The harsh reality of being a CISO

Transcript

[Music] Hi everyone. Nice to see a very full room over here of security curious people or people that are trying to get into security or you know whatever you know is that you have affiliation with security. Just like it says over here this is not a fun presentation like I'm sorry I was trying to do this presentation to actually attract people and developers and engineers to do more security stuff. And as as I was building the presentation, I noticed this is a very pessimistic view about what it is to actually be working in security. So um just caveat over here, if you want to leave, this is not a fun presentation.

If you actually want to work in security, you probably don't want to see this because it will tell you like just go open a burger shop or something like that. It's probably, you know, a much more fun and a lot much less stressful. So let's go, you know, with first slide. you know, what do actually people think that working in security is? And especially in web 3 security, you know, and blockchain and and and for those that are, you know, constantly on Twitter swapping, you know, and everything else, this is probably what you see on Twitter from security people, it's like, oh, look how much money I made. Oh, I just started in security and look, I already made my first a thousand bucks without even knowing how to code or anything about blockchains. you know, uh, people going into competitions and,

you know, no disrespect for any of the people over here. Maybe some of you that are over here are right here in the in the audience right now. Uh, no, no disrespect at all. I think you're doing an amazing job and and I'm so grateful that we have really, really talented and smart people participating in competitions, doing audits, protecting protocols, and everything else. Uh, no. And I think it's really worth the money that you're getting back from it. No, but let's not paint a picture to people that are outside of the security world and especially those that are outside of like just general book bounties competitions that oh just join security, train yourself for two minutes in two months in solidity and you're going to start making million dollar a year because that's not the reality. No, this

is literally the 1% that is actually really really really good at what they're doing. Most of them actually come from traditional security. They were pentesters in the past. No, they were security. So, they were redteamers. And the only thing that they've done, they learned a new language like solidity and applied all of that mentality, all of that offensive mentality and uh and knowledge into crypto. And you know, they're being very well paid and renumerated. Thanks on that. But, uh the reality is that there's a lot a lot a lot more uh that that comes with like taking care of security for a protocol, taking care of security for a company than just participating over here. So um if you really want to start I think this is a

great way you know start with competitions start with audits start with book bounties I think it's a relatively easy to start getting into c into crypto security and at the same time you know hopefully make some money you know honestly money motivates everybody like let's let's not kid itself no we're all working here for a specific reason and one of them is mostly money no to be able to you know travel have fun uh you know put kids to school you know buy mama house, whatever is the motive that you're doing, there's always a reason why you're trying to make money, and that's perfectly uh normal. So, but you know, I um I I I notice I never introduce myself. So, I'm Christopher. I work for Polygon Labs in the security team. No, I'm not a CISO. I

don't think I want to be a CISO. A CISO really just, you know, uh people think that it's a fun job, but it's, as I say, it's not really a fun job. You get all the hate, you know, when things go wrong, and you get none of the credit when things go well. So um let's look a little bit you know uh about what it is actually to be a CES and really just like what it means to protect uh a protocol and what is in the mind of somebody that is working in security especially in in the web 3 industry but you know it also applies to everything else. So I just gathered a bunch of pictures that basically are on my mind every single day when I wake up you know about the things that I'm worrying about know. So obviously starting with some

very relevant topics. I think we had a couple of people here already talk about things like North Korea, the IT workers very relevant right now, you know, for those that are not aware like you got a North Korean guy working for your company. I'm quite sure of that. No. Uh so just just look around, you know, there's probably, you know, one of them over here right now just listening to this uh to this session. But um you know IT workers Lasseros's group obviously very very very you know uh difficult uh team that you know are basically very sp very highly sponsored by uh by North Korea and some others. No it's not only North Korea you got other countries over there they actually have people in different countries like in the United

States and even in Europe that actually are basically the face of the North Korean IT teams. No. So when you go and interview somebody or you have to do team meetings actually the person that is showing up is like you know anybody that could be here on the scene like you and me and basically just with a little script that is hurst but in the background you have an IT worker that is actually paying this person to literally being an actor you know in the in those things. So this is something that you know we always thinking especially if you're in HR or you do recruiting and you do interviews like keep in mind that you know there's oh you know this is very prevalent and there are a lot of people trying to apply for this jobs.

