You are in for an amazing treat right now. This is stage B. If you're expecting to be somewhere else, then you probably want to run away now. But we have Lydia Cossogmas. She joins us all the way from Berlin via a way of the United States and bits of Europe and bits of the Middle East. She's from all over the place. It's amazing. She's doing some groundbreaking research on disruptive technology, how it impacts society. She's making a game at all. I'm just so excited for this talk. I'd like you to give her an enormous AMF round of applause. Thank you so much. But before I even start, I think we have to say that this is an amazing camp. This is my first time here. It's all the volunteers who have made this happen. To you I say thank you so much. This is magical. My presentation is about how it's actually a magical time to be alive. I'm looking at different technologies that affect humanity. When I was introduced, you talked about a game. I'm actually creating a card game that has prompt cards to give us to think reflectively about the technologies that are being created and how they affect our society and our humanity. When I submitted this talk for AMF, the feedback I got was like, that's great, but could you also be critical about the technologies? I will be critical as well about the technologies and I look forward to your questions and comments. This presentation goes from birth to death and we're going to walk through some of the different aspects. In the card game, these are some of the different categories that have prompt questions. Starting with birth, DNA editing. For those who are not aware of it, DNA editing is also called genome editing. It's a type of genetic engineering in which DNA is inserted, deleted, modified or replaced inside the genome of a living organism. This is great because it has the potential to take out certain inherited diseases or illnesses, which means that we can live healthier and longer. This also can create a new industry of designer babies, which is a hot topic right now. The idea behind it is that you could design your baby the way that you see fit. Right now, the technology isn't there to do everything, but some of the ethical concerns are if you could change the eye color, the hair color, the skin color, if you could make the muscle stronger, or if you could even make the brain smarter or capable. The question lies, if we were able to change all of those things, would we, should we? What does that mean to us and how we think? Also, would designer babies create a new form of minority or disabled communities such as those who were not able to get genetically modified to be super strong or have better neurological connectivity? Next item in birth is this in a moment. Can you imagine a baby growing out of a woman's womb? So it's a thing, it doesn't exist yet for us, but it's a thing and it's called an artificial womb. It's a hypothetical device that would allow for external pregnancy of growing a fetus outside of the body of an organism that we normally carry a fetus to turn. Right now, they have done experiments with a lamb and it's been successful for almost a month and then they stopped it. And then with a human embryo, embryo, they've done it up to the legally allowed limit, which is 14 days. And so they have been able to successfully grow one externally and then they stopped because the laws don't allow them to continue. This is kind of the system, how it works. And some of the interesting questions that it poses, so first of all positively, it would allow couples to have babies even if they had genetic issues to having children. It would allow same-sex couples the transgender community to have children and it would also allow people to have children later on in their life. The interesting thing that this creates is if we were able to have an external womb where we would create human beings, should that be regulated? And if so, how would we say you can only have two, three children created or you can only have one at a time? Can you have two at a time? And should there be people that couldn't have access to doing that? And how does that compare to when you do it naturally? In the category of learning, there are exciting new technologies and I've listed them near virtual reality, augmented reality, artificial intelligence and brain computer interface. So virtual reality, augmented reality is a picture that we have here is where you would see your environment but you would see an overlay on top. And this is very helpful as we learn to see things better. This is another example of that, learning about anatomy. Here's an example where you have virtual reality and the screen kind of shows what this person is looking at. Another type of way to learn is through neuromodulation where it is the alteration of nerve activity through targeted delivery of a stimulus such as electrical stimulation or chemical agents to specific neurological sites in the body. And this can help give you an advantage to learn faster. This is the latest right now in terms of what has been shown to work and what is planned. You take a moment to look at that, lots of potential here. One that exists, this headphone that this person is wearing exists and what that does is it puts an electric field in this area up here so exactly if you're wearing a headband or a listening device. And it puts electric field into the motor cortex to induce a state of hyperplasticity and when you are wearing that and when that's active you learn faster. What are the consequences? I don't know, they don't know. It's one of those things that you have to wait and see what happens. Another one is brain machine interface. So this is basically putting something in your brain or that would be minimally invasive. That's what they're working on right now. There's some companies, one of them is Neuralink, that's Elon Musk's company and he's trying to make this happen.  