►
From YouTube: Securing development systems in the era of hybrid work
Description
The era of hybrid work has accelerated the move toward the cloud to run day-to-day operations in global businesses. Because of that, CISOs are more focused than ever on hybrid and cloud development systems as critical points to defend their organizations and their software products. In many cases, security teams are rapidly modernizing the security models for these systems, applying concepts like zero trust to software development and build systems, and more. In this session, GitHub CSO and SVP of Engineering, Mike Hanley will be joined by a panel of CISO's for a security conversation focused on areas like:
How security has changed as organizations move from remote to hybrid work models, and methods used to secure development systems as the software supply chain evolves in a hybrid world.
How to think about zero trust in the context of securing hybrid development systems and critical strategies to secure your organization.
How to build a cross-organizational incident response team and program that leads to productive communication channels to swiftly handle incidents.
As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
A
A
And
I'm
the
global
senior
director
of
sales
for
GitHub
Advanced
security
I'm
excited
to
moderate,
incredible
lineup
of
csos
here
today,
as
they
share
their
perspectives
and
experiences
around
securing
development
systems
in
the
era
of
hybrid
work.
So
without
further
Ado
I'd
like
to
invite
to
the
panel
Jeff
belnap
Ross,
young
and
Mike
Hanley,.
A
C
A
D
A
Thank
you
for
that.
Now
you
might
have
all
noticed
that
we're
one
shot
on
stage
today.
Unfortunately,
our
panelist
Amanda
Cody
was
unable
to
attend,
but
we're
looking
forward
to
a
future
opportunity
to
share
her
perspectives.
Okay,
excellent!
So
let's
get
started
so
the
first
thing
that
I
want
to
talk
about
is
our
panelists
here
come
from
a
range
of
Industries.
However,
since
most
companies
today
are
software
companies
either
developing
their
own
software
or
leveraging
third-party
software
to
do
business.
Let's
start
our
conversation
with
software
security.
A
B
From
a
perspective
that
you
haven't
thought
about
before,
which
is
really
you
know
what
you
need
in
a
security
mindset
and
then
I
think
I
always
think
about
investing
in
in
either
building
or
buying
technology.
That's
really
going
accelerate
those
people
towards
the
mission
that
we
want
to
accomplish
excellent.
C
You
know
I
I,
think
about
the
new
College
hire
when
they
come
to
the
company.
How
do
we
teach
them
enough
so
that
they
can
do
all
the
security
practices
that
we
want
them
to
to
be
successful?
So
a
lot
of
it
is
on
the
education
piece
and
making
it
very
easy
and
clear
for
them
to
know
what
to
do
and
how
to
follow
the
practices
of
building
good
product
security.
D
A
So
baking
and
security
into
the
development
process,
essentially
so
another
topic
that
we
hear
a
lot
about
today
is
like
software
building
materials
curious
to
understand
from
the
three
of
you
like.
How
does
that
kind
of
play
into
the
software
that
your
organizations
are
developing
and
also
the
software
that
you're
bringing
into
your
organization,
maybe
Ross.
C
You
know
it's
really
important,
that
everybody
knows
the
software
bill
of
materials
and
I.
Think
of
it,
mostly
as
a
supply
chain
threat.
You
know,
if
you
don't
know
what
you
have
in
your
organization
and
all
of
a
sudden,
this
piece
of
malware
like
log4j
or
some
something
else
is
in
your
environment,
and
you
have
to
search
that
quickly.
That
can
be
the
difference
between
hours
versus
minutes
of
being
able
to
do
the
remediation.
So
that's
a
huge
piece
plus.
B
There
I
I'm
I'm,
a
big
fan,
I
think
you
know
we're
where
we're
starting
with
this
and
looking
at
critical
systems
is
a
great
way
to
sort
of
get
the
dust
out
and
figure
out
how
to
do
this
effectively
and
at
scale
and
I.
Think
anything
where
we're
putting
more
information
in
the
hands
of
the
buyer
or
the
person.
D
What
versions
it
is
is
pretty
important
to
making
sure
that
you've
got
a
good
security
posture,
so
certainly
I
think
s-bomb
is
part
of
that
and
I
would
extend
to
say
you
know,
I
think
the
industry's
still
figuring
out
what
it
wants
from
s-bomb
like
it
is
a
thing
and
you
can
you
can
emit
it
at
various
stages
if
it's
either
the
contents
of
a
repo
or
it's
what
comes
out
the
other
end
of
your
CI
CD
process.