Uh another one that comes to mind obviously uh right here on the right the vibe coding. Now I think everybody over here hopefully is vibe coding. No if you're not like just don't lie yourself. you're not going to be able to keep up with the developers and the people that are really using AI tools to develop. There's nothing wrong about it. No, if you have a security guy that says like don't use AI tools, like I'm sorry, you're not going to make it because people that use AI tools are just 10 times more productive. Developers are able to ship 10 times faster the products that you need. But there come a lot of consequences and it's really a little bit of a nightmare over here because uh most of the time when a developer uses AI tools or and you it doesn't have to be a developer can be

anybody you don't really know what the AI is doing how the code is built what dependencies are they actually importing no the AI the AI tool is going to use the easiest path to actually go and build the you know the prompt that you're putting over there so it may be using actually dependencies that are not safe dependencies that for whatever reason have been you know uh hacked or you know have some type of zero day or something like that. So it's important that even though it's all okay with using AI tools, AI development, VIP coding, you need to have somebody to peer review that code.

Ideally yourself if you're the developer, but always have somebody else also review that code that the AI is building because uh there's a lot a lot a lot of issues that can come with AI coding. No. Um um fakes, no deep fakes specifically. I I talked about in the a little bit about the recruiting and North Korea and all those type of things. Uh that's also uh one that worries me a ton. It's it's just incredible the amount of um you know perfection that deep fakes h have gone. No, I think everybody remembers that Will Smith spaghetti uh video uh you know that that was tried to be generated. No, where he was like it was crazy. It didn't make any sense like a year ago how the AI built that video and now literally it is almost perfect to

perfection how it builds video and even in the deep fakes you can barely notice nowadays especially if you don't have like perfect connection perfect video uh state and stuff like that you can you can probably be fooled very easily uh that the person you're talking to is actually your boss or the financial advisor or whoever it is. So, uh, following the rule of like two-factor authentication multiffactor authentication, always verify. If your bot calls you and tells you, please send half a million dollars, you know, to whoever it is, just do a second check through Telegram, to Slack, to whatever, you know, whatever system you do, like, hey, can you confirm what you just said, you know, about transferring money or doing this or doing this upgrade or stuff like that? Um, yeah, just always

double check, verify everything that that is else. Uh, another nightmare to me is uh the part of testing in prod. And I put, you know, a very uh famous person over here, you know, I I I I like what he does. No, don't get me wrong. But when he went out and said like it's all good to test in prod like I'm like no, that is actual nightmare. You do not want to test things in production because you have people all day looking at the blockchain like literally looking at the mempool which means before things are even deployed into the blockchain to understand how can they attack it how how can they use it to their benefit so you know what I take like testing prod testing prod in a simulation let's put it that way now I think testing prod as

a concept is really good because it really reflects realtime scenarios and stuff like that but use a simulation for it another thing that I um you know wake up every morning. You're going to see it over there at the end. That is literally my Sunday morning. And I could only just like screenshot like the the f it's my it's our bug bounty program at Polygon. That is a real screenshot. Those are real things. If you see the time slots that went on for basically until 10:00 a.m. in the morning. So it started like 7:22 in the morning on Sunday and it went all the way to 10 a.m. Those are all AI uh bug bounty submitted. And uh obviously it's all good. You know, you got triagers. Yeah, this is a submitted, you know, invalid, invalid, invalid,