So right now that's being worked on and this would be another way to learn. So with all these exciting ways to learn, there's still one aspect that's missing and that's passion. And I was talking to somebody who is in the Netherlands working with some universities about passion and getting students to learn about passion and find it for themselves. What those universities have found is that they have all the technology of the world. They have all the information of the world that they can give their students. But they're finding that some students, many, are not as motivated and they're not feeling as excited to do things or learn things. And so he right now is trying to see how he can help those universities teach students passion. And his proposal is we need to go back to the human connection. And he's now looking for people who are very passionate about what they do to put them in front of those students and just for them to talk about the things that they're passionate about. And this is something that technology can't do. Relationships. So this picture here is a robot with a child. This is an experiment that was done successfully at a hospital where they were trying to get children to feel less nervous about shots and just medical day-to-day procedures. And this worked. Kids felt happier when the robots were around and got to play with them and felt less stressed about the whole situation. As we have more and more robots, we're going to have more and more relationships with them. So here's one example. And then another one is pets. We may see more robot pets that we adore and have in our homes. Another one is having artificial intelligence companions. And this is actually something that already does exist. And Dr Kate Bellman talked about it yesterday evening in her talk sex robots. So this one you can customize your AI to be as you like. They have different personality traits and then you can talk with them. And this is on the AI. It also has the actual doll robot. Again, this is what Dr Bellman talked about yesterday. And so if you can imagine, with our loved ones, we text them throughout the day and tell them how things are going and all of that. So imagine you had an AI which you would communicate throughout the day and let that AI know how your day went and that AI would respond to you in a personality that you liked. And then you could go home and play with that same AI and hang out. And so I see the potential of having a new form of companionship which would be separate from human companionship. You may see this as familiar because this is what was talked about yesterday by Kate Bellman. This is again the doll that she was talking about. So you could have the AI version on the phone and then come home to the doll. So we could see a rise in robot companions and we have another one with caretakers. And I want to share with you some very nice pictures from a hospice in Italy. They brought this robot and this patient here is introducing herself to the robot and welcoming it to the facility. Now this robot goes to pick up a patient to help her come to the dinner table. And she uses the robot to walk her way to the dinner table. And I think that you can see that this was a doll that did well over there and they liked it. The next category is identity. With more technology we'll see our identity changing and the way that we see ourselves changing. So what is a cyber? A person whose physical abilities are extended beyond normal human limitations by mechanical elements built into the body. And here are two examples. The one on the left, he is colour blind but very severely and just sees actually black and white. And for him this was something really important and so he installed, literally had surgery into his skull to put this device on. And what this device does is it doesn't make him see colour but it makes him feel colour. And so the device has some light and it reflects on the colour and then in his head it comes as like different types of sounds. And so he sees colour through sound. And actually he even did an actual musical performance with an orchestra and they played the colours that he sees. And he designed it so that's really interesting. The next one he has this kind of special glasses that help him see and he's also the first victim of a cyber discrimination attack. He was in Paris and three people attacked him and tried to pull that off of his eyes. So as we see more people connecting themselves to technology we may also see discrimination. So it's something to think about how it is we help support people who are exploring themselves in different ways. In work we're going to see work transformed again through virtual reality, artificial reality, artificial intelligence and brain computer interface which we've already talked about. But as well as avatars, holograms and haptics. So with virtual reality you can go into a room, be an avatar and communicate with others and have meetings there. And this is one way you can reduce costs and pollution instead of driving to work or flying a plane for a meeting. We can do this in virtual reality. With holograms we can actually sit and see the other person in a holograms form sitting down and have that conversation. These technologies are being developed, the proof of concepts are there and it's only a matter of time before they become more prevailing. Haptics is an interesting one. It's a technology where you can admit error, kind of feel buttons and different knocks. And that's still in the early stages but that'll be something that will affect our lives. With augmented reality already Microsoft has a few proof of concepts out there where we would interact with like a special type of glasses where we could see our world and the augmented reality and move screens around and push buttons and all of that. In the category of stuff 3D printing is doing marvelous things. So 3D printing is the action or process of making a physical object from a three-dimensional digital model, typically bylining down many thin layers of material in succession. What this has done is that it has allowed for mass customization. And Thingiverse, I believe that many of you are aware of, is an amazing resource where everybody shares the things that they've created and you can, there's one here in the picture of a toothbrush and a vase, so many different ways to share the things that we make. Not just sharing things but we can also share culture. My manufacturer has an initiative called Scan the World and what they're doing is they're trying to scan culture, whether it's a statue or a device, but things that are part of our culture as a global and part of our history so that it can be shared with others. And also in the event of a destruction, such as a bombing or an earthquake, these precious items of culture can still be preserved digitally, they can also be reprinted. So if you could example, for example if you could