Enigma 2018 Conference Program

How can we design systems that encourage better cybersecurity behaviors? Despite important improvements to the usability of cybersecurity systems, much security advice goes ignored and many security systems remain underutilized. I argue that this disconnect can partially be explained by the fact that there’s a largely unconsidered cost to engaging in good security behaviors: costs of social face. For example, by using two-factor authentication, one might be perceived as “paranoid.” By encrypting one’s phone, one might be perceived as having something to hide. More generally, by caring too strongly about cybersecurity, one may give off the impression of being shady. In this talk, I present evidence in support of the following claim: Social influences strongly affect cybersecurity behaviors, and it is possible to encourage better cybersecurity behaviors by designing security systems that are more social.

First, I empirically modeled how social influences affect the adoption of security behaviors and systems of 1.5 million Facebook users. Second, I designed a notification that informs Facebook users that their friends use optional security systems to protect their own accounts and evaluated these “social” notifications in a randomized, controlled experiment with 50,000 Facebook users. In so doing, I provide some of the first direct evidence that security behaviors are strongly driven by social influence, and that the design of a security system strongly influences its potential for social spread. Specifically, security systems that are more observable, inclusive, and stewarded are positively affected by social influence, while those that are not are often negatively affected by social influence.

Taken together, my work argues for a future of socially intelligent security systems that understand and accommodate basic human behaviors, desires and capabilities.

For decades security awareness programs focused on one dimension: improving people’s security ability. The assumption has been that employees don’t know the correct course of action and that with the right amount of training, they’ll start performing more securely. There is a second dimension that needs to be considered in security behavior change: motivation. This talk will explore how and when to motivate employees to security action. It will also discuss how to "surf" motivation generated by both predictable and unpredictable security events to drive security behavior change in a workforce.

Much of the research in differential privacy to date falls short of private industry requirements in its ability to scale and data-proven success. However, most researchers do not have access to real-world data to prove new techniques. In this talk, Uber's privacy engineering team and Berkeley researchers discuss the story behind their pragmatic collaboration and how it led to multiple open source releases from their differential privacy stack.

This is a joint work with Elizabeth Anne Watkins.

Computer security often takes place in an institutional context: large organizations in fields like finance, healthcare, law, and journalism set best practices and provide critical training for non-experts. Many tools used to protect users assume that security is administered by benevolent overlords who can set appropriate permissions, answer questions, and in general  save workers from themselves. However, as the future of work shifts towards contingent labor models and precarious employment, institutions may no longer play such a primary role. What then?

In a gig-based economy, independent workers are cut off from organizational sources of security training. Security costs are externalized to the individual worker, who is no longer conceptualized as part of the organization. This in itself may have an outsized impact on marginalized communities due to their overrepresentation in gig work, denoting a coming class-based disparity of security awareness.

But even more impactful, gig workers have been relegated to outsider status, often categorized as another source of risk. What were once trust-based relationships may become new sources of vulnerability to be managed. The logical outcome of identifying users as a threat is a widening of mistrust of groups of people who were once trusted insiders, and with that, we risk fundamental changes to cultural conceptions of security.

Are your opinions really your own—or how much have they been carefully shaped until you think they are? Today’s digital connectivity makes it possible to share information like never before—traditional borders and constraints of distance simply do not exist anymore. But this same connectivity also makes it easier to manipulate the public’s perception of reality. The term “fake news” has become increasingly common in the past year—but it is only one facet of a much larger problem: the use of technology to alter public opinion, and ultimately affect the real world.

This is not a new phenomenon. At every point in human history where a new disruptive communications technology has replaced another, propaganda and manipulation flourish. Each communication method has its associated societal norms and customs, but these take time to form. What is allowed on television, radio, and print is well established—but the Internet has not reached that level of maturity yet.

I will demonstrate the techniques and methods that have been actively used to this end—and not exclusively in the field of politics. I will review the global availability and costs of such underground services, from Russia to China, Ukraine and the Middle East and demonstrate the affiliation of these activities with other Black Market commodities and services. I will discuss several techniques of identifying such campaigns by processing social media data and show how it is possible to trace those campaigns to the original perpetrators. Finally, I will walk through a number of case studies, demonstrating the links between artificially fabricated events and the executors carrying out those orders.

A lot is expected of software developers these days; they are expected to be experts in everything despite very little training. Throw in the IT security team (often with little-to-no knowledge of how to build software) telling developers what to do and how to do it, and the situation is further strained. This silo-filled, tension-laced situation, coupled with short deadlines and mounting pressure from management, often leads to stress, anxiety and less-than-ideal reactions from developers and security people alike. This talk will explain how people's personal insecurities can be brought out by leadership decisions in the way we manage our application security programs, and how this can lead to real-life vulnerabilities in software and other IT products. This is not a soft talk about "feelings", this is a talk about creating programs, governance and policies that ensure security throughout the entire SDLC. No more laying blame and pointing fingers, it's time to put our egos aside and focus on building high-quality software that is secure. The cause and effect of insecurities and other behavioural influencers, as well as several detailed and specific solutions will be presented that can be implemented at your own place of work, immediately. No more ambiguity or uncertainty from now on, only crystal clear expectations.

