DEF CON 30 - 与Jay Healey的政策炉边谈话
本页标题、字幕、摘要和阅读笔记为已保存的 AI 译文，可能有误。时间戳与来源一致，可展开查看原始字幕，并对照原视频核对。
Jay Healey在DEF CON的政策对话探讨安全从业者如何通过公共政策、协作和切实可行的修复措施来帮助防御者。
文字记录来源：YouTube上创作者上传的字幕。Vidleaf添加了AI标点；保留原始措辞和时间戳锚点。原始文字记录可在下方获取。
AI生成的摘要
Jay Healey与Dark Reading的Fahmida Rashid讨论为何数十年的黑客攻击和安全投入并未带来社区所寻求的防御优势。Healey以个人身份发言，主张发现弱点需要一条更清晰的通往修复和可衡量改进的路径。他们描述了技术从业者通过研究员项目、漏洞赏金、地方政府、公众咨询和社区组织为政策做出贡献的方式。Healey倾向于那些能广泛而低成本地帮助防御者的措施，包括更新、安全设计的云服务和端到端加密，以及通过CERT、ISAC和共享框架开展协作。对话还考虑了无偿技术援助、不安全系统给他人带来的成本，以及权利与责任之间的平衡。最后以关于公私合作以及如何评估互联网是否变得更具可防御性的问题作结。
根据文字记录生成。请对照原始视频检查链接段落。
带时间戳的章节摘要
为何技术发现需要一条通往更好结果的路径
DEF CON与政策之间不断变化的关系
通往政策的路径与修复的责任
连接研究、沟通与政策语言
大规模、低成本的具有可防御性的互联网
攻击能力与安全之间的张力
运营创新与公私合作
无偿技术援助与社区服务
权利、责任与安全外部性
战略优势与衡量可防御性
[0:00] - 我们想欢迎来自 CFP 团队的 Jay Healey，然后是 Fahmida。欢迎来到 DEF CON。他们将进行炉边谈话。请关注您的日程安排，您将在 Hacker Tracker 应用上看到最新信息。因此，如果您关注您想观看的时间和房间，那是找到更新信息的最佳地方。所以请热烈欢迎我们的座谈嘉宾。（观众鼓掌）- [Jay] Fahmida。
[0:33] 是