invalid. But what's the problem over here? There may be a valid one in the middle. And there is a valid one in the middle, unfortunately. And we cut the valid one in the middle. But it took a while because we also had to go through other 30 different uh reports and basically figure out which one is real, which one is not real. So it's very easy to miss a real bug bounty program. Um, what else keeps me at night? Uh, yeah, Dows, not really for Polygon. No, in certain terms, but obviously we had this Vitilik just literally I had this slide already prepared and Vitilik talked about it as well. I'm like, "Oh, wow. We think alike, you know, the the arbitum drow stuff where, you know, they actually paid to get votes in order to, you know, gain some advantage into the

governance and all those type of things like sometimes I'm afraid not specifically in Polygon because we don't have direct like onchain voting that actually goes to onchain execution. But uh you know for for a protocol that has direct onchain execution based on token voting like you can wake up one day and somebody change all your contract through a malicious you know governance proposal or something like that and obviously this has happened. Um yeah namecheep and all the social networks like all my found all the founders all the you know crypto famous people that the company the that the company has like they're being targeted all the time with fishing links and stuff like that.

And you know, you can imagine what happens if one of these guys, let's put Sandep from Polygon gets fished, his Twitter gets hacked and then suddenly says, "Yeah, airdrop. Polygon is doing an airdrop. Please, please, you know, send your tokens here and we're going to airdrop you stuff." Now, every most people's going to believe that. And you know, so that's a nightmare. Just all the social networks, Discord getting hacked, all those type of things. You can wake up one morning and all of that is hacked and you just got to go through it. um travel rule, a lot of regulations. You know, now with you know, it's great that regulation is opening up and being more comfortable with crypto and everything else, but at the same time that means that we need to do more things. We need to provide more information, answer more questionnaires,

uh all those type of things to uh to the different governments and the regulators. Now, uh last but not least, the obvious bridge gets drained, millions of dollars lost. That's an always constant nightmare that you have over there. Um, so I would like to tell you, you know, if you're looking to go into security or want to do security, like actual security, not just, you know, trying to find a bug and make a million dollars, is like, are you really ready for that responsibility? Because, and this is probably the most pessimistic slide of all of all of them. It's like you're going to be, you know, attacked or bombarded with constant threats. No, we've talked about that regulation, countries, state sponsored, uh people, you know, dodosing your website, um you

know, spam, um all those type of things. There's also misaligned incentives. Like apart from those 1% auditors that are making bank on some of these competitions and stuff like that, the rest of the security people have a normal salary. like we are not millionaires and we're trying to protect like you know multi-million dollar even billion dollar companies, billion dollar treasuries, billion dollar smart contracts and stuff like that. So um you know there's a lot of misaligned incentives especially if you're a custodian if you're part of a multisig like you know you can be tempted somebody can come and tell you like hey if you give me one of these bug bounty things you know uh some of the that where where I can hack you know polygon for $3 billion I'll give you 10% of that

information like that's you know 50 years of your salary or whatever whatever it is like think about it no so those incentives are not always aligned. You know, you're not going to be a multi-millionaire by working in security. Um, limited authority, that's also a very big problem, unfortunately. No. U ship ship ship. That's what we hear from all CTOs, from all CEOs. And I completely understand it. Like this this this industry moves fast and we need to move fast if we want to remain relevant. But at the same time moving fast means that it comes with a lot of uncertainties and a lot of untested code a lot of no unsecured code and stuff like that which could lead to disastrous dangers. So you know I'm all about

moving fast no and and uh and and and swiftly but at the same time you know at least you have to have a little bit of interference and at least know that code is going live. Like the worst thing that that can happen for a CISO or for somebody in security is that you wake up and suddenly you have a new smart contract with millions of dollars that you have never heard about. You know, like hey, when did you guys deploy this? Why didn't you tell us like at least give us a night to review it? Like make sure that you know you're not doing anything incredibly stupid that will, you know, any script kitty can hopefully do it. Unfortunately, it happens a lot.