imagine a Greek statue from Athens being 3D printed in Australia for students to touch and see and visualize. Another one is scaffolding for 3D body part creation. Yesterday we had a talk by Konichi Wakiti, Rachel, these earrings are actually from her. She talked, she's doing her PhD creating eyeballs and so 3D printing also can create scaffolds. If she's here I'm sure she'll have a lot of great comments about this. Another thing is that 3D printing also helps people with disabilities and in this case you see here a child who, he has this amazing cool hand that he can use and it helps him grab things because he's missing his hand. However it's not always positive like that, you can also 3D print weapons. And right now there are files of 3D weapons that you can print. And finally we are at death. So one item that I think will transform death is whole brain emulation or wind uploading. It is the hypothetical futuristic process of scanning the mental state including long-term memory and the self of a particular brain substrate and copying it into a computer.  But up to that point so you'd be copying that brain up to a certain point. Whether it's conscious or not would be very much open to debate. So what this does is it allows for us to create a copy of ourselves but it also allows us, this technology has not been created yet but there are people who are working on it. If and when this does exist it would raise questions about immortality and whether or not we should leave behind our brain. And if so if we had a loved one for example who passed away, should we communicate with that brain? Should we keep that person alive when they are gone? And this, I do not have answers to that, this is for all of us to discuss and think about. But there are technologies that are working towards this and they do have implications on how we deal with grief and how we understand death beyond our body's death. So in conclusion it's a magical time to be alive and I hope that we purposefully and thoughtfully create technology and that we bring it to our lives in a way that does more good than bad. The card name that I'm creating is meant to raise all these questions so that more people could talk about it and so that it doesn't just happen in a lab somewhere without civic society having a say in that. If you have any questions I'd love to take them out. Thank you so much. It's an amazing book. If you have a question, please take your hand up and wave so I can see you. I see one person there. The question of brain uploading and things like that, there's been explored in science fiction and people can call it doctor's walk away and black mirror both explored those. What's the, what do you see the importance of those sorts of explorations of these ideas and sort of teasing out the consequences in those environments? So one of the things that comes to my mind is what if Osama bin Laden's brain was uploaded and what if his followers today were able to communicate with that brain and that brain simulated would continue to provide feedback and encourage them to continue. You could apply the same reasoning to Hitler and so other ethical questions that would arise is if and when this technology does exist should it be regulated in the sense that certain people would be allowed to have the brain uploaded and other people wouldn't and if so what are the parameters for that? So that is one item that I think could be explored as well. Any more questions? I see one over there. In terms of the products at the, where does the majority of the funding come from? Is it state or private? From what I've noticed it's mostly privately funded. Obviously I've talked about arranging technologies but I'm seeing more and more of it being privately funded so for example the one about brain computer interface, Elon Musk, he's funding mirroring. So I see most of the technology being privately funded. There is obviously some government funding but I believe that I see it more in the private sector. Any more for any more? In which case a huge amount of calls for relief from public.


What's going on here? It needs to tell one great story. It allows us to be able to get truth. What makes that particularly interesting?


And welcome to today's edition of Frightfully Forgotten, but to start things off, what are we drinking? Sir Alexander Saxton's Fossil. It's a German ice-bok. And what percent? Oh, nine, ten percent? Ooh. Today we're continuing our Made For TV horror theme, and we're going to dedicate a whole episode to John Carpenter's Made For TV efforts. So the first one is called Someone's Watching Me, and it came out in 1978, written and directed by John Carpenter, stars Adrianne Barbeau, who he ended up marrying. They met on the set of this movie. And Lauren Hutton is in this as well. The movie starts off with, uh, we get introduced to Lee, which is Lauren Hutton's character, and she's moving to a big high-rise apartment building for a new job. She befriends Adrianne Barbeau's character, kind of an interesting thing.  That's right, yeah. Which is pretty rare. Oh, for 78 they don't really have female gay characters on TV. Yeah. Lee starts noticing, like when she comes home, the door is open ajar. She also starts getting really strange phone calls. She also gets gifts, too, in the mail. Little by little she starts getting more and more paranoid that somebody's watching her, right?  No, they won't do anything. Eventually, her and her friend sort of cook up a scheme to try and catch this guy. Perfect example of taking the format of a TV movie where you can't have a lot of gore. Just have a story, a really good, simple story, told and paced perfectly. Exactly. It's all building tension. You feel what she feels. Yeah. She sympathizes with these characters a lot because there's a lot of character building, right? The scene where she comes home and then you see the shadow of whoever's in the apartment just kind of go by her and leave because they're still there and she gets home, you know? Yeah. It's like... And the scene in the laundry mat, the guy's stalking her and she has to go under that grate. Yeah. She drops the key. Yeah. And then the guy comes and stands on the grate and is kind of looking around and she's just... Yeah, yeah. And if you would have looked down, he would have clearly seen her. Yeah. It's a good mystery too. It's a good mystery movie. Uncle Leo is in this. He's kind of a patsy. Yeah. They