Understanding
these
are
two
different
things
in
many
cases.
Actually
the
s-bombs
would
not
necessarily
look.
D
The
same
is
is
part
of
this,
but
it's
ultimately
for
me.
It's
like
what
security
questions.
Are
you
trying
to
answer
and
I
think
if
it's
we
want
to
know
how
our
software
is
composed
so
that
we
can
do
things
like
manage
vulnerabilities,
then
s-bomb
is
a
tool
that
helps
you
do
that.
So
to
that
extent,
I
think
it's
good
and
virtuous
that
people
are
adopting
things
like
that
for
sure
excellent.
A
Well,
thank
you
for
that.
So
the
next
thing
that
we
can
talk
about
is
cloud
applications
and
infrastructure
have
been.
You
know
at
the
center
for
the
last
few
years,
including
how
to
secure
them.
So
the
question
that
I
have
for
you
Ross,
is
what
has
been
the
biggest
challenge
in
securing
your
apps
in
distributed
environments
and
with
the
workforce.
That's
you
know,
possessing
varying
different
skills
of
cyber
security
awareness.
C
D
Mean
a
lot
of
how
we
do
this
at
GitHub.
Obviously,
we've
got
a
very
large
Cloud
footprint,
as
well
as
some
physical
on
data
on-prem
data
center
footprint
as
well,
but
independent
of
where
things
are
hosted.
I
mean
the
general
strategy
is
like
I,
want
to
know
about
everything
and
I
want
to
be
able
to
measure
and
understand,
State
and
configuration
against
known,
good
baselines
and
I.
Think
the
the
general
rule
of
thumb
is.
D
You
can
run
whatever
you
want
so
long
as
it
meets
all
the
rules
and
expectations
that
we've
set
and
agreed
on
for,
like
what
good
looks
like
from
a
security
perspective
and
being
able
to
measure
that
so
that
you
can
detect
drift
and
like
govern
your
way
back
into.
That
is
a
big
part
of
our
strategy,
so
we
have
something
internally.
D
We
call
the
fundamentals
program
and
these
are
effectively
the
rules
of
the
road
right
like
I
gotta
have
license
plates
Gotta
Have
current
Insurance
gotta
have
a
seat
belt
in
your
car,
like
those
types
of
things
that
we
express,
so
this
frees
developers
up
to
provision
what
they
need
to
go
run
and
what
they
need
to
go
iterate
and
deploy
and
make
sure
that
when
they're
doing
at
we're,
not
holding
them
up,
but
what
they
do
in
run
meets
our
expectations.
That's.
A
Interesting
and
I
can
maybe
relate
a
little
bit
working
at
GitHub
I.
Think
one
of
the
really
interesting
things
that
you've
done
is
whenever
you
get
in
front
of
the
company.
You
always
say
you
know,
raise
your
hand
up
if
you're
part
of
the
security
organization-
and
it's
like
everyone
at
GitHub
is
part
of
that
right
and
I.
Think
raising
your
mental
awareness
about
that
as
well.
I
think
also
puts
you
in
a
frame
of
mind
of
like
wanting
to
understand
more
and
and
be
ready
for
it.
B
I
well
I
feel
like
these
guys
really
knocked
out
of
the
park.
You
know
I've
started
to
think
about
this
more
and
more,
almost
through
a
mindset
of
detection
response
like
how
you
usually
think
about
instant
response,
but
you
know
obviously,
when
you're
dealing
with
products
and
services
and
building
them
it's
a
little
bit
different
but
I.
Think
anytime,
you
can
be
clear
about
what
the
requirements
are
and
then
you
can
move
detecting
whether
you've
met
those
requirements
into
some
sort
of
platform.
B
That's
part
of
your
your
pre-commit,
your
post,
Commander
cicd,
and
then
you
are
implementing
detection
and
Remediation
of
that
in
that
process.
Instead
of
sitting
down
with
everybody
here
and
going
like
all
right,
here's
how
you
write
good
code
I
think
that's
a
much
more
beneficial
path
and
I
think
that's
that's
really!
Where
we're
all
headed
excellent.