Many companies treat their buildings as trusted locations, granting devices on their office networks access to sensitive resources. This often renders logical security controls only as effective as the company's ability to prevent tailgating into the building. Zero Trust networks address this issue, with the most well-known being Google’s BeyondCorp. We'll review the Location Independent Security Approach (LISA), a Zero Trust architecture pioneered at Netflix. It removes trust of the office network, replaces it with trust of authenticated users and healthy devices, and is simple enough that many companies can implement it. High level implementation steps will be provided so attendees can evaluate and plan similar programs in their own organizations.

How do people with an army-sized cyber force think about cyber operations? One thing is for sure, it is not how we grew up thinking about traditional information security. Information security, while important, fails to capture the scale, audacity, capabilities, and resources of government-backed cyber operations.

Over the past 10 years we have seen the rise of massive nation-state cyber forces and we’ve felt the impact, from catastrophic data spills to destructive cyber attacks to influence on the U.S. presidential election. Like it or not, cyber conflict is raging now and is likely to get worse before it gets better.

From Clausewitz and Jomini to the present, militaries have learned how to fight at scale on the physical battlefield. For example, the United States fielded and coordinated actions of almost 100 divisions of 10,000-15,000 people each to fight around the globe in World War II. Militaries are now organizing, training, and equipping forces and learning to fight at scale in cyberspace. What we’ve experienced so far is only a first taste.

In this talk we will look at time-tested military techniques and study how they may be used to support offensive and defensive cyber operations. We’ll focus on key examples: effects based operations, targeting, deception, center of gravity analysis, command and control, and cyber-enabled information operations, and we’ll provide pointers to many more.

These insights will help prepare network defenders and security researchers for what is coming, help you to better understand the mindset of those attacking you, and convince you we aren’t thinking big enough.

As connected devices and systems grow ever more complex, security experts recognise the need to protect the most critical functions. Standards and products have been developed to provide ‘roots of trust’; isolated components to manage identities and other keys, verify updates and measure/report the status of a device. We also see a growing list of processor features allowing arbitrary code to run in a protected environment, both on our devices and also in the cloud. Despite all this innovation, very few applications actually support these features. Market support for hardware security is low. This talk will explore why that is, and what we might do about it.

With billions of usernames and passwords readily accessible via the black market, account takeover poses a significant threat to services that rely solely on passwords for authentication. In this talk, we provide a deep dive into the ecosystem supporting account takeovers, the danger it poses to users, and the importance of automatic, defense-in-depth risk detection systems as a fundamental defense in identity solutions. We start by exploring the relative likelihood that users fall victim to data breaches, phishing, or malware using a dataset of over 3.3 billion stolen credentials; and how hijackers subsequently use these credentials for spam, financial theft, and stepping-stone attacks. We then turn to examine how identity providers can use risk analysis, in conjunction with ‘login challenges’, to bridge the security gap between two-factor authentication and password-only users with minimal additional friction. We show the practical weaknesses of certain login challenges (SMS and email) and evidence of attackers now collecting risk profile data and challenge responses to weaken user security. Finally, we discuss ongoing challenges such as how public opinion (as measured by our user studies) may be at odds with actions identity providers should take to improve overall account security, and how the industry should try and change this.

We need to move to a fully autonomous world for software security. Current software security attack and defense is done by humans, at human time lines. Cyber-autonomy research and development is creating tech that makes fully autonomous cyber possible. Cyber-autonomy promises to scale better and make defense possible within machine-scale time.

In this talk, I will describe the Cyber Grand Challenge and the system Mayhem. Mayhem is a fully autonomous cyber system that can find new vulnerabilities, generate exploits, and self-heal off-the-shelf software. Mayhem is the result of 10 years of academic research and 3 years of commercial development. Mayhem competed and won a $2 million dollar prize in the US Cyber Grand Challenge competition co-hosted at DEFCON 2016. I will describe how Mayhem works, the Cyber Grand Challenge competition, and how Mayhem fared against the world's best hacking teams. I will also describe how I think Mayhem, and other autonomous systems like it, will change the security landscape in the next decade.

The current state of the industry and “what happens next” is keeping security practitioners up at night. The interaction between companies and security researchers is a fragile equation: can they like each other or should they hate each other? Or both?

Questions around this love/hate relationship, and its future abound, include: If we like each other, what are our groups’ strengths and weaknesses? How can this newly formulated partnership be celebrated? Controlled? Secured? When the honeymoon period is over, what happens if things go wrong? Can potential issues be predicted before we agree to partner together? How is trust established: Have we asked the right questions? How do we build long term rapport and respect? What regulations or legislation, if any, do we need to learn and follow?

One misstep in a bug bounty program could shut down this harmonious “marriage,” but at the same time, more and more companies are taking on this perceived risk given that they’re seeing this new way of doing things is necessary and inevitable. Arming companies with more ammunition is necessary to defeat their attackers.

If we make it through this fragile security landscape, what will that future look like?

Our current approach to security assessment is inherently flawed. In this talk, Casey will examine how we got here, and how the "unlikely romance" between whitehats and enterprise organizations is changing everything.

If you want to be accepted into the ML hipster clique, just say the magic words: "deep learning is over-hyped," and watch those around you nod their heads sagely. But as a deep learning researcher I see little sign of that in practice. Approaches that are well understood in academia are not being well used in the infosec community, despite clear advantages. Perhaps it is actually the case that "deep learning is over-hyped" is over-hyped.