all send him away and he loses his pension and everything. So it's kind of nice seeing Uncle Leo in something different, you know? Yeah. He's young but he's still old. Yeah. It's the perfect mix between Rear Window and Black Christmas. And you can tell where Carpenter's going from here, right? Exactly. He uses a lot of elements and techniques in this in Halloween. Yeah. He's perfecting that. Body bags sort of hosted by John Carpenter himself. It's an anthology series and the first one is the gas station. A girl starts a new job at a gas station. Make sure you have your key on you because once the door closes, that's it. You're locked out. You're locked out on the news that somebody's on the loose, right? He's still on the loose. And it takes place in Haddonfield. That's right, yeah. All these weird people start coming around. West Craven. Yeah. George Buck Flowers, his name, he's using tons of John Carpenter things. Tons of things and generally he's always the drunk guy or the bum, crazy drug driver. And the suspense builds, eventually all of this kind of culminates into somebody really chasing her and wanting to kill her. And she's going to have to fight for her life. It's a simple story told perfectly by the master where it's all about building tension and suspense. And like all the foreshadowing is really neat in this. Yeah, you have to pay attention, right? It's, again, it's a classic Carpenter thing where if you're not paying attention, you're going to miss these clues that elevate the story to the next level, right? Even all the cameos are super neat in this. You know, Chloe of the Month, a little picture, and it's Sam Raimi, you know. And David Naughton is a little cameo in this too. He was, of course, famous for American werewolf in London. Exactly. But Jason is in this too, and he's a Carpenter regular, basically, he's in Prince of Darkness. The next story on Bodybags is called Hair, and it is not really a horror. It's more of a comedy. Stacy Keech is in it, and he's great. He plays a great straight man in this, and he plays a balding man, can sympathize with this guy. I've been there where he's trying to style it different, so it's kind of hiding it a little bit, and he's super obsessing over going bald. Got that toupee. He goes to the barber shop wearing a toupee. He tries doing some one of those painted on jobs, where you just paint your scalp thing. When he answers the door, he's super obvious.  So he keeps seeing infomercials for this new hair restoration. He chooses hair style, right? That super 90s tech wakes up the next day, and he's got all this hair. But the hair keeps growing, and the hair is alive. You see the little follicles moving, like worms and stuff. This one's great for just the characters. You really sympathize with the characters, and you can relate to them. I can relate to them. I think a lot of people can, even if they're not bald. This is about vanity. The next one is called Eyes. This one wasn't directed by Kardonger, it was directed by Toby Hooper. This one tells the story of Mark Hamill, who's a baseball player, and he's kind of making it to the big times. He seems kind of old to be making it to the big times.  We do learn that there's a new treatment to replace his eye with a cadaver's eye. Everything's going great, except all of a sudden he starts getting flashes, and he sees flashes of somebody buried in the backyard, or putting stuff down the garboretor in the sink, and he sees an arm going down, his blood everywhere, and he also starts turning against his wife. He starts getting very irate with her, and it turns out that this eye they got from a serial killer. If you want to see what Mark Hamill does exactly, keep watching.  This one is great. I really like the story. It's really good.  So that's body bags, really, really good made for TV horror anthology, and the music for the whole thing is great too. It's so John Carver. Perfect. The next one on our list is part of the Masters of Horror, and we've already covered it, so we're not going to go super into detail, but it is cigarette burns. If you want to see our full review, click the link. We're going to post it up here, but just to quickly go over it, it's basically about a film buff who is hired to find a lost film by a very eccentric man, and he gets involved in this weird CD underworld trying to find this lost film.  So check out cigarette burns and check out our review for it. The other Masters of Horror one that Carpenter directed is Pro Life, and not so good, not as good as the first one he did, but this one tells the story of a girl, a young girl who finds her way to an abortion clinic.  Her dad pulls up, played by Ron Perlman, everybody seems afraid of him, he's got this big reputation, and he's basically going to do everything he can to stop it, breaking into the place and trying to shut the whole thing down. The reason why she wants to get rid of this baby is because it's not really a human baby. It's growing very quick. Very fast, yeah, and that's where we're going to end it, because you're just going to have to keep watching and see what this thing really is and how it turns out. I think it seems a bit phoned in on Carpenter's end. He just took it for the job, for the paycheck. The story is really neat. The conflict of abortion, right, like there's this guy who's super against abortion, he's going to these extremes to stop it, but in this case, maybe he should change his mind. Yeah, exactly. And he's using God as the excuse, right? But the funny thing is, is that God, you don't have to worry about God in this one. So the idea is really good, I think that the way it's told is really just lazy. It falls flat, it feels flat. And the effects are pretty good in it actually, but they don't need to be there. That's kind of my problem with it, you don't need to see all that stuff. You could have got the job done without any of those things happening. So yeah, definitely check it out. It's worth watching, it's just not going to change your life. You compare this to cigarette burns and they're like drastically different. You can tell John Carpenter cared about cigarette burns and not so much about pro-life. That's our little episode on John Carpenter made for TV horror that some of them I didn't even really know existed until not too long ago. You may not know they exist either, so definitely check them out. And until next time, keep drinking.