B
A
Okay,
so
the
next
area
is
securing
the
software
supply
chain
is
top
of
mind
for
all
of
us
today
and
lately
we've
seen
increased
discussion
in
the
community
and
the
Press
around
phishing
social
engineering
and
how
to
better
secure
Dublin
environments
so
Mike,
maybe
you
can
lead
us
off
here
so
phishing
in
Social
Engineering
are
the
best
ways
for
an
adversary
to
get
into
organizations
and
wreak
havoc.
How
do
you
create
awareness
about
fishing,
social
engineering
and
the
potential
impact
within
your
organization?
Yeah.
D
Think.
For
me,
it's
really
just
focusing
on
the
importance
of
the
basics.
With
people
I
mean
the
stories
about
threats
and
threat.
Actors
are
certainly
interesting
insofar
as
I
think
they
can
help
inform
just
how
important
the
basics
are
to
be
excellent
at
and
to
really
be
comprehensive
about
right,
like
you,
can't
have
80
of
your
employees
use
2fa,
you
need
100,
you
need
strong
2fa
for
everybody.
You're
always
going
to
be
in
a
situation
where
the
weakest
link
in
some
of
those
situations
is
what
you
look
for,
and
this
actually
isn't.
D
Your
employees
or
user's
fault
like
this,
is
on
you,
as
a
security
team,
to
figure
out
how
do
I
make
it
so
that
we've
got
the
high
bar
and
the
Excellence
on
the
basics,
but
it's
easy
for
people
to
adopt
those
things
and
then
get
their
job
done
within
the
context
of
those
controls.
So
a
lot
of
that
is
just
socializing.
What
we
do
and
why
and
why
those
Basics
matter
so
much.
Oh.
A
B
Think
the
I
guess
the
short
answer
is
yes.
The
hardest
thing,
though,
is
zero.
Trust
has
lost,
I,
think,
like
all
meaning
in
reality,
so
it
was
coined
a
million
years
ago
by
a
barbarian,
I
think
Forester
analyst,
and
it's
turned
into
the
easy
way
that
you
get
everybody
to
read
your
emails
but
I.
Think
where,
where
I'm
thinking
about
it
is,
you
know
just
from
a
principal
perspective
when
you're
building
a
new
system
or
you're
overhauling
some
access
management
regime.
B
C
Know
I
try
to
look
at
different
novel
ways
to
solve
the
problem.
So
when
you
think
about
phishing,
you
know
how
do
you
gamify
that
experience
and
one
way
we
did
it
in
in
my
company?
Is
we
give
out
a
fishing
trophy
every
quarter
and
it
looks
like
a
giant
tuna
fish
and
it
says
fishing
champion
of
the
quarter
to
whichever
c-suite
executive
had
the
lowest
click
rate
out
of
all
the
comparative
c-suites.
C
So
it's
not
the
most
clicks,
no,
the
lowest
click
rate
and
if
there's
a
tie
where
we
have
zero
percent
from
multiple
divisions,
then
whoever
had
the
highest
reporting
rate
of
spotting
the
fish
and
telling
it
to
the
Cyber
organization.
That's
the
winner,
and
you
know
doing
little
things
like
this:
every
quarter,
we've
significantly
dropped
our
scores
and
it's
also
building
in
the
the
multiple
ways
of
process
to
improve
your
organization.
So
if
somebody
says
Hey
I
want
to
change
my
account
billing
number
and
and
their
routing
profile
and
all
their
banking
account
information.
C
Well,
we
want
to
check
not
an
email
where
that
came
from,
but
we're
going
to
call
that
person
on
the
phone
and
said:
did
you
actually
send
this
email?
You
know
and
and
out
of
band
things
like
that
are
what
we
have
to
embed
in
our
processes,
because
you
can't
always
trust
one
single
form
of
of
Technology.
A
Well,
thank
you
so
just
maybe
summarize
the
three
of
you.
So
we
have
awareness
we
have
gamification
and
you
have
like
be
aware
of
the
user
right.
You
have
to
find
a
compromise
between
those
three
to
really
give
give
the
ideal
The
Experience,
because
at
the
end
of
the
day
we
have
to
get
our
work
done,
isn't.
A
Absolutely
so
moving
on
then
so
as
much
as
we
try
to
be
proactive
incidents
can
happen
to
anyone
right.
