[Music]
well none of you are shooting at me so
that’s a good start
you see I used to have a dangerous job
in a very dangerous place where people
killed people every damn day with ak-47s
sniper rifles small roadside bombs huge
truck bombs even the occasional
artillery shell the size of a Volkswagen
for years that’s what one truck bomb did
near my house one morning and despite
many of my colleagues and friends not
making it out I’m very happy to be here
with you today as I want to share with
you what saved my life since it could
very well help you – that’s tradecraft
or more specifically defensive
tradecraft and a little rock saved my
life now tradecraft means different
things to different people for me it was
really just the tools and techniques
used in intelligence work stuff like
surveillance secret messaging hiding in
plain sight normal stuff yeah if you’re
in that line of work
the defensive tradecraft is simply using
that same stuff in reverse to try and
stay safe like avoiding cameras by
creating plausible vignettes like a
well-timed sneeze or secured it’s rude
now to me living in a warzone tradecraft
was taking a different route to work
every day even after I knew the shortest
rows that meant getting stuck in traffic
go miles out of the way on
now why would a sane person do that
as my friend was in that car
that exact car tradecraft meant
suspecting everyone everything
everywhere all the time in the shops on
the streets in a bar how could that
person hurt me what could they be after
who do they really work for what was
their motivation let me tell you this
does not make you an easy person to be
friends with and yet it saved my life
and it saved the lives of thousands of
operators around the world every day I’m
very thankful for the tradecraft
training that I received but when I
eventually moved back to the States
it took me years to unlearn that
tradecraft I would still vary my routes
to the grocery store I’d run background
checks on dates I did more unexpected
visitors I’d never sign up for discount
clubs or frequent flier miles that could
track me but there was no longer any
threat what I was doing seemed silly and
paranoid but it was just that ingrained
in me to finally over a long time I
started taking the shortest route to
work and he would started to collect
frequent flier miles I slowly became
normal now however the old kinetic
threats are well behind me but a new
wave of internet-based threats are upon
us all and I find myself sliding back
into a world of modified defensive
tradecraft
to protect me my ventures my community
the threats are everywhere and they’re
increasingly successful transnational
criminal gangs hunt people and companies
not to physically hurt them anymore
but to steal their money or their
secrets to disrupt their operations
sometimes even destroy entire companies
foreign intelligence services have now
aggressive programs in place that go
well beyond government to government and
they target individuals like you and me
and all the
companies that make up that civilized
world’s critical infrastructure so if
you work in the transportation sector
you’re a target if you’re work in
banking or energy or healthcare you’re a
target there are actually 18 critical
sectors worldwide in all of the
companies and all of their employees are
now targets these threats might start
with you spread across your company
across your entire industry and
ultimately disrupt our very way of life
in your world today your risk is my risk
now they don’t use bombs and guns as
much as emails and websites but now so
much of our lives are online the threats
are just as real now quite frankly
companies have had enough and they’re
willing to trade some of that openness
or increased security companies and
governments around the world are
adopting something called the zero trust
model where your systems only do the
expected things and nothing else now I
know this runs counter to the whole
concept of the open Internet where you
can connect to everything and do
anything but companies are making that
trade-off due to the high level of
attacks on their systems their data
their personnel their privacy so I ask
are you ready to make that same
trade-off as your threat level risen to
the point of making the tradecraft
trade-off
how much do you worry about your
identity being co-opted your private
thoughts being laid bare or your
reputation besmirched your money being
stolen vistas companies are moving to
zero trust the same concepts can hold
true for your personal life online if it
inputs not expected be it an email and
invite a pretty picture a text a video
just skip it don’t click it sure you’ll
miss something maybe something really
good but you will be safer and that
doesn’t mean you have to be an online
whore me
I still have email I still surf the web
I still use social media but I use it
with defensive tradecraft in mind if you
follow me on Twitter
you’ll see I tweet about where I’ve just
been rather than where I’m about to go
this reduces my risks and still lets me
share true tradecraft can really help
you too because it can stand if you can
stand the embarrassment because you’ll
have to suspect everyone and trust no
one and you’re gonna be wrong most of
the time and that’s alright
your friends are gonna think you’re
crazy but that’s alright because you’ll
be safer are you all right with that
tradecraft trade-off that’s certainly
not for everyone but it might be for you
are you are you I’ve had invites on
LinkedIn that turned out to be a team of
foreign intelligence operatives because
a tradecraft I declined but I did notice
that after a couple of weeks they had
over a dozen friends that I knew to hold
sensitive jobs now that’s just a simple
example and I’m sure you probably see
this stuff all the time
that email from your bank we’ve got that
that website that says you won that link