So my name is Caspian. You've all heard that. I'm going to talk about 10 things I wish I knew before my first incident I'm not the only one who wrote this talk So my manager a crowd-strike Shelly Giesbricht who can't be here today would have been doing this talk And I think I'm looking forward to seeing her version of it because it's probably gonna be pretty cool We're gonna go over a story or two and then we're gonna get into my top 10 list and I hope you'll enjoy it I'm just gonna Proface this I don't know by saying Nothing I'm talking about in here is not public information. So it's already stuff that's gone out I don't speak on behalf of my employers while I'm here. I'm speaking from personal experience I've been with crowd-strike for a while. I've been doing this for 20 years though. So That's kind of the whole thing. So let's start with my first incident I was pretty young. It was a long time ago ransomware wasn't a thing yet and I Was kind of a junior incident responder really like getting into my stuff getting very excited about things and we had a malware case Kind of like what we've been talking about for the last couple of hours except much less advanced than anything I've been talking about for the last couple hours We hit the big red panic button a bunch of people go running into this executives office.  We're pulling stuff out.  Oh my god. It might be a state-motivated threat actor They might be attacking us Turns out it was actually just an email campaign and the only reason We were freaking out was because the email campaign deployed something on this one executives desktop and the poor executive went Yeah, let me just click on that and open it That ended badly it ended in a huge waste of resources I had ended us scrambling pretty much all the jets and the search dogs and the fire department For nothing it also kind of did some bad stuff for our security team because we Got looked at is that the people who freak out over nothing, which is not a great situation so There's some commonalities here. You're seeing them up on the screen of course but one of the things that I like kind of pointing out is that I There are usually three things you need for doing Incident response. Well, they're up there. I'll let you read them I'm gonna talk about a second story where and this was a little bit later in my career At a hospital we had something worse happen this time. It was real so ransomware hits a hospital This happens. Unfortunately. It's a it's a thing this time It's not so bad that it's like making the hospital not work But it's bad enough that it's messing everything up for us and we hit the big red button and everybody panics and everybody runs and thankfully We had the ability to call out for help So we got some extra people in but it took us a little while to get to that point We also didn't have any way of talking to anyone in the various divisions of the IT team or anything else So, you know, it took us a while to get to the point where we were covering things So by the time we finished the recovery, you know about 16 million years later. Actually it was close to six months The threat comes back and wax us again Yeah, that was great I think the main thing here basically is plans communication and visibility obviously the visibility part is actually My number 10 on this list. It's the first stop Can you even detect threat actor activity? And a lot of people are gonna be like, yeah, cool. We've got tooling We've got automation. We've got all this cool stuff and that's great. It's very important I work for a company that sells automation and tooling I worked for a company prior to this that also did that I've spent a lot of my life looking at other people's work around it and Honestly, everybody's doing a good job in this space I'll obviously say that you know my employers are better than everyone else because I work there But I've also actually gotten to work with their stuff a lot But The main thing here for me is actually people You can have all the shiny blinky lights in the world You can have all the machines that go ping it really doesn't matter if you don't have people who are capable of handling those things So, you know, there are two questions on this slide obviously and these were ones that I would keep asking every time I changed jobs every time I got a new role as an incident responder What what's the security stack look like and it's gone from? Norton antivirus which should give you an idea of how long I've been doing this To advanced endpoint detection and threat resolution blah blah blah intelligence sprinkle some blockchain on there Whatever you want And and the thing with this is that that stuff's great But sometimes your solutions bail or twine and duct tape or just grab so Knowing you can detect stuff is great Knowing what happened is even better and a lot harder and and the three things here on this slide These are kind of you know an ideal situation I have never worked with a team either in consulting or in you know in practice when I was doing it where we have all three of These lined up perfectly Usually what we've got is it got a situation where we've got some good investigators But the logs aren't being stored anywhere or the logs are only being preserved for a week because they're too many of Them or on and on and on In a lot of these situations, you know your your outcome from your your actual incident response is probably not going to be as Good as you want it to it's not going to be one of those things where hey, you know, this is great We resolved everything, but let me talk about one where it did work for me And this was a little while ago It was another minor ransomware case and this time basically I walked in the door I think I was working alone at this point And I said, you know where your logs and the IT person comes back and he says, oh, they're right over there All 40 gigs of them go nuts So several hours later, I had started to be able to reconstruct how the threat actor got in what they did everything else This is you know, not not a lot of systems. We're talking about it's a fairly limited scope and what was kind of nice about it was We actually had a resolution within a week, you know, it wasn't an incident that just dragged on and on and on We actually knew what we could do. So that's a good situation I've been in a lot of bad situations and usually