So
it's
not
really
a
case
of
if
but
more
a
case
of
when,
and
so
you
know
announcing
that
there
has
been
a
data
breach
and
and
taking
the
steps
to
publicize
or
publicly
disclose
and
document
what
happened
is
not
easy,
both
from
a
technological
perspective
and
on
a
human
level
as
well,
and
there
are
a
lot
of
steps
internally
that
need
to
be
taken,
and
so
maybe
Jeff.
B
I
think
well,
oh
how's,
the
how's,
the
team
set
up,
so
we've
got
a
centralized
instant
response
function,
that's
globally
distributed,
so
we
have
lots
of
resources
available
when
they're
needed,
but
I
think
one
of
the
most
important
things
is.
We
try
to
think
about
incident
response
and
Security
in
general.
More
like
we're
paramedics,
not
police,
right,
we're
here
to
engage
triage.
The
situation
make
sure
that
we
can
kind
of
understand.
B
What's
going
on
and
figure
out,
what
do
we
need
to
sort
of
get
this
situation
from
where,
where
it
is
today
to
mobile
and
moving
and
moving
the
business
forward
again
and
the
way
that
we
do,
that
is
I,
think
just
just
like
Mike
and
just
like
I
saw
a
couple
of
you.
Raise
your
hand
that
you're
part
of
the
security
team
is
we
we
open
the
tent.
We
bring
more
and
more
people
in.
B
So
if
there
was
an
incident
that
was
happening,
what
we
would
see
is
the
legal
team,
the
comms
team,
our
our
internal
Partners,
whether
they
be
in
engineering
or
other
or
sales
or
some
other
part
of
the
business
they're.
All
a
part
of
that
discussion
now,
obviously
my
my
best
friends
in
comms
and
legal.
B
If
you're
watching,
we
know
you're
valuable
and
important,
but
you're
not
they're,
not
necessarily
going
to
be
in
the
engineering
discussion,
but
they're
going
to
be
somewhere
where
they're
getting
a
regular
sort
of
like
you
know
up
to
the
minute
update
of
what's
going
on
so
that
they
can
do
their
job
and
I.
Think.
The
most
important
thing
that
we
keep
in
mind
is
a
security
incident
is
not
a
technical
problem.
It
is
a
business
problem
and
what
we
need
to
do
is
move
the
business
forward
and
the
way
we
do
that
is
we
understand.
B
What's
going
on,
we
understand
how
to
break
that
into
the
pieces
that
each
part
of
the
business
needs
so
that
they
can
communicate
to
their
customers.
They
can
communicate
to
their
vendors.
They
can
just
communicate
to
the
rest
of
our
business
about
what's
happening
so
that
there's
no
mystery
and
then,
at
the
end
of
the
day,
we
can
hopefully
communicate
clearly
and
succinctly
to
our
members
and
customers
about
what's
going
on
and
I
think
that
thing
and
I
think
some
of
the
folks
here,
like
Mike,
you
you've
done
a
great
job
with
this.
B
C
You
know,
for
me,
cyber
security
is
the
business
of
Revenue
protection.
We
need
to
look
at
the
organization
and
how
do
we
best
protect
it?
So
if
a
third
party
has
ransomware,
how
do
we
stop
the
connections
where
they
can
infect
us
right?
How
do
we
quarantine
their
emails?
So
people
aren't
opening
malicious
attachments?
C
How
do
we
know
our
internet
connections
that
maybe
we
have
to
pause,
so
they
can't
spread
files
into
our
organization
that
that's
kind
of
you
know,
stop
the
bleeding
initial
triage
and
then
afterwards
it
to
to
Mike's
excellent
point
here
or
just
excellent
point.
I'm
sorry
I
wish
I
was
that
tall?
It's
all
about
the
partnership
right.
C
Normally,
it's
legal
who
actually
gets
to
declare
an
incident
because
they
know
the
laws
they
know
what
pii
is
identified,
as
this
particular
instance
in
this
particular
state,
where
there's
very,
very
specific
laws
that
are
very
different
from
every
other
state,
and
you
want
to
follow
their
guidance
and
you
want
to
work
through
your
comms
team
to
make
all
that
very
consistent.
So
there's
definitely
a
huge
focus
and
the
focus
is
always
about
protecting
the
company
and
protecting
the
revenue
that
the
company
is
producing.