that says you’ve been randomly selected
the thumb drive you found and the free
Wi-Fi that’s being graciously offered if
you’re getting anything for free
anything be it a search or a service an
app or game you’ve got to ask yourself
what could baby after who do they really
work for what’s their motivation the
same things I was taught suspect
everyone and trust no one all the time
in your phone on the web in the cloud
suspect everyone and trust no one let me
close by three rules of practical
defense of tradecraft for your life
online rule number one is zero trust
your life just like the companies and
governments are doing now this isn’t
hard but it will absolutely subject you
to ridicule
ribbing your friends your family why
didn’t you retweet me why don’t you
watch that funny cat video I said why
didn’t you tell me you were in town I
get that all the time you have to ignore
the unexpected you get lots of messages
across lots of platforms but if it’s a
bot a crook or casual troll they tend to
move on after a few times you can then
start to extend some trust your friends
and family but never fully trust anyone
rule number two reduce your attack
surface don’t be a joiner these apps
that you download they get to track your
every movement down to which hand you’re
holding your phone in which rule the
side of the room you’re on what you’re
watching on TV what you’re watching on
the internet what you’re searching for
what your eye looks at on on the screen
what your cursor lingers over and a link
that you’d never ever clicked all that
gets trapped where you drive what you
buy now maybe you want to trade all that
privacy away and that’s fine but think
about the real costs versus what you’re
getting in return and rule number three
change your identities emails are cheap
these days and having multiple email
addresses really helps you have multiple
online personalities one for buying
stuff another for playing games a third
for social media one for family one for
business you get the picture and since
your passwords have already been long
gone and are already sold on the dark
web to the highest bidder or the lowest
bidder for critical systems such as
banking and healthcare and work consider
change your identification process
beyond and password to a passphrase you
know a few words that you remember
cobble together or moving to two-factor
authentication with your phone or
biometrics with your face your
thumbprint this extra hassle for you
makes it so much harder for them but
tradecraft is not for everyone and I’m
by no means implying it’s advocating it
for all but if you are tired of being
threatened with a kinetic or cyber you
don’t want to be a flashpoint for your
company your industry society as a whole
you might want to consider employing
some defensive tradecraft right that’s
not for everyone but in the end it might
be for you I just want you to have the
option to be a little bit safer
thank you [Applause]
well none of you are shooting at me so
that’s a good start
you see I used to have a dangerous job
in a very dangerous place where people
killed people every damn day with ak-47s
sniper rifles small roadside bombs huge
truck bombs even the occasional
artillery shell the size of a Volkswagen
for years that’s what one truck bomb did
near my house one morning and despite
many of my colleagues and friends not
making it out I’m very happy to be here
with you today as I want to share with
you what saved my life since it could
very well help you – that’s tradecraft
or more specifically defensive
tradecraft and a little rock saved my
life now tradecraft means different
things to different people for me it was
really just the tools and techniques
used in intelligence work stuff like
surveillance secret messaging hiding in
plain sight normal stuff yeah if you’re
in that line of work
the defensive tradecraft is simply using
that same stuff in reverse to try and
stay safe like avoiding cameras by
creating plausible vignettes like a
well-timed sneeze or secured it’s rude
now to me living in a warzone tradecraft
was taking a different route to work
every day even after I knew the shortest
rows that meant getting stuck in traffic
go miles out of the way on
now why would a sane person do that
as my friend was in that car
that exact car tradecraft meant
suspecting everyone everything
everywhere all the time in the shops on
the streets in a bar how could that
person hurt me what could they be after
who do they really work for what was
their motivation let me tell you this
does not make you an easy person to be
friends with and yet it saved my life
and it saved the lives of thousands of
operators around the world every day I’m
very thankful for the tradecraft
training that I received but when I
eventually moved back to the States
it took me years to unlearn that
tradecraft I would still vary my routes
to the grocery store I’d run background
checks on dates I did more unexpected
visitors I’d never sign up for discount
clubs or frequent flier miles that could
track me but there was no longer any
threat what I was doing seemed silly and
paranoid but it was just that ingrained
in me to finally over a long time I
started taking the shortest route to
work and he would started to collect
frequent flier miles I slowly became
normal now however the old kinetic
threats are well behind me but a new
wave of internet-based threats are upon
us all and I find myself sliding back
into a world of modified defensive
tradecraft
to protect me my ventures my community
the threats are everywhere and they’re
increasingly successful transnational
criminal gangs hunt people and companies
not to physically hurt them anymore
but to steal their money or their
secrets to disrupt their operations
sometimes even destroy entire companies
foreign intelligence services have now
aggressive programs in place that go
well beyond government to government and
