a time, in fact, for most of you as recently as this week, there were software development teams. Now, how many of you are involved in creating code, who actually write code? And I don't mean like web application, I mean any sort of code. Okay, how many of you manage the security for that code? All right, okay.  All right, hi.  Don't worry. So once upon a time, we were engineers, and engineers like building things, right? And we like building big, awesome, innovative, feature-filled things. We like doing that regularly.  The internet has given us the ability to build things that connect people and countries that are so spread around the world that previously their cultures had never met. And we live in a world full of components and libraries and things where we can actually not become kernel developers anymore. We don't have to. We can just use libraries and frameworks and focus on the objective of our software, not on getting down to the kernel level. Meanwhile in the security industry, we got quite good at spotting car wrecks and monetising car wrecks. And we created an entire system of governance and frameworks and applications and environments and devices you could buy from us for hundreds of thousands of dollars. And we were very happy selling them to you. But it turns out it didn't all go that well. So raise your hand if you can name an incident in security in the last 12 months that affected someone on the planet. Yeah, I don't think we met that KPI. How many of you were personally affected by a security incident in the last 12 months? Yeah, how many of you have attended another security talk this week at LinuxConf? Yeah, how many of you left it feeling like the world was actually an impossibly evil place and there was no hope for mankind? Yep, we are meeting and exceeding that expectation. So what do we need to do, right? Why am I even here? What am I going to talk about?  We know this. We've all written that application. I'm not here to tell you that the hackers are coming and you need to check and lock everything twice. You know that. And to be honest, I probably already need a network, so shift has sailed. Okay, I'm here to give you 10 things that you can actually do yourself, not with a specialist, not with a lot of money to actually bring security to whatever project you're working on.  There is nobody in this room who cannot do security, every single one of you can. And I'm going to show you how. So we're going to come up with a few common misconceptions to start with because I'm bored of hearing them and if I spread the word to you that they're lies, you'll spread it to friends. I'm going to give you 10 steps that you can actually bring to your own workflows no matter what they look like, no matter how many post-it notes you have on pieces of glass in your office. And I'm going to show you some of the challenges and pitfalls. So why can I even talk about this? So I'm actually a reformed software developer. I started out writing COBOL at the tender age of 16 for taxation systems. I'm that cool. I then went to real time C for CERN, radiation monitoring software specifically. And eventually I made it into Java because I've been told that's where all the cool kids end up. Turns out I was quite good at breaking code as well. And eventually the Java people said please don't play with us anymore.  And so I became a penetration tester. So these talk and everything covered in it today come from over a decade of making and breaking things. So I hope you can see that I have a few war stories that I've been around the block a few times. And if you have any questions, please do feel free to ask because this is your talk. You're here to learn, not me. So let's talk about the basics of development life cycles, right? We're quite familiar with this. We have an awesome idea. We design it a bit maybe on a piece of paper, maybe just in our brains. We code something if we're really lucky we test it and eventually we deploy it into the unsuspecting real world. Fantastic. Now traditional security likes gates. Now when we talk about gated security basically we insert things between parts of the development life cycle. So we insert risk assessment between ideas and designs. We insert penetration tests. We just make the process longer. Now that worked really well in Waterfall kind of. Never found any bugs obviously. But in Agile, can we do the same things just more frequently? Of course we can't. So some of the processes we've gated in here, so code reviews and penetration tests, they take ten days, three weeks, all on their own. Now if you're working on two-week iterations or in a continuous deployment environment you can't stop for two weeks every time you need to test new code. So we need to rethink the way we do security from being a gated approach to being something slightly different. Now there are some common misconceptions and let's get those out of the way first. Ignoring security and doing it later is not the same as managing security. Now I have to mention it because many people have long lists of things they're going to get to or they know they need to care about. Unfortunately security ends up on the same list for most people with global warming and curing cancer. I want you to prioritise it off that list which are all very valid noble missions and put it into the more practical day-to-day things. Because avoiding it isn't going to save you. People are still going to actively research security vulnerabilities. They are still going to go around the internet looking for things to play with. I use the word play very intentionally because not all hacking, see I told you I was going to use it, is destructive intentionally. A lot of it is very bright people who are very curious and may have some boundary issues. The other thing to note is you're never too little to fail at security. So that's something, right? Every tiny application on the internet has the potential for security vulnerability which means every single script you've ever put out there is probably vulnerable. There's no such thing as an organisation that is too big or too small for security to be important. So whether you are able to spend thousands of dollars and get professionals in or not, the size of your organisation matters there. But in terms of whether you need to care about security in general, not so much. I commonly hear that security is impossible, that people have gone to talk after talk after talk where people have gone in the traditional security presentation style a bit like this. Hackers are coming. I have developed an exploit tool that will break into your system in three clicks. Click, click, click, ta da! And there we go. And that's where the talk ends. And everyone leaves a room feeling really, really dejected because how on earth can they save themselves hundreds and thousands of these scripts and tools when there are literally ten or more malicious perhaps people out there doing strange things on the internet to every one person defending. But it's not impossible. It's hard, absolutely it's hard, but scaling is hard. Anything in Gentoo is hard. You know, we don't avoid these things. We just kind of get on with it and we learn. Agility doesn't increase risk.  