D
Even
when
you've
made
a
mistake
is
is
actually
I
think,
like
just
super
important
customer
trust,
and
you
can
see
examples
of
where
like
where
this
has
not
happened,
and
it's
been
clear
that
people
either
haven't
been
upfront
or
didn't
understand
what
they
were
disclosing
I
mean.
This
is
like
disastrous
for
for
trust,
and
it's
so
hard
to
rebuild
that
it's
you
know
you.
You
gain
trust
in
in
sort
of
little
drips
over
time,
but
you
can
lose
it
in
in
buckets.
If
you're,
not
careful,.
B
D
You
gotta,
you
gotta,
be
comfortable
dealing
with
bad
news.
Yeah
I
mean
I.
Think
the
big
thing
that
I
always
tell
teams
is,
like
you
know
it's.
Never
bad
news
is
never
personal
for
one
like
people
are
gonna,
make
mistakes
like
somebody's
going
to
unintentionally
ignore
or
bypass
the
security
control
or
they're
gonna
click
that
phishing
link,
or
you
know
whatever
they're
going
to
have
people
that
are
going
to
make
mistakes
and
I
think
like
as
a
security
leader.
D
First
thing
I
always
have
to
do,
is
look
and
say
like
what
could
we
have
done
differently
as
a
security
team
to
improve
that
outcome?
For
that
person
like
it's,
not
not
something,
I
look
and
say
you
know
they
screwed
up
I,
always
look
at
like
what
could
we
have
done
differently?
So
I
think
that's,
that's
the
first
one
and
then
in
terms
of
the
teams
that
are
working
on
security.
D
D
But
if
you
can
keep
people
focused
on
that
stuff
and
they
can
see
the
fruits
of
their
work,
I
think
it's
much
more
fulfilling
for
one,
but
you
can
also
give
people
the
space
and
permission
to
say
no
to
the
activity.
That
I
would
say:
that's
not
necessarily
going
to
lead
to
good
business
results,
and
you
know
you're
never
done
with
security.
It's
not
a
state
that
you
realize
and
you're
like
cool.
D
B
B
You
take
that
personally
and
you
feel
like
Oh
I'm,
a
failure
and
one
of
the
one
of
the
things
I
try
to
lean
into
the
most
is:
how
do
we
provide
psychological
safety
from
that
eventuality
right?
How
do
we
make
sure
that
these
people,
that
are
you
know,
maybe
they're
type
A
personality-
is
super
competitive?
They
want
to
be
good
at
this.
B
I
think
it
creates
a
space
where
people
can
think
and
breathe
and
work
on
a
problem,
and
it
builds
more
resilient
people
and
and
I
think
it
sort
of
pays
the
culture
forward
and
and
I
think
in
a
lot
of
ways.
That's
we
need
more
of
that.
We
need
people
to
feel
like
it's.
Okay,
if
there's
an
incident,
it's
it's,
not
okay!
If
we
ignore
it,
if
we
don't
respond
to
it,
if
we
don't
know
how
to
communicate
about
it,.
C
Yeah,
so
we
have
this
concept
of
when
the
right
way
and
and
it's
really
about
transparency
and
and
really
finding
some
of
the
root
causes.
So
if
a
developer
makes
a
bad
code
change,
you
know.
People
may
initially
think
well
he's
this
dumb
developer.
But
you
know
that's
not
really
the
case.
You
need
to
go
back
and
say
well.
Where
was
the
pure
code
review
that
someone
would
have
caught
it?
Where
was
the
test
case
that
you
should
have?
A
So
you
kind
of
spoke
about
you
know,
developers
and
awareness
and
I'm
kind
of
curious
to
think
about
when
you
think
about
security
by
design,
for
example,
how
does
that
kind
of
fit
into
your
strategy?
And
how
do
you
work
with
developers
that
you're
about
to
do
something?
This
is
going
to
introduce
some
risk.
You
know
how
do
you
you
think
about
that
and
what
could
others?
You
know
listening
here?
Think
about
maybe
Mike.
If
you
have
some
thoughts.
D
That
were
wrong
before
you
actually
GA
something,
and
even
how
we've
rolled
out
experiences
inside
GitHub
for
our
employees,
like
you
know,
Nero
you'll,
probably
remember
when
we
went
all
in
on
Fido
authentication.