it's because logs are missing or they're not stored long enough or People aren't trained on their equipment. I think I'm repeating myself, but I think you get the point I've also worked with a lot of grep in the past. That's why this is up here. This is actually me 25 years ago when I got my start in incident response so The next question we've gone with Can we see the ta? Can we investigate? This is a bigger piece for me. What can I contain? I love this picture and that's why I put it up here, but I There are a couple of main things about containment containment is should be your first move on an incident but in a lot of cases your first move is Once you get past this part go to containment look at what you can contain and you should know what you can contain but a lot of people don't because you know There's more than just the incident response team working in IT. So you're gonna end up in situations where Your containment isn't working because you're missing pieces. There's missing communication that kind of goes back up to my top slide, right? I've worked with teams that really know their stuff and they've got good processes and there's been tooling and investigation And this is also doing the consulting side of things But for me the containment part is usually where people trip up. We think we've succeeded We're not sure can we call you and get some more information and I've been the person asking those questions and For me, it's kind of perpetually a case of like how sure are we? How far can we see so let's go back to slides, you know who who's actually able to help us here, which is another piece so I Think with ransomware. It's actually really simple to talk about containment. We're basically saying okay Stop the spread cool Great, we've done that. What about the threat actor and the C2 networks and the rats and the data? Well, you can't prove the data was exfiltrated unless you can see what's going on on the network And if you can't see what's going on on the network, let me back up a slide. No, I'm kidding So the next piece after the containment side and actually in some cases at the very beginning of the containment side is Who do I call for help? I Where's your team of avalanche search dogs coming from?  Across the room to the IT engineering department and say, okay, can you like you know close all this stuff up? I've got a really interesting story about that one actually I was working at a place where we had a really really large network and What basically happened one Friday, of course at around five o'clock when I was on my way out to a conference Was the entire network went offline not just Not just the internal one, but our connection out and literally everything else. We basically DDoS herself from the inside of the network and Network engineering lead comes over to me and says you're never gonna guess what just happened And I'm like, well, I think I am because you're gonna tell me and I'm gonna bet it was a worm. Yeah, it was So the problem with this was we had no way of reaching the side of the Large campus that I was working on to talk to the people who had the worm to tell them to stop for three hours so our entire network was offline for three hours because we didn't have a phone number the other piece of this and this kind of Turned into something later because the reason this DDoS happened was we had a piece of technology that had really really really really Really poor internal security I don't know if any of you have ever run across a username of developer and a password of you can guess so This is where the functions that end in R come in in this case HR wasn't involved PR Thankfully wasn't involved, but lawyer was involved and then there was a third one that we didn't have to call up our fourth one Sorry external responder Knowing when to escalate is kind of important because getting those people those ours on board is Sometimes gonna require a call at three o'clock in the morning And sometimes it's gonna require that they actually get over there in time when I've worked for on-site incident response teams Which I've done a little bit We usually try and have a 24-hour readiness time if you're in the middle of a ransomware case That's That's a lot of time, you know, so be prepared to get extra help know who to call for extra help and know who to escalate and if we You know go back to my original sort of not exactly an incident incident The escalation went to me, but I was the only incident responder there I was the junior incident responder and that's all I did And it was coming from an executive who probably should have been the person who actually had the power to do that But didn't really know how that worked and I think this is probably one key point to take away from this is You need sponsorship from somebody further up in the organization even if you're at the top of the organization You should probably have that backing so the next piece in my top 10 list is criticality This is one of my favorites because I do a lot of strategic practice work as well as incident response And I help run red team blue teams and you know do tabletop exercises with people So we spend a lot of time Doing simulations and sitting folks in a room not as many folks are here right now but sometimes we get quite a lot and We usually will have a question of like okay, so where are your critical systems? And my favorite thing in the world and by favorite. I mean I absolutely hate it It's kind of terrible is the number of blank faces. I see when I ask that because there's always a oh Yeah, I mean I guess I guess the point of sale machines are critical or Maybe it's that that electronic health records that's probably important or or maybe our SQL data bit and then it balloons And this is the thing with what critical is It's obviously get a very poor organization, you know if you're if you're in You know if you're running a store for example, you're doing sales It's gonna be a very different thing from if you're a hospital or a factory that makes widgets It's also gonna vary per team everyone thinks what they're doing is important You don't want to really take that away for them obviously but you do have to have a hard conversation about who gets budgets and who's responsible for patching and Who's gonna be there when the lights go out and who you're gonna call to restore everything because as an incident