You can't move quickly because risk increases. Now this is based on the fear that you can't do your traditional gated approach. You can't have a pentest every time you release because you're releasing three times a day. Now there's another side to agility that isn't reflected in this statement. And that's the fact that if you are deploying three or four times a day and you've got mechanisms in place to spot problems in your code quickly, the time from spotting something to resolving it and deploying a new version is very, very small. In a waterfall life cycle, if you find an issue, chances are it's going to take you a matter of months before it's gone through the entire process and can be deployed in a regular deployment window. If you are in a waterfall and then have to do it out of band because it's serious and it's got to go outside of the patch cycle, then that's entirely complex too. You can't move at the same place, you can't react at the same pace and you can't therefore resolve the issues as well. So while agility changes the way risk looks, it prepares us to react quickly when we do find those problems and we will find problems. My personal favourite of all of the problems that people have with agile security is that we've always done this. The code has remained unchanged now for 15 years and nobody has hacked us. The only response I have to that is bash. We learnt in the last 12 months that old code is also vulnerable code. And just because it hasn't been found until now, it doesn't mean it won't be found. There are thousands of people full-time employed looking for security vulnerabilities in known software packages. And it's just a matter of time. Bash gave us a really good example this year where we need to not just consider the security of our new code, it's easy to go in going, oh we're going to do security from the start when you have nothing to begin with, but why we need to revisit the security of existing code. And I don't mean re-engineer it, I just mean look at what we wrote and understand where our risk is. So let's give you ten steps, right? Let's give you ten things you can take back to your organisation or your project or whatever it is you work on. Wrong way. Right. Now this is not a reflection of all of the community but some of the Linux community have been prone, and I do generalise, to say statements such as, well, I run free BSD, therefore I don't need to care about security because it's more secure than other distros. Or I write everything in Node.js. And Node.js is inherently secure because it's modern. Or I'm a C developer and therefore this new fancy pants vulnerability thing doesn't affect me because we've always done it this way. Firstly, all technologies have security problems, sorry, all of you. They're all a bit different, they're all a bit special in their own way but they all exist. The debate of which technology you use versus another is sort of boring. So kind of get past that and just know what is in your stack. Every layer, right from the operating system, that's important. But right the way through up to every single library, every framework, every CMS you're using and every bit of code you decided to get off stack overflow. Every bit of that stack could introduce vulnerability and it's your job to keep an eye on those technologies and see when they get updates and see when you need to change your code to prevent a threat from happening. So knowing your stack is actually the most fundamental thing you can do and then stalk your stack online. Find its Twitter feed, find the news groups, find the IRC channels, find where people actually talk about this stuff and keep a track of it. Now that can be daunting, right? You've got hundreds of technologies in your life, following all of them is hard work but you'll find a way. You guys are engineers and scripters, you've got things that make this easier for you. Adapt, adapt and abandon, right? So what am I talking about? I'm talking about the dance of security. If you read a book on security, any of them, it will talk about governance frameworks and processes and many things have been developed over 10 to 15 years and if you're in a very large, very bureaucratic organisation many of them will still work. But when agile organisations try and incorporate these security routines, they get crushed by them. And so people go, well, I'm not going to do that because now we can't do anything. Now we are stopped, now we are not innovating, now we are not delivering. So when you know there's a process you need to do such as code review, such as an architecture review, such as penetration testing, whenever there is a security thing you know you need to include, look at the process as it is written, how it is recommended, but then feel free to add to it, adapt it or say screw this and abandon it all together. I give you permission to not do it if it doesn't make sense. Look at the objective that that routine or that workflow or that task was trying to achieve. And then try and find a way to do that objective in your workflow. It's not about doing the right steps to the dance, it's about reaching the objective and that objective is to reduce risk and help you survive a security incident. Communication number three. So security people, myself included, were very guilty of this and technical people in general, we are terrible. We are terrible at jargon and at absolute meaningless twaddle in every aspect of our life. We baffle people like it's a magic trick. Now, as security people, we are trying very, very hard to pull back from jargon and work in plain English terms. Now, another thing I give you license to do from now onwards is call out people in your environment when they're using a phrase particularly in a security context and you're not sure what it means because if you're not sure, it could be that it may not mean exactly what the person who's using it wants in the context. And context is important with language. So challenge them. If you've got a vendor coming in, you know, a good look with that, but challenge them on the language in their marketing materials. When things say they align with or are guided towards ask what that means. Once, thank you. When people use the word critical or high in terms of severity or impact those words have meaning and they don't just mean something that all of the world means the same thing. They mean something specific to your context. So go back to your teams and write down the words on here. So informational through critical now, later and never and define them for your organisation and for your team because those terms are really important and you need to make sure you mean the same thing. You also need to make it okay for people to say I don't understand. I need more information can I have some help? We're really bad in the tech community at kind of making it hard to raise your hand and go yeah, I'm sorry, I need more information. So always give people permission and there is no consequence to it to say we don't have enough information. How many of you heard of the phrase of technical debt? Yeah, how many of you have technical debt? Yeah, don't we all. Now technical debt for those who aren't familiar with the concept is the idea that as you go around building things there are certain things that you want to put into your systems or you no need doing but you don't get around to. Now it could be because you just don't have time and you'll get to eventually and sometimes you realise over the course of your project you didn't need that feature to begin with. It's natural and it's kind of technology's way of pruning and keeping you focused. Unfortunately when we put security things in the same pile it all goes horribly wrong. Now I work with applications of all sizes and shapes developed by like four people in a basement three to four thousand people globally. And I consistently see security issues placed on the same one as usability functions and tweaks to the colour scheme. They are not all even. You need to make sure that wherever your debt is documented that you highlight which ones are security and you make sure you understand what the issues are and what the risk is if you don't solve it because that will help you prioritise those out of your debt queue. Technical debt is one of the reasons people get hacked. How many of you heard of Briserstack? How many of you know why I've mentioned in a security talk? Go at the back. Can you yell it? Don't worry, just yell. Of course. So, the very Cliff Notes version.  