they target individuals like you and me
and all the
companies that make up that civilized
world’s critical infrastructure so if
you work in the transportation sector
you’re a target if you’re work in
banking or energy or healthcare you’re a
target there are actually 18 critical
sectors worldwide in all of the
companies and all of their employees are
now targets these threats might start
with you spread across your company
across your entire industry and
ultimately disrupt our very way of life
in your world today your risk is my risk
now they don’t use bombs and guns as
much as emails and websites but now so
much of our lives are online the threats
are just as real now quite frankly
companies have had enough and they’re
willing to trade some of that openness
or increased security companies and
governments around the world are
adopting something called the zero trust
model where your systems only do the
expected things and nothing else now I
know this runs counter to the whole
concept of the open Internet where you
can connect to everything and do
anything but companies are making that
trade-off due to the high level of
attacks on their systems their data
their personnel their privacy so I ask
are you ready to make that same
trade-off as your threat level risen to
the point of making the tradecraft
trade-off
how much do you worry about your
identity being co-opted your private
thoughts being laid bare or your
reputation besmirched your money being
stolen vistas companies are moving to
zero trust the same concepts can hold
true for your personal life online if it
inputs not expected be it an email and
invite a pretty picture a text a video
just skip it don’t click it sure you’ll
miss something maybe something really
good but you will be safer and that
doesn’t mean you have to be an online
whore me
I still have email I still surf the web
I still use social media but I use it
with defensive tradecraft in mind if you
follow me on Twitter
you’ll see I tweet about where I’ve just
been rather than where I’m about to go
this reduces my risks and still lets me
share true tradecraft can really help
you too because it can stand if you can
stand the embarrassment because you’ll
have to suspect everyone and trust no
one and you’re gonna be wrong most of
the time and that’s alright
your friends are gonna think you’re
crazy but that’s alright because you’ll
be safer are you all right with that
tradecraft trade-off that’s certainly
not for everyone but it might be for you
are you are you I’ve had invites on
LinkedIn that turned out to be a team of
foreign intelligence operatives because
a tradecraft I declined but I did notice
that after a couple of weeks they had
over a dozen friends that I knew to hold
sensitive jobs now that’s just a simple
example and I’m sure you probably see
this stuff all the time
that email from your bank we’ve got that
that website that says you won that link
that says you’ve been randomly selected
the thumb drive you found and the free
Wi-Fi that’s being graciously offered if
you’re getting anything for free
anything be it a search or a service an
app or game you’ve got to ask yourself
what could baby after who do they really
work for what’s their motivation the
same things I was taught suspect
everyone and trust no one all the time
in your phone on the web in the cloud
suspect everyone and trust no one let me
close by three rules of practical
defense of tradecraft for your life
online rule number one is zero trust
your life just like the companies and
governments are doing now this isn’t
hard but it will absolutely subject you
to ridicule
ribbing your friends your family why
didn’t you retweet me why don’t you
watch that funny cat video I said why
didn’t you tell me you were in town I
get that all the time you have to ignore
the unexpected you get lots of messages
across lots of platforms but if it’s a
bot a crook or casual troll they tend to
move on after a few times you can then
start to extend some trust your friends
and family but never fully trust anyone
rule number two reduce your attack
surface don’t be a joiner these apps
that you download they get to track your
every movement down to which hand you’re
holding your phone in which rule the
side of the room you’re on what you’re
watching on TV what you’re watching on
the internet what you’re searching for
what your eye looks at on on the screen
what your cursor lingers over and a link
that you’d never ever clicked all that
gets trapped where you drive what you
buy now maybe you want to trade all that
privacy away and that’s fine but think
about the real costs versus what you’re
getting in return and rule number three
change your identities emails are cheap
these days and having multiple email
addresses really helps you have multiple
online personalities one for buying
stuff another for playing games a third
for social media one for family one for
business you get the picture and since
your passwords have already been long
gone and are already sold on the dark
web to the highest bidder or the lowest
bidder for critical systems such as
banking and healthcare and work consider
change your identification process
beyond and password to a passphrase you
know a few words that you remember
cobble together or moving to two-factor
authentication with your phone or
biometrics with your face your
thumbprint this extra hassle for you
makes it so much harder for them but
tradecraft is not for everyone and I’m
by no means implying it’s advocating it
for all but if you are tired of being
threatened with a kinetic or cyber you
don’t want to be a flashpoint for your
company your industry society as a whole
you might want to consider employing
some defensive tradecraft right that’s
not for everyone but in the end it might
be for you I just want you to have the
option to be a little bit safer
thank you [Applause]
Please follow and like us: