Hacking a Major Security Conference
- 1. Insert presenter logo here on slide master HACKING A MAJOR SECURITY CONFERENCE Dan Houser, CISSP-ISSAP CISA CISM CGEIT Member, (ISC)² Board of Directors Security & Identity Architect, Cardinal Health Session ID: PROF-106 Session Classification: General
- 2. Copyright © 2010 Daniel D. Houser DISCLAIMER Despite the joke inherent in the title, the author does not condone… • Cracking systems without permission • Stealing This presentation is a guide to getting into conferences for free… the LEGAL way.
- 3. Copyright © 2010 Daniel D. Houser AGENDA Why Speak at Conferences? Methodology / Approach Keys for Success Application / Wrap-up 3
- 4. Copyright © 2010 Daniel D. Houser NO BORING STUFF • This presentation will not cover: – Speaking & presentations – 31337 PowerPoint skills – Visual Aids – Hygiene, Grooming or Attire – Showing up …or any other basics about giving presentations • This presentation WILL cover: – Non-intuitive insider information on how talks are selected – Step-by-step process for getting on conference programmes – Managing the abstract and presentation process – How to get your presentation selected 4
- 5. Copyright © 2010 Daniel D. Houser METHODOLOGY & APPROACH Why a method? – Task can seem overwhelming – Benefits from functional decomposition – Methods can be tuned and repeatable – Methods usually win over random acts My CTO’s challenge in 2002: “I want you to speak at as many conferences as possible this year.” 5
- 6. Copyright © 2010 Daniel D. Houser METHODOLOGY & APPROACH 6
- 7. Copyright © 2010 Daniel D. Houser HACKING EXPOSED – SIX STEP APPROACH 1. Target Selection 2. Fingerprinting 3. Scanning 4. Enumeration 5. Attack 6. 0wn 7 Image courtesy McGraw-Hill http://tinyurl.com/2bcr8ne
- 8. Copyright © 2010 Daniel D. Houser TARGET SELECTION If you want to be serious about “hacking” conferences, you must select targets 8 Where do you want to speak? What venues would you enjoy? Targeting also benefits from a methodical process
- 9. Copyright © 2010 Daniel D. Houser INTROSPECTION: WHY SPEAK AT CONFERENCES?? • I can’t answer that question for you, your reasons are your own • Prestige, (mostly) free training, professional growth, furthering your career, travel? • Personal challenge? Fun? • Potential for financial rewards? • What matters most to you? 9
- 10. Copyright © 2010 Daniel D. Houser MOTIVATION & PRIORITIZATION • You will need to determine your own motivation to prioritize the conference(s) you most want to attack • What is important to you?? Prestigious Conferences Commercial vs. Academic vs. Vendor Career Training opportunities Location - Resort / Exotic location Travel commitment Ability for Compensation / Honorariums Optics – Low Profile or High Profile? Perqs and vendor chotchke “Destination” Conference such as RSA 2011 Spouse/partner opportunities 10
- 11. Copyright © 2010 Daniel D. Houser TARGET SELECTION • Select motivations best aligned with goals • Identify Conferences that meet those criteria • Google is your friend – “Call for Papers” security OR cryptography OR privacy – “Las Vegas” “security conference” • Ask colleagues for advice on conferences • Read trade magazines • Metro/regional vs. national vs. international • Consider being the “lone security pro” at an associated conference (e.g. IT Audit, Legal, Privacy, Gaming) 11
- 12. Copyright © 2010 Daniel D. Houser FINGERPRINTING • Short-list conferences: Pick 10-20 • Research targeted conferences to assure alignment with your goals – and score them • Identify Call for Papers deadlines – Even if not yet published, look at last year’s dates • Align dates with vacation/holiday schedule • Don’t forget local & regional conferences – May require no travel expense – Great proving ground for new topics – Easier “optics” for management than New Zealand or Miami 12
- 13. Copyright © 2010 Daniel D. Houser SCANNING • Research prior conferences for subject matter • What made the agenda before? • What is consistent across last 3 years as a trend? • What was there 3 years ago, but was gone last year? • What does the marketing literature say about the goals of the tracks and keynotes? That theme should carry through. 13
- 14. Copyright © 2010 Daniel D. Houser ENUMERATION • Aligning targeted opportunities with “attack” capabilities • Requires you to know yourself: – To what subjects do you bring expertise? – Does your journey over past 3 years present an idea for an interesting case study? – What do you get excited talking about? Where is your passion, your bliss? – What interesting research have you done? – Can you bone up on a topic for 4 months and become the expert with something to say? 14
- 15. Copyright © 2010 Daniel D. Houser WHAT ATTACKS ARE SUCCESSFUL? OR… WHAT TALKS ARE SELECTED? What program committees look for: – Targeted coverage of a track • Committees will pre-select big 3-7 topics they want covered • Anticipate what your AUDIENCE would want to hear about – Crisp, clear & solid abstract & biography – Session title that grabs them (without being campy) – Learning objectives & outline – Prior speaking experience – Demos (that have a high confidence of being successful) – Talks unique to the conference …or at least not rehash given 3 times already this year – Practitioner talks for technical, CISO/CIO for business/strategy – Industry gurus (particularly as panelists) 15
- 16. Copyright © 2010 Daniel D. Houser WHAT ATTACKS ARE SUCCESSFUL? OR… WHAT TALKS ARE SELECTED? What will kill your abstract: – Any hint of a sales pitch – Presentations by VP of Sales or Product Development – Spelling and grammar errors – Obvious first-time speaker – Clues that the speaker is not fluent in the language of the conference – Off-topic – Over-used material….. – Over-the-top claims – Not having a marketable abstract Remember: your abstract is brochure marketing text 16
- 17. Copyright © 2010 Daniel D. Houser TOOL SELECTION: BIOGRAPHY • Academic vs. Commercial • Study biographies from targeted conferences • Like a CV or resume, create versions that emphasize different skills – Innovation, Identity, Cryptography, Enterprise Defence • Sell yourself as both an expert in the field, and with demonstrated expertise as a speaker and/or author • Action oriented • Work & re-work • Create 80-word, 150-word and 250-word versions 17
- 18. Copyright © 2010 Daniel D. Houser TOOL SELECTION: CREATING AN ABSTRACT • Study abstracts from targeted conferences and tracks • Basic kinds of talks: – New spin on an old subject – Primary research – Making a complex topic clear – Covering the basics – always needed! – Case Study – Panel Discussion – Demo • What was the balance of talks in prior years? Mostly demos? Panels? 18
- 19. Copyright © 2010 Daniel D. Houser TOOL SELECTION: CREATING AN ABSTRACT • You will find success elusive with a single abstract: Write several • I usually submit at least 4 abstracts per conference • DO: – Create diverse abstracts within several subjects of expertise – Partner with trusted peers for co-presenters or panels – Create a variety of styles – Show creativity with the titles • DON’T: – Create 8 different flavors of the same abstract, in the hopes the program committee won’t notice. Likely, they will. – Use the same or mostly same titles – Partner with a slacker 19
- 20. Copyright © 2010 Daniel D. Houser ATTACKING YOUR TARGET As with the “Hacking Exposed” process, this attack is in 4 waves: • Launch Attack – blast out abstracts • Gain Entry- abstract accepted • Escalate Privilege – create presentation • 0wn – deliver presentation 20 Image courtesy Heart Hackers
- 21. Copyright © 2010 Daniel D. Houser ATTACKING YOUR TARGET: LAUNCH ATTACK 1. Use goals orientation and scoring 2. Start submitting abstracts to the most desirable conferences first – Align topics & capabilities with tracks and goals of conference 3. Modify abstracts and titles to ensure marketing text in brochures isn’t identical 4. Send 4-5 abstracts to each of your top targets 5. Biographies can be re-used across conferences, but provide tuned biographies to make sure they align with the topic 6. Submit abstracts and stop… no need to go further 21
- 22. Copyright © 2010 Daniel D. Houser ATTACKING YOUR TARGET: GAIN ENTRY • Hooray! Your abstract has been accepted – Gulp! Now what?!?! – Don’t Panic, you typically have 4 months to deliver a presentation • Determine funding model and talk with the boss before accepting the engagement – Do they provide free conference attendance? Most do. – Do they provide free room, board and/or plane fare? Most don’t. • Now develop outline (if not already developed) and bones of presentation • Schedule local group for delivery of presentation as a trial 22
- 23. Copyright © 2010 Daniel D. Houser ATTACKING YOUR TARGET: ESCALATE PRIVILEGE • The presentation is easy with a methodical process • You only have to develop accepted presentations • You don’t have to develop full presentation all at once • You need a presentation to be developed in 4 phases: – Outline sufficient to plan further work, may need to submit – Full text of presentation laying out talk -1 month before deadline – Presentation complete with graphics suitable for printing - by presentation deadline – Animation and screen transitions - by conference • Don’t make the mistake of trying to build your presentation complete with graphics from ground up 23
- 24. Copyright © 2010 Daniel D. Houser ATTACKING YOUR TARGET: 0WN! • Practice locally. Practice often. Practice again. • Consider joining Toastmasters for targeted help • Give presentation at local/regional conference before national/international if possible • Stand and deliver • Repeat 24
- 25. Copyright © 2010 Daniel D. Houser APPLICATION • Set a goal to start with determining your objectives and researching conferences by November. • Remember to use a phased approach so the task isn’t overwhelming • Tune your approach and abstracts • Practice and seek opportunities to give your talk in unthreatening environments as “practice”
- 26. Copyright © 2010 Daniel D. Houser Q & A Surely, there are questions???
- 27. Copyright © 2010 Daniel D. Houser LOGISTICS Please fill out evaluation forms Contact information: Dan Houser