It's an online service where it lets you test your application in hundreds of different browsers and on different operating systems. That's not helpful, Jaco. Really, really not helpful. It lets you test your application on tons of different browsers so you can see what they look like and they work the same. It saves you maintaining a whole army of VMs and things yourself. Now, they were compromised in the last year and an email was sent out to all their clients explaining quite how diabolical their security was. How did it happen? It happened because they had an old test box that was still deployed on their live internet-facing systems that they hadn't gone round fixing yet. They had to turn it off. That was technical debt. That was something they hadn't got round to and as a result it wasn't secure and as a result somebody compromised their database, took their client list and made a heaping mess of their reputation. The company will probably bounce back but it was an important lesson in managing your debt. Security is often the thing that we engage at the bottom of a cliff when it's all gone wrong.  The trick with agility and security is to engage as early as humanly possible. When you have that idea over your dinner in the evening or first thing in the morning when you get up and you're off on your run or whatever you do engage security in the process from idea onwards. It is very difficult to integrate security into an application after it's been built. That creates very fragile code. It creates unmaintainable code in some circumstances and it can be really really expensive to do that in terms of not just money but in time. In formalised agility we have an idea of definition of done and that's a formal way of saying our code is only done when we've done certain things and those are things like has been tested has some documentation. If you have a formalised idea of what it means to be done add security into it. Add secure code review. Add a design review and I'm not saying get a specialist in I'm saying use things like I can't believe I'm going to say this in a Linux conference Microsoft have some really really good guidance free of charge on the internet for how to do threat assessments of systems of any kind regardless of language call look up stride if you want to go and look it up. They have a lot of resources that you guys can go and actually use yourself. So make sure you've got it in your definition of done and get in there early because finding out after you've been hacked that you may have wanted to consider security is too late. And then prepare for the worst. Now the sad reality is that you are likely to get exploited that your application whether by an actual motivated individual or unfortunately by a pearl script left to go wild on the internet is going to get attacked and sometimes it will get through your defences. Everyone needs to prepare for what would happen with the case and preparing isn't just a case of monitoring your logs while that's really important it's things like who would you need to contact? Who do you need to tell? Do you need to involve your legal team if you have one? Do you need to disclose to any governing or compliance authority? Practising these things and getting a plan together beforehand makes it a lot less stressful in the case of an emergency. Now one of my previous jobs involved working in a basement doing very crazy things and we used to work in an operational style where if something kicked off and something bad happened we would have to react very very quickly. I learned very very quickly that when people are under stress particularly technical people they are not the same personalities and they are not the same personalities you guys have in the room today. So by testing our incident response plans and getting this stuff together in advance we rule out the effect of the strange personalities from the decisions we make and those decisions can be affected by things like I personally get slightly bossy when I'm stressed I'm called a field marshal in some circles that's fine but you need to know it. Some people, and this is no reflection on any particular group of people diversity or otherwise, actually get touchy feeling and I mean they like human contact they will tap your shoulder or put their hand on your back and that's not a reflection of anything else other than a very human instinct for connection in a time of stress. You need to know who in your team is going to panic who is the person who is going to hide in the bathroom for three hours and you really want to make a decision and this is far too scary you need to know who that person is not so you can blame them, blame is not part of this it's so you can prepare and help those people get through it. In terms of how you can prepare keeping logs goodness me I speak to people about logs and what they keep logs of and some people do scary things like I keep it till it rolls over and when does it roll over at a time of time and what's that, 20 megs so about 14 minutes right, fantastic other people are more savvy and they've got maybe a few weeks but the reality is many compromises aren't spotted for 18 months could your organisation go back that far through as logs are you keeping your logs in a place where they can't be tampered with by somebody who's attacking or are they actually sat on your main web server or your application cos that's probably not a great idea all of this comes into preparing and it's not about being defeatist it's about being ready for it and I see that more as a challenge to be ready and prepared as part of what we do rather than being scared of the world we live in and then you're going to build an army now security once upon a time used to be the realms of the security team if you were lucky to have infrastructure or operations now when I say build an army I mean that every single person in your organisation is now responsible for security so congratulations you all got a new job who knew you get things at this time in the afternoon now I mean everyone I mean your first line people who answers the phone if somebody rings up because your application is behaving badly have you ever spoken to them and given them the skills they need to answer questions of the security nature who does your customer support and your long-term management what are they saying about security of your products you probably should find that out your developers, your infrastructure people, your ops every single person has a role to play in security and everyone needs a different type of support gone are the days where you just send people on a CISA course or whatever the latest certificate of choices we have to tailor our engagement with every type of role so everyone can do security and we work together if you've got 1100 developers for example and you've only got three security people will those three security people be able to do everything they need to do to keep your application safe probably not there are a finite number of hours in the day and you know we've kind of got to get on with it so if they can't then we need everyone to help out and that's where building an army comes in automate your workflows the Linux community is awesome at this so I don't need to dwell on it every system you automate in script is one less system you're going to get wrong when you're having a bad day and human error is actually a massive cause of security vulnerability so automate all the things I'm a personal fan of a mutable architectures and chef there are hundreds of ways to do this and you don't need a lecture on it so go talk to the rest of your community and automate everything if you're not redundant by the end of the week then you've done it wrong security fails when it's a special event if you are the type of organisational team that only brings in security once a year they come in in a spiffy suits with a clipboard and you do we do security this week you do an audit and they leave again you've done it wrong it should be the type of thing you talk about in your monthly little pizza and beers meetup thing or whatever you do inside your organisation to spread news and share knowledge security should be always there it should be something that's okay to question it should be okay to break things in your organisation and if you ever want to learn about how to break things and have a lot of fun and do security come talk to me afterwards and then outsource smartly now I'm a security vendor in a way I have a consultancy I sell things we also write