a lot of products, a lot of smart contracts, a lot of just general, you know, websites and stuff like that going go live with barely or none knowledge from security teams. And well, we all know how those stories ends. Um, and last over here is obviously the regulations, the legal risks and stuff like that. Uh, would I don't know if any everybody knows, but in traditional security, if you're a CESO in the United States, you can actually go to jail. Yeah. So like look at Solar Winds and many others like there you have a duty over there to protect the information to inform the board about risks know to ensure that um you know that you have a a a mature security strategy and everything else and if you don't do that

you're going to go to jail that's a tough risk to handle no to be honest to being a security person in web 3 not so much but you still have a lot of personal liability like there's millions of dollars at stake and millions of dollars of millions of people. Like, who has to say that one of those million people that lost money because you didn't take care of proper security, hygiene, or stuff like that is not a crazy guy that is going to come to your house with a gun and shoot you? Like, sorry, I'm I'm not selling security at all, but it's the truth. No. And it's something that I think about very often all the time. And I want to make sure that uh you know, when when when you're talking to your security folks, when you're like specifically if the security guy's like,

"Yeah, sorry, we need to test it. It's going to take another week. Uh, no, let's not do that. Just please use a ledger. Don't use your metam mask. I know it's more convenient. Like these are the things that that guy has in her mind. You know, it's the fact that hey, if something happens, it's my ass on the back. Um, so what keeps what keeps an I think I'm a little bit over over time, so I'm going to go very quick, but there's a couple of differences between like traditional CESO, web 3. And I think the most important part over here like it all starts with fishing. Fishing is the number one vector over there. But what is you know the most important part is that in web 3 when it happens it happened and it's done and you're gone like the funds are gone in one second.

In the traditional you know you have time you have reputation okay you got to negotiate there's ransomware. Okay pay me I'll tell you your your data. In web 3 the money is gone you're gone the project is gone. Um, no. Hopefully you can recover it through, you know, trying to find who it is or negotiate or stuff like that, but it's gone. Like, you know, it's it's it's it's not fun. Uh, so the risks are much higher when you're a web 3, you know, crypto CISO type of person. Um, so how do you think about this? And I'm going to finish very quick with this is, you know, how I think about um, you know, security. Let's say you just got hired, you're a new security person. You think about people, you think about the technology, you

think about the process. You got to make sure that the people, you know, are, you know, do things in the most safe way possible. You know, assume that they're all monkeys. Assume that they're all monkeys. They have nothing to do and make sure that you build a strategy based on that. The technology as well. Assume that North Korea is already in your AWS infrastructure. Okay. Start with that base. Go forward. And then processes. Ensure you have checks, checks, checks, checks. Like I said with the video call and stuff like that, check with your CISO, check with your CFO, check with your colleague that what he said on the video on what he said in this message is actually true and it was him that actually uh said that message.

Um this is the last one. Um so you just got hired again into security uh to do security. So what what should you do? And you know this are I I got this somewhere. I don't know. I read it somewhere in Twitter and it stuck in my mind for months and months and months. So this is my take on it, you know. Um, first of all, do a tabletop exercise like assume you got hacked and see how the company reacts. No, tell the tell your don't even tell your CEO, tell your CTO and you know two or three more persons that you're going to do this, but apart from that just announce, hey, we just got hacked and let's see how the company reacts and they're going to fail miserably. No, but that's going to, you know, basically start training people to see which are the biggest holes that you

need to solve. Um then benchmark the maturity of the of the company. You can do it very easily with a checklist. Now there's NIST CIS and the CSA produce a bunch of checklists that are even relevant to a fivep person organization. Yes, this is not a thing for you know big bureaucratic companies. And the last one over here is you know build a riskbased plan. So you know start to think 30 90 365 plan and you know talk about it with your uh founder team with your uh with your leaders and stuff like that to ensure that you're aligned with the business. No and that you're not going to just stop the whole engineering and and die the product. I think I'm done with time. No, I'm good over there.

Yeah, and I made it all the way to the end. So um yeah, thank you guys. I hope I didn't discourage anybody from joining security. And if I did, you'll welcome me in the future when you're old and, you know, depressed like me. [Applause] Yeah. Yeah. No problem.