You
know
we
exposed,
for
example,
just
requiring
Fido
in
front
on
some
apps
to
make
sure
that
we
got
feedback
from
teams
that
interacted
with
them
most
often
then
the
next
set
of
apps,
then
the
next
set
of
apps,
then
the
next
set
of
apps
and
at
each
stage
of
that
we
got
feedback
on
like
hey.
D
D
The
bolt
like
that,
you
you've
made
it
secure,
congratulations
and
nobody
can
get
anything
done
so
I
think
those
like
product
management
principles
and
involving
designers
and
other
disciplines,
rather
than
just
security,
can
really
help
you
get
to
better
overall
experiences
of
interacting
with
security.
That's.
A
D
D
That
should
be
the
goal
right,
because
actually,
where
you
lose,
people
is,
if
they
don't
want
to
interact
with
your
controls
or
they
don't
want
to
interact
with
your
team
or
they
don't
feel
like
they
can
come
to
you
when
they
really
need
help
like
if
you're
in
that
situation.
You've
got
a
lot
of
work
to
do.
That's.
B
Awesome
Jeff
any
thoughts.
Well,
I
think
you
hit
the
nail
on
the
head.
This
is
where
I
talk
about
like
that
user
experience
has
got
to
really
be
better
than
the
security
experience
right.
If
you're,
not
thinking
about
how
people
are
going
to
interact
with
this
thing
that
you
built
what
you're
doing
is
encouraging
you're,
encouraging
them
to
bypass
whatever
you've
designed.
B
B
How
do
marketing
people
work,
because
if
you
bring
yourself
outside
the
show
of
engineering
and
thinking
about
how
Engineers
interact
with
computers,
you
start
to
really
get
into
how
these
controls
that
you
build
can
be
interpreted
by
different
people
and
how
the
real
job
of
the
security
team
is
not
to
build
a
perfect
system
that
can
never
be
breached.
It's
to
build
a
company
that
can
be
successful
while
being
trustworthy
and
resilient
and
I
think
that
success
has
to
come
from
that
place
where
it
comes
from
a
place
of
trust
and
the
place
of
resilience.
B
C
You
know
I
think
the
biggest
thing
is:
we've
forgotten
how
important
Simplicity
is
in
security,
and
so,
if
you
think
about
the
future,
you
know
think
about
where
you
spend
all
your
maintenance
time
on
building
an
application.
Are
you
patching
a
server?
Are
you
patching
middleware?
Are
you
doing
all
this
stuff
just
to
make
your
app
run,
and
might
you
be
able
to
minimize
some
of
these
with
serverless
approaches
that
minimize
the
amount
of
overhead
and
bandwidth
and
guess
what
all
those
security
patching
misconfigurations
on
the
OS
and
middleware
go
away?
C
A
Excellent,
so
I'm
going
to
hit
on
another
topic,
which
is
also
pretty
current,
so
the
the
recent
Verizon
data
breach
report
kind
of
spoke
about
the
you
know
the
the
major
vulnerabilities,
the
major
way
web
application
services
are
being
exploited,
and
this
is
through
leakages
of
credentials
for
the
people
listening
in
in
the
audience
here
and
for
the
people
at
home.
You
know,
as
you
think,
about
this
being,
like
you
know,
one
of
the
major
kind
of
motions
through
which
nefarious
actors
can
can
act
in
an
organization.
A
A
B
Password
lists
yeah,
exactly
yeah
I,
think
I
mean
Mike
brought
this
up
earlier.
The
the
most
exotic
attack
that
is
the
most
wildly
successful
thing
today
is
still
fishing
right
is
still.
We
are
still
not
finding
people
throwing
zero
days
and
and
secret
ninja
attacks
against
systems.
What
we're
finding
to
be
wildly
successful
is
targeting
humans
and
until
we
can
really
focus
on
building
a
program,
building
a
business
that
can
rely
on
technology
that
eliminates
the
password
or
at
least
raises
the
cost.
B
Significantly
Beyond,
just
totp
2fa
of
making
a
phishing
attack
ineffective
we're
going
to
keep
running
into
this
issue.
So
I
dream
of
the
day
where
everybody
here
is
using
passwordless
auth,
whether
it
be
through
a
502
webathons.
You
know
scenario
or
something
like
that
or
or
whatever
it
ends
up
being,
but
everybody's
using
that
for
their
banking
account
for
their
GitHub
account
for
their
LinkedIn
account
and
I.