software that's why we do consultancy to kind of keep that funded and it's open source software so you know one of you guys sort of you are going to outsource or your organisation is going to at some point and it's whole true of whether you're hiring someone like me or anyone else or whether you're buying a product always hold them to the highest standard they are going to take a lot of your money ask them about what their research is ask how they're actually experienced in the type of environment you're in the days of generic security advice are gone you have choice and go and extend it go and find out who the people are if they're not pushing the industry forward then don't give them your money right common challenges we've not got long, don't worry you're almost free so compliance sadly is a priority how many of you work in an environment that has some form of compliance over it so legal or PCI DSS or yeah quite a few of you the sad fact of the world is whether we like it or not compliance regimes are there we have to adhere to them because that's what keeps us in business so we do that we do compliance but please do not be confused compliance and secure compliance is tightly scoped it says these three systems here meet audit criteria hackers really don't care about scope no no no we will find every person every operating system every host in your environment the ones you've forgotten about the ones the marketing team put up in a hurry for that call campaign that they thought of everything we will find everything is a scope for us so please don't treat compliance as secure treat it as something you need to do to do business but it's only a starting point there is a very predictable learning curve when it comes to integrating security into an agile environment now it goes a bit like this I'm going to do security this is awesome I know I can do it I feel empowered and your enthusiasm goes like this and then you start finding bugs which is awesome and the bug curve goes like this and then eventually the bug curve keeps going and your enthusiasm kind of starts to wane because you actually realise that bug curve is going up way way quicker than the number of bugs you've fixed suddenly you can get really really down with the whole thing the whole thing feels like an insurmountable challenge don't aim to get rid of all of your bugs don't aim for 100% security you need to maintain momentum you need to do it in little steps so every single day everything you do try and do one thing, just one slightly more secure than you would have previously done it that's as simple as change that password that you know is shared with six other things change that password that's on the wiki that A shouldn't be on the wiki and B probably should have been changed six years ago maybe look up what that library is that you're using make one thing every day and before you know it, actually that pile of bugs starts going down without your enthusiasm going down with it hire good people this could be a talk in itself and there would be a whole panel of us telling you the qualities that make good people good people are the people you can stick in a room and you ask them how they would rob a bank and they can give you honest to God answers of how they do it and why and that doesn't mean they're bad people it means that they are people who understand risk good people are the people who actually think about decisions they're making understand consequence and don't cover their tracks people who are honest people who admit that they don't know things they admit their own vulnerability so hire good people and if you need help hiring good people reach out to the security community reach out to your peers and let them help you find the good people there's no time in this industry in the security world for us to have people who are show boating or making things up or hiding behind their very impressive resume or LinkedIn profile there's no time for that hold them up to where you need them to be if they don't meet it, find more and by that also find some juniors come talk to me afterwards if any of you are looking to join a study group to learn about application security if you're a student or in a tiny wee start up come talk to me afterwards, free training hooray use your words yes is a scary word to people like me when a developer comes to me and says I want to use Heroku and I want to write it in Node.js including both side, server side and client side and my instant reaction is to say no no don't do that no is cheap to me no gets rid of risk if I say no and you don't do it I've won but you're engineers and if I say no to an engineer you build around me, under me through me you'll completely ignore me so security people if you're in the room, learn to say yes more but say yes with caveat say yep we can totally do that but let's have a look at this bit here let's have a look if we can get some guidance about doing this securely and those of you who are the developers who come to people like me and go I love this new technology let's do that slow down, just a little please don't scare us just come to us with a we would like to and here's where we think risk is and let's look at these things a bit before we jump in so we've gone through a few common misconceptions we've learnt that we all need to care about this and I've given you ten ways to do it the video will be up online as will the slides so you don't need to have taken notes what I'm hoping is that you will understand this is achievable perfect security isn't that's an absolute fallacy you're never going to get it let's give up on that idea let's aim for survival let's aim for little bit more secure every day let's aim for building security in the same way we build in scaling and performance okay if you have any questions I probably have like a minute and ten seconds or something anyone Ray hi if not I can repeat the question it will be easier so one of the things that we do with agile software development is that we build things in pieces and we don't build big chunks to start with you know it's partial functionality towards a total goal the thing with security is often you need a big picture view of that how do you think the best way forward of doing that you can't build a little bit of security on client side and a little bit later on sometimes you need to take that step back and look at the big picture how do you propose that fits into the agile model yep okay so to repeat the question slightly is how does security fit into the agile model when you're building incrementally and getting a picture of the aggregated risk is actually quite challenging now this is really topical the Ruby Yamelberg from the last couple of years it was a prime example of where this goes horribly wrong where you've got very intelligent developers making very intelligent decisions on independent components which when placed together introduce risk significant risk in that case now what I would say in that circumstance is you need to free up some people instead of just being on the two weekly cycle or whatever your iteration period is to actually spend some time at the architecture level looking at where the changes you're proposing integrate because security vulnerability often manifests around boundaries so boundaries between groups functionalities trust boundaries boundaries between components so freeing up somebody and training up some people with some architecture skills and letting them do an iteration or two where they are actually looking at the aggregated picture is a worthwhile investment sometimes you need to pull back on the velocity that we're used to so this concept of having a continuous speed for the rest of forever sometimes we do actually need to take a break and the one thing I would say is don't leave that to somebody who's outside your dev team to do on their own don't just leave a rogue architect all on their own to do it they don't have the contextual knowledge of what that code is doing to do it valuably so get across functional team get people from different areas of the code base different areas of functionality with a security person, with an architect and actually look at the piece together to a business it's very difficult to articulate to seniors as to why it has value but find a way to make that something you can communicate and show benefit from Anyone else? Well that was easy Oh one last guy, hi Run Jack, I run Hello, I ask this at pretty much every infosec talk How do you convince management or clients if you happen to be a contractor to actually care about security? Okay, so that's a hard problem so the question is how do you convince your management right, because they're the ones who are going to have to let you have the time and the money and the resource to do this Now sometimes the best way to do it and I found the best way to do it is to actually get your management in a room and make them plan breaking into your organisation Once you've got on the senior leadership team of a bank planning robbing their own bank or the senior leadership of someone like trade me as an example, writing their own phishing emails It's very different perspective wise from when they feel like these attacks are somehow foreign to them that they're not achievable by people like them So you need to give people the skills to actually understand where risk comes from and the realities of who is likely to be attacking and sometimes the best way to do that is to actually include them and make it practical The other way is to translate it into business benefit and to use case studies from around the industry Now in New Zealand we're very bad at that because we always assume New Zealand businesses are better than everywhere else or more secure because we're little and nobody cares about New Zealand but the reality is we trade globally now and we can't think like that So looking at the case studies around the world as they come in and don't just send them a news article send them a link to the article with a here's how this is similar to us and here's how we should be changing to avoid this being us because then it stops being something they need to process and digest and it's something that they can then do tangible action with and it's something they can distill and chat about at their level they have many other priorities and it's finding a way to inject that into their world without it crushing them Hi I think we agree here in this room that testing for security in your software is obviously important but it's also important to test the human component and see where people actually fail so my question is until Ada is released how do we test for that? Okay, so to give the audience and the viewers at home some context the question was how do we test the human element of security until tools like Ava are released now Ava for those who weren't at Kiwicon is a tool I'm releasing which does very bad things to very nice people I'm really sorry find out about that in another time that's not for now are there easy ways to test? play pretend if you need to plan a robbery go look at your house go figure out how you'd break in if you have to think about it for more than 10 minutes and it doesn't involve a blunt force instrument through your windows try again this is the kind of thing you need to do you need to look at the common denominators a simple ways to attack people and then make a safe way to mimic it in your environment and that's going to be specific to your environment it's not a global thing we can do I'll think we have time for one more question Okay, anyone else? Wow, hi I'll let you choose and I don't have to feel guilty those of you who don't get to ask please come find me at the end and I'll have to answer any questions Thank you Just a similar question to what we were saying before I work as a systems architect and one of the difficulties I often have is trying to convince developers that security and architecture is actually an important thing that they need to consider in a project So a similar question before how do I convince developers that security and architecture are an important part of a process? Okay, how do we convince developers that security and architecture are a part of the process and they're important? So it's a slow process Actually, the best way to do it the most successful thing is actually to become closer to your developers Your developers are probably set in small teams working together regularly The architects and security team are normally isolated from them and they only ever come in when there's trouble They come in, they say your baby is ugly you should feel bad and they leave again This does not make friends Go be with the teams I don't mean formally join them I mean if they have stand-ups go to them If they're having a retrospective and a review and they really want to show off what awesome code they've written go along, don't just be the angry voice in the room actually go to the positive things too You want security and architecture to be something in your organization they see as a beneficial thing they can call on at any time that your door is always open and that you are there not to judge them because they don't know there are gaps in their knowledge but you are a resource you are there to be to help them If they are seen as a barrier or as a blocker they'll just kind of avoid you So most of it the biggest change is in how you interact with the teams and it's going to be specific to your organization or situation but the guy at Etsy who came over for Kiwicon Rich Smith and their organization they have a policy and security team of being first up the bar with the credit card Now I'm not promoting drinking culture but the sentiment there is be involved and be part of it You are not separate from the dev team you are one with them and it's just like I as part of the security community I'm trying to come out into non-security world and actually become closer and learn more about what that world is like so I can help that's exactly what you need to do with your developers Okay, well thank you very much If you need to contact me my details are up on the slide please note the underscore in the Twitter handle if the lady nerd gets angry So yeah, it's been lovely please feel free to ask questions via email, Twitter or wherever Seriously, we would rather answer questions to anyone free of charge over coffee than we would the world to be a less secure place so you know we're here to help you, let us do that Thank you


So Nick Kairos has come out and defended Emma Rado-Khanu, but this is what Nick Kairos had to say on Twitter about the Rado-Khanu criticism that was flying around by former players such as Daniela Hanchakova. So this is what Nick Kairos had to say over on Twitter. He says, What's with the old retired players giving their opinion on our stars now? I love A-Rod and I agree we all need to chill with our rackets and all that. But Jesus, I read an article about a past female player talking about Rado-Khanu. No offence, but she is far, far bigger name already. So Kairos coming out and talking about not just the Rado-Khanu stuff, but also talking about the breaking of the rackets and the defaults and all that stuff. Going back to the Rado-Khanu stuff, he's coming out and saying, Look, what's the deal with past players saying that Rado-Khanu doesn't work hard?  And it's good to see Keeg standing up for a young player. And we saw that Rado-Khanu did stand up for herself anyway. We saw that Rado-Khanu needs somebody to stand up for her. But it's good to see Kairos going, Hey, you former players, we're doing it our way. And he's kind of telling the former players to let them be. And it's good to see. I like it. I like it when Kairos standing up for Rado-Khanu. But let me know in the chat, let me know in the comments, what do you think?  Do you think the former players need to maybe not make their opinions so valid or so much heard? Or do you think they've got valid reads? Do you think Roddick talking about the rackets breaking and hitting the balls in the air and making jokes out of that? Do you think Kairos is talking about Rado-Khanu? Do you think it's valid?