responder You can't do everything and usually this is why we at you know, we call it a team, but the team kind of extends The other piece of this is who knows what and and who knows what they own and this is my favorite This is my favorite sort of like dig down when we're doing tabletop exercises The worst thing in the world in an incident is to not know who owns the system you're working with I actually had a case years ago where We we had a it was another malware case So it gives you an idea how long it was because you know malware now is solved by everything But it was a mouth malware on a Windows XP machine Malware on a Windows XP machine and a part of one of the buildings I worked in that no one knew even existed until the malware pinged our antivirus and went hi, I'm here calling out to Russia Come get me and we're like, okay. Where is this? Where is the system? Turns out it was in the basement and it was attached to our HVAC system and When we got down there We start tearing it apart. We're like, okay, first of all, no one knew this was here Who's is it? You know, can you tell me what it does? It took us two days to figure out It was connected the HVAC system that was another one that kind of turned into an emergency for us because it was around the time of Stuxnet and There were questions being asked and thankfully again, it didn't blow up too big We didn't have to do the whole you know panic arms waving thing, but We did have to spend a lot of time doing a very long and deep investigation after that just to make sure everything else was okay because We also discovered that the HVAC system was controlled by a whole bunch of PLC's and workstations and servers That we hadn't seen yet and weren't on our radar Is this critical? I don't know is an HVAC system critical for a building? I think so I ran a simulation a little while ago with one of our hospital clients that I kind of love because we actually set it up So that we just turned off refrigeration for them Turn off refrigeration in the middle of a covid vaccine campaign You have a huge problem on your hands. So again going back to knowing what's critical and who owns it That's going to extend outside the IT team sometimes The next piece is how do we customer and I like saying it this way because it's also how do I even? Or how do I cope? Um This isn't a self-help seminar So I'm not going to get into the individual coping skills that you have to have as an incident responder Which I'm sure all of you have probably struggled with if you're an incident responder and probably if you do security at all You've had to struggle with this This part's about the organization You can see what's on the slide obviously, but let me talk about something that is in the picture on the slide This is a picture of Woodstock This is the nice picture of what was up the field from what was down the field at the end of Woodstock and all the way through Woodstock They had to hire helicopters get musicians in and out because they were so narrowly focused on the idea of let's do this show But they sort of forgot to install port-a-potties and people got sick and They couldn't get ambulances in Woodstock was actually worse than the fire festival in some senses just in terms of the emergency preparedness and kind of dealing with All of this stuff. So I you're probably asking yourself Caspian What's your point which is a really funny thing to ask yourself because your name is not Caspian But my point is really simple Be prepared for denials of service be prepared for things shutting down be prepared without of band communications Going back to again my first non-incidence story and actually the second one as well that out of band communication piece was huge If we had had it it would have been very simple if we thought all our networks were compromised Cool, let's switch to signal and talk or something else Right now though, you know We're kind of having a hard time here because we can't talk we can't speak we can't see we don't know what's going on so This brings me to the next piece. We also don't know who does what I kind of talked about this in the criticality piece Not knowing who owns what's gonna slow you down I mentioned that with the story about the windows XP box in the basement Not knowing who does what's gonna hurt you even more if I go in in an incident and turn off a critical system Or I just turn off a system or I trip over a power supply that knocks out the billing system for somebody We need to know who's gonna call the people at the end of the billing system We need to know who's gonna turn the power supply back on I need to know all this other stuff Incidents don't occur our current a vacuum so as much as an incident responder My focus is gonna be put out the fire, you know, stop the bleeding fix all the stuff There's all this other stuff going on where we're gonna need to actually Call these people in and get them to work. So, you know, the 4r as I mentioned before you're that your lawyers your HR your PR those folks I a lot of good Prepared organizations I work with and I'm saying good and prepared sort of separately because there are a lot of good organizations that are unprepared The ones that are prepared usually actually have a sense of who does what in this case, you know We do check who the pseudo reports go to That's actually kind of important knowing about that Putting that down somewhere in a way that it's accessible for your responders for me if I'm your responder It's gonna make a huge difference because if I don't know then who do I talk to so the next piece Speaking of talking if I can actually get it to advance There we go next piece is connections you'd think I would have put this at the top, but I'm kind of going in reverse order I don't know if anyone's kind of noticed that Connections are really important for a couple of reasons The first piece on this slide is actually the one that you probably should be thinking of before the incident Have you scanned externally? Do you know how everyone's getting in? Do you have a way of getting in to that data center or anywhere else remotely? And if you don't Are you prepared to drive for two hours to Laval or Toronto? That's gonna take longer than two hours if you're driving from here Access is a really big deal Loss of access, especially when everything goes out also a really big deal I don't have a