Think
when
we
get
there
and
then
we
start
to
see
the
Verizon
data
breach
investigation
report
pivot
to
there's
some
other
thing
that
is
now
working.
B
C
You
know
it's
a
really
tough
environment.
Phishing
is
not
going
away.
Some
poor
sucker
is
going
to
click
the
fish
or
click
the
attachment
or
you're
going
to
have
a
man
in
the
middle
attack
where
someone
actually
steals
the
credentials,
but
they
really
don't
care
about
that.
They
mostly
care
about
the
cookies
in
the
browser
that
they
can
replay
to
go
to
the
website
and
impersonate
the
person
and
and
I
think
where
we
have
to
get
as
an
industry
is
to
be
more
focused
on.
C
A
D
But
you
know,
as
we've
discussed
a
couple
times,
it's
actually
the
basics.
In
most
of
these
cases
they
get
it
right,
and
you
know
it's.
This
is
not
what
you
see
in,
like
security
marketing
collateral,
most
of
the
time
right,
you're,
seeing
like
much
more
Sensational
stuff
and
the
problem
is
I.
Think
it's
a
security
leader
you've
got
to
like
recognize
that
it's
actually
the
hand
washing
of
security
right
like
wash
your
hands
for
30
seconds
before
you
like
it's
the
most
effective
thing
you
can
do
to
like
not
get
sick.
D
D
Frameworks
and
what's
your
checkerboard
of
compliance,
look
like
against
those.
Have
you
implemented
the
top
10
here?
Are
you
using
these
generally
accepted
baselines
here?
If
you've
got
all
that
stuff
mastered
and
most
organizations
don't,
but
if
you've
got
all
that
stuff
mastered,
then
you
can
kind
of
move
up.
The
hierarchy
of
needs
pyramid,
but
I
would
just
urge
people
to
just
focus
on
Basics,
Basics
basics.
A
D
To
kick
off
yeah
and
if
you
were
here
in
my
talk
earlier,
I
talked
a
little
bit
about
this,
but
I
think
the
mindset
that
security
starts
with
the
developer
or
the
end
user,
and
thinking
about
who
you
know
if
you're
a
security
practitioner
who's
your
customer
internally
and
how
do
I
set
them
up
for
success,
I
think
Jeff
and
Ross.
Both
both
brought
up
different
different
versions
of
this,
but
ultimately,
as
a
security
leader
you're.
D
Rather
than
tossing
things
on
them
and
saying
good
luck,
but
just
really
thinking
about
like
how
do
we
set
people
up
to
be
successful?
And
that
includes
managing
risk
right.
But
how
do
you
set
them
up
to
be
successful?
I
think
if
you
start
with
from
that
question,
you're
you're
already
pointed
in
the
right
direction:
Ross,
how.
C
Know
I
would
go
down
to
two
points:
education
and
gamification.
You
know
how
do
we
make
sure
the
person
who
who
comes
into
the
company
as
an
intern
knows
the
right
steps
to
follow
just
like
a
pilot
needs,
a
checklist
that
says
I
need
to
make
sure
the
the
landing
gear
looks
good.
The
flaps
look
good
before
I.
C
Take
off
I
have
a
developer
checklist
that
I
can
follow
to
secure
our
company
and
then
the
second
piece
is:
how
do
we
gamify
it
so
that
we
know
everybody
is
learning
is
increasing
in
in
adopting
these
standards?
It's
not
a
one
and
done
it's
this
constant
Improvement
and
when
you
have
ways
where
you
can
measure
each
month,
so
you
can
say
here's
the
status
of
where
we
are
here's,
how
we're
trending
and
here's
the
goal
when
we
know
when
we're
done,
we'll
have
the
opportunity
opportunity
to
really
make
impact.
B
Somebody
that
exists
already
through
things
like
you
know,
there's
a
partnership
between
LinkedIn
and
GitHub
code
spaces
or
whether
you're
building
internal
training,
material
yourself
like
build
a
development
program.
So
you
can
bring
people's
skills
up
to
where
you
want
them
to
be
or
where
you
can
bring
your
skills
up
to
a
point
where
you
can
take
on
a
new
challenge.
I
think
anybody
who
is
interested
in
security
is
interested
in
better
Technology
Building,
better
software
I
think
we
all
win
excellent.