We are still planning for a very significant cyclone event to hit the coast around the Cairns Innisfail region. That means that the councils in Cairns, the Cassowary Coast, Hinchinbrook and Townsville are all in the process of relocating residents in the high-risk area in Waterfront and low-lying areas. At this stage there hasn't had to be any mandatory evacuations but we will continue to advise you throughout the afternoon. As I advised this morning there's been quite a lot of work done this morning on the Cairns Base Hospital. A decision has been made to fully evacuate the Cairns Base Hospital and the Cairns Private Hospital. Approximately 205 patients will be evacuated from Cairns Base Hospital and 50 from the Private Hospital. The Air Force have confirmed that they have sufficient aircraft to undertake the task and evacuations will therefore commence in the early evening. The Air Force aircraft have to be fully fitted out this afternoon and then transported to Cairns. This all Brisbane hospitals have been put on what's known as a Code Brown Alert. This requires those hospitals to make sufficient arrangements to accept incoming patients. They will do this wherever appropriate by cancelling elective surgery where possible and by early discharges where they can. I'll invite the Chief Health Officer to make some further comments but I'm advised that across all of the hospitals in the Brisbane and South East area these patients can be easily accommodated and there is an officer in charge at the receiving end of ensuring that patients are efficiently allocated this evening when they arrive in Brisbane. This is a very big exercise and we're checking the records but we're not sure that we've ever totally evacuated a big regional hospital like this in Queensland's history. As I said I'll invite the Chief Health Officer to make some comments about that further. Additional flights have been going into the region and there will be further attempts to get further flights in there this afternoon. For example Jet Starano has had two extra flights into Cairns, Qantas has had two extra flights into Cairns and is attempting to get a third flight in this afternoon. However we could depending on the weather conditions see some airports close as early as this evening so all efforts are being made to provide additional flights in this afternoon. We are also endeavouring throughout the afternoon to put in place arrangements for those people who do need to relocate but who are unable to do so with friends, family or workmates and we will have provided further advice about that mid-afternoon when we have all of the details settled. I'll invite the Deputy Commissioner if he wants to make any further comments and then the Chief Health Officer to add in relation to the hospital. Premier only that we're very very pleased that a large number of people have determined to self evacuate out of the danger areas by driving out and taking their families with them. We'd ask that people don't panic by in terms of petrol. There are good supplies of fuel in the Cairns and south of Cairns areas but this raises another issue and that is of road safety. Please I'm asking you those people who are self evacuating who are leaving by travelling south out of that area certainly we would like you to be very patient and very careful. The last thing we need is precious resources being utilised in dealing with road squabbles or certainly snails on our roads and we have large numbers of traffic police out assisting the volume of traffic to move south and to the west. Thank you. Thank you Premier. Given the information that health has been provided that there is a real risk that the hospital in Cairns will be inundated with water we made the decision to err on the side of caution and evacuate all patients from that hospital and the private hospital. We're doing it purely because we think that is the best for those patients given they are amongst the most vulnerable in the community at the time and we know we can do that safely with the assistance of ADF and we know we have the capacity in Brisbane to take those patients so I'm confident that that is the right thing to do by those patients. Questions? Can you just explain the condition that the patients are in that will be transferred? There will be all of the patients in the hospital so those will range from intensive care patients through to mothers expecting to give birth, through to dialysis patients coronary care patients, neonatal patients, premature babies, children. This is the entire hospital. Yes but we do this every single day in Queensland we've got a very big state and we move very sick patients around the state all the time so I'm very confident. No but that's where we have the capacity with ADF to do so and we'll be putting our doctors and nurses on those planes to move these patients safely. What time will those flights arrive this evening? Late evening. At the moment that's still been worked through logistically. There will be we'll have a staging post managed at the airport so we can manage the numbers that are coming in and then distribute them out to the hospitals in Brisbane. QAS has got all that in hand. That's been worked through with ADF at the moment. Current modelling certainly has cans as the largest centre likely to be affected by the crossing of this cyclone but still down south of cans wherever this crosses the area south of it will be hardest hit so we're still very concerned into that Cassaree coast area which is cities or towns like Innisfail, Mission Beach, Cardwell, further into Hinchinbrook and into Townsville. Premier what about some of the preparations for Palm Island and also remote Indigenous communities? The mayors of Palm Island, Woodger, Woodgill and Hopevale have been part of the state disaster management hookup and Palm Island has all of the storm surge modelling on the island and has put in place arrangements to ensure that people affected by storm surge can be located into other homes on the island. Similarly Woodger, Woodgill and Hopevale and of course Yarrabar, east of cans are all looking right now at the storm surge data and determining what if any relocations may need to occur. Yarrabar of course is particularly low lying and their council is working with the cans council and the Bureau to work through exactly where they need to relocate people to. Has the cyclone crossed any small islands? Not to my knowledge, no. I think the first thing that we'll see in our area, the cyclone crossed tomorrow will be the Bureau of Meteorology radar station on Willis Island where there are four Bureau staff who will be gathered in the one Cyclone category five proof building I would suggest. No. We have set up a phone line for people to