good story about this because I can't talk about some of the stuff that I've seen except to Give a vague indication that that two-hour drive was something that one of my clients did experience a few times And they had to basically say Yeah, we need to figure out a way to get in Well, and I'm merging a whole bunch of people in this case So they build this bashing host and it's really nice But it's getting scanned constantly and they haven't put any kind of anything on it to prevent it from actually being used for remote desktop access One of my favorite threat threat actors really loves using remote desktop to just sling stuff all over the place. Guess what happened? It was a lot of fun to solve that one We had this really cool new tool that had just come out that we could actually map the remote desktop sessions out from So we could see exactly what they were doing I sort of chuckled when we saw this person just basically download Metasploit from Rapid7's site and start using that This piece I'm sure you've all had to deal with at some point. I have Extensively this is actually where and this is one of my favorite parts as well. This isn't criticality They go hand in hand. They're like They're like drinking too much in a hangover, you know, they're they're just gonna be there all the time So first of all Please please save me next time and test your backups I've been in so many situations myself and with other people where those backups weren't properly tested or the restore process Wasn't properly tested. That's an even bigger one I mean if you're restoring over a T1 line and you've got terabytes of data, that's not gonna work out Well if that AS 400 that you don't have a backup for that drives all of your production systems goes down You may want to have a backup system for it Backups are a big deal. Backups are a cost center Backups are also what allow you to get out of the ransomware incident quickly because that's usually what's gonna happen We're you know, we may find it a cryptor. We may find a key. That's cool But man if you can restore from backup quickly enough, you're gonna be fine. The rest of it's gonna be an investigation So this brings me to number 10 on my list I've been hinting at it all day Do you have a plan? I work with lots of people who don't they didn't write it down their plans a nice ISO document that has a phone number in it And that's it So there are good plans and bad plans the plan you wrote for the auditors is a bad plan The good plan is not the end of my slide deck It's all these little boxes here and let me let me let me walk you through this just in case you've got tired of being Rick rolled The never gonna is your actual master incident response plan That's the thing that has all the phone numbers that you have tearaways from you give them to people and say okay you go IT engineering guy help me out here The next piece playbooks Playbooks are kind of useful when you're doing this all the time and you're kind of panicking your way through something because you've actually got something Written down that you can go back and say okay. We've done this before Let's see how it works or we've planned this out and tested it did I mentioned testing testing is really important And then the last piece the awesome piece is the fact that those playbooks and the plan and everything else goes right back into a continuous improvement process that you can use To build better IT and build better incident responders So that's it I'm just gonna do this one more time. I've never Rick rolled a room full of people before Thank you all very much. I hope you hope you enjoyed that and obviously questions will be later So I'll be back for that


Everyone, Basel Chapman here for the 11 o'clock Tiger Financial News Network market update downtown 545 at a new low. This is really important, 34,583. If it keeps going like this, the 34,200 period exponential moving average is going to be kind of a target. Let's see what happens by the end of the day, this end of the month, we'll see what happens here. Definitely, the weekly chart is signaling that it's now gone to a cell signal upgrade potential by this Friday if it continues week like this to a cell mode. Let's go to the S&P. The S&P was doing very nicely and all of a sudden turned around and the S&P now is down 46, that was quick. To a lower low, it's a leg C to the downside. This is confirmed that it's in a cell mode in the daily chart, nothing yet in the weekly chart. The QQQ of the days, young member, is turned around very sharply from a very nice earlier on, 401.19 high, 408.71 was the all-time high on the 22nd. Is this going to become the dreaded H? The dreaded H meaning a lower case H to show you the chart real quickly before we go to the other indices. Looks like this. The Chapman wave methodology is straight down, makes an arch formation, fails at a peak A or a B. This could be an A. We haven't even got a peak A yet, but if it turns down and takes out 389 support over the next coming days, that's going to be very negative. We're looking at the IWM, the Russell 2000 being weak, oh, very weak right now under the 200-peer moving average. Has Gold taken the lead now? No. Gold has taken the lead to the downside, down 11 at 17.73 underneath the key support level. Has the dollar started to rally? No. Dollar is down 0.59. Hey, wait a minute, TLT, is that rally sharply? It was as up as $1.74. Money usually flows from equities when they fall back to the safety of bonds. It's done that, but it hasn't continued so far, 151.07 up 1.76. If there is a close in the TLT, the Lehman 20th Treasury bond fund, above 152.50 in the next day or two, that's just saying. Loads are coming down, and in fact, the market becomes a lot more vulnerable, and we're looking at the last thing I want to look at. It was crude oil. Look at that during my show, plunging down 2.86 at 67.09, weakness. I wonder if the Fed is going to deal with this in terms of weakness. So with that said, I'm going to hand you over to Larry Pizavento coming up to your wonderful show. There's always great programming here. We're looking at, oh, first of all, let me just say be careful for the close today. It's going to be really important. Then we're going to have Larry, thinkorswim, Steve Rose, Dave White, Tom Albright, have a wonderful day, and check out my opening for the years to come. See you tomorrow.