register if they're evacuating and we'll provide some more information about that this afternoon but obviously people are doing this informally. They're going to their mother's place. You know staying with friends so no it's not possible to track exactly how many but we would be encouraging people later today once they have relocated to register and to let police know because their friends and loved ones from around Australia will want to know where they are and we don't want them to be inadvertently listed as missing. My understanding is that there isn't but the volumes are growing and we are encouraging people to make this decision early. If they're going to go now is the time to do it and we're taking what we consider a quite sensible action in this regard. You said this morning that you'd make a decision or a decision will be made by lunchtime today with regard to mandatory evacuation what's happening with that? Certainly mandatory evacuation can only be undertaken with the full support of the local councils and their meeting as we talk in fact I'm hoping to leave here and go and speak to the relevant officers and mayors straight after this meeting so certainly we will have a better idea by the next time we provide you with information this afternoon. How far away can you have to travel by car south to be able to danger zone? Well certainly Townsville is going to experience on current modelling the equivalent of a low Category 2 cyclone all the way down to about Home Hill and we're advised that Mackay will experience similar conditions to a Category 1 which is similar to what was involved with Tropical Cyclone Anthony just the other day. So in reality we would like people to get as far south as possible quickly as possible without of course breaking the rules but Mackay is probably a target area for the safe for complete safety. Premier have you worked out the alternative? No I'll invite Janet there is a couple of facilities being looked at but there is certainly ample emergency staff to provide emergency medical treatment and that will be available and we'll be in a position to give more precise information I would hope later this afternoon did you have anything to add to that? That's quite right Premier. Our concern is that the care and space hospital may will be inundated so people can't access it so we will set up an alternative emergency department elsewhere where we know it won't flood. What hospitals are the patients being taken to and how can we do something? At the moment we have Princess Alexandra, Royal Brisbane and Women's, the Children's Hospital, All On Standby and QE2. Buildings in north and far north Queensland since Cyclone Tracy, buildings built since then have been required to be built to Cyclone standards so whether they're homes or schools or any other office block they've been required under the building code to be built to a certain Cyclone standard. Obviously in well settled areas like Cairns there are many older homes that will not have been built to that standard and people who live in them will know that. That's why we're encouraging them to make sure that they are in the safest place that they can be. If it's not a silly distinction are you more worried about the wind or the flooding out of this or is it both? I'm advised that in Cyclone events, serious Cyclone events around the world, more people are injured or lose their lives in the water that is associated with storm surge than in wind and flying debris. Only because people are generally sensible and stay out of the wind and the flying debris. So in terms of what is more dangerous it depends on people playing safe and getting out of any area that might be subject to storm surge flooding and staying inside once the serious winds start. These will be highly destructive winds. They will be higher than we experienced with Cyclone Larry and they will be life threatening if people make it their business to go outside in them. So loss of life and serious injury ultimately will depend in some respects on people being sensible, listening to the warnings, taking advice and not treating this as a tourist event. It will be a display of the awesome power of nature but it's not something you want to go outside and watch. How long will you give them before you physically move? Certainly we hope that most people will move when instructed to do so. And if they don't, what's the latest that you will send people in to shift them? Well door knocking is already starting in these areas to warn people and to ask them to move voluntarily. The mandatory issue comes in when we actually direct them to move. The problem then becomes one of capacity if we have large numbers of people who are still in place that we're asking to move. Obviously there are practical issues in how do you actually forcibly ask large numbers of people to move when you're moving towards a very dangerous event like this. So there are some really critical factors in the practicality of... So what I'm trying to say is what's the latest that you can do? Certainly. This will go on throughout the night if necessary. As we've already said at about eight o'clock tomorrow morning on current predictions it will become dangerous and high risk to be driving about or walking about or doing anything outside due to the force of the winds that are expected tomorrow morning in the critical areas where the crossing will take place. Partly, but certainly it doesn't stop us working right throughout the night and we're capable of doing that. Will police have to control the streets for that reason? It's standard practice that all emergency services workers get to a point where they actually shelter in place too because we don't want them to put their lives at risk. We need them to be available to us immediately, the dangers passed to help deal with the post-psychotic event as well.  That's pretty much right, absolutely. I mean, if people go out and purposely go out and get into strife, get into some difficult or create a high risk sending emergency services workers out into that environment is not necessarily practical or sensible. Yes. We will have an update from the Bureau at five and I'm already agreed to a number of live crosses into news with any updated information out of the five o'clock and there won't be any further updates after that. Not scheduled, but if anything dramatic happened we would of course advise you through alerts and other press releases. So, 3.30 here and then further advice out of the five o'clock State Disaster Management Group where we have the that'll be the latest modelling, the last modelling for the day from the Bureau and then no scheduled updates beyond that, but then again tomorrow morning at 9.30. I hope to have that by 3.30. Thank you.


Okay now we have our slides back again. So organizing a conference is apparently a lot of work and many, many administrative things are involved like booking conference hotels, negotiating the rates, organizing the food, finding the venue, organizing basically organizing everything around it like sponsoring and so on and so forth. And I would like to thank my team to be honest that did the vast majority of the work. So this is Karina, you will find her on the desk. She basically did I would say 90 percent of the work and the rest supported her where she actually or where we actually could. So please thank them all and whenever you have questions or problems or issues please approach one of these people with the nice orange shirts. I mean you see some of them in the back in case you have questions. People are usually interested in statistics. It's nice that we could essentially stop the a bit the downtrend of TCC participants, right? So basically in 2018 we reached the low with almost 100 participants and now we are back to 136 I think with 16 registrations in the past two days. That you attend this conference is actually very important, right? At the business meeting at the ICR people asked why are all people actually going to other conferences and TCCs going down as your attendance here is very important. We have a very nice program thanks to the awesome work of the program chairs. Dennis and I know the coffee breaks and the lunch will basically provide it will be outside so you find everything there. Regarding your talks please visit or please go to the rump session chair sorry to the to your program chair meet them before and let's try that the technique works better than it did in my case. The rump session you already presented to you. The dinner will be on Tuesday as we said the places actually sold out in case you don't have time to show up please let us know then we can give out the vouchers to to other people that are not able to to get one. We have planned four excursions and most of them were also quickly sold out. One of us will always be there to help you. The first one is the castle so please see Vicky Onger if you have any questions. The second one are the Nurembach Trials this will be with Dominic Doiber and myself. The third one are the rock cut sellers and Karina will help you there. The fourth one is the documentation center and Christoph Egger will actually be the person to contact. So I want to spend just just one minute more about what was Germany actually famous for what what what can you see here. So the map you see here are actually the breweries the breweries that you can see find in Germany and there is Nurembach and as you can see we have the highest densities of breweries so please go around and try the different types of beers. We are also very famous for the Christmas mark that was finished for the first time in 1628. It's usually open from 10 a.m. to 9 p.m. and if you brown want to bring some some presents for your relatives we are very famous also for the for the Liebkuchen basically the gingerbread. And now it's my my my honor to welcome our president who took the time to come here Achim Honegger. Oops I don't want to see my picture. Sorry. So a warm welcome to Erlangen a warm welcome to Nuremberg as a representative of the board of the Friedrich Alexander Universität FIU FIU I warmly welcome you here in the wonderful city of Nuremberg please apologize that I was a few minutes late I was stuck in the traffic because you know the daily commute and in particular on Mondays it's quite hard to get to the city of Nuremberg. So a warm welcome to FIU FIU is a very traditional university here in Germany. We are 276 years old we were founded in 1743 in the city of Erlangen. Margre Friedrich was the founder of our university and in 1961 the business school of Nuremberg was linked to our university and since then we are the Friedrich Alexander Universität Erlangen Nuremberg located here in the metropolitan region. The FIU is one out of 10 of the 10 largest universities in Germany. We have 40 000 students here in the metropolitan region. We have more than 14 000 employees at our university including our university hospital and we have around about 600 professors in our system. In terms of organization our university is a full spectrum university covering a wide range of different fields. It's just or it's the it's a full spectrum comprehensive university and there are just two in Germany the University of Bochum and our university and we offer more than 250 bachelors and masters program. So you can imagine that the strength of our university is also cross-disciplinary collaboration and that's also what we stand for and having a full spectrum university and talking about profile of the university that's also quite quite a challenge and we are in terms of innovation power also in a very unique environment. Here in the metropolitan region innovation is something that we have in our genes. We have a lot of larger companies you are familiar with for instance we have the Siemens company here in the metropolitan region Siemens health seniors healthcare the headquarter is just walking distance to my office we have Siemens energy division Siemens industry division all these core businesses of Siemens are here in the metropolitan region we have also the Alidas company you know the sports company they also stand for innovation in their business we have the Puma company we have Schaeffler automobile supplier company more than 100,000 employees and we have strong links between the university and our industry partners here and it turns out that FAU is pretty strong in supporting the innovation process currently we are in terms of patents citations of our basic research results in patents citations of our patents in other patents the usage of our patents patent application success rates and things like that we are number one in Germany so there is no other university that supports the innovation process like we do at FAU and we are Europe wide we are number two listed right after KU Löwen and worldwide we are listed number 14 and this shows to you that the link between basic research and industry is something that we understand and support in a way that is unique if you talk about the region you also have to mention if you are in this wonderful museum here that the first train connection in Germany was here in between the cities of Nuremberg and Ferd Nuremberg and Ferd that's a distance of a few kilometers and the first train connection was built in this area and that's also the reason why the train museum is here located in the city of Nuremberg so mobility is a topic that is in the focus of the regions of the region for many many years other aspects Dominic has already mentioned we have the highest density of micro breweries in the area that's one thing that is quite interesting for visitors and talking about profile of the university our humanities are very much focused on human rights research because here is the cradle of human rights the basic concepts for human rights and the so-called Völkerrecht was the international right or international law the the basic concepts were worked out here at our city of Nuremberg next to our university and you will also visit here the locations where the trials have been after world war after world war two so that's a very historic situation and it's some kind of natural that also our university is taking this unique embedding here putting human rights into its research focus so there is a lot we can offer exciting exciting times you are here to talk about the theory of cryptography one challenging topic in computer science by training I'm also a computer scientist I'm in the field of pattern recognition our computer science department was founded in 1966 it's one of the first computer science departments in in Germany and currently also one of the largest ones in terms of the number of professors and staff members and I'm I'm very happy to host international researchers in this demanding field and I really hope that you enjoy your time here in Nuremberg I hope that you will have exciting discussions scientific discussions but I also hope that you will have some time to experience the wonderful city of Nuremberg and all the things this wonderful city offers to our visitors so take your time enjoy the conference enjoy FAU enjoy Nuremberg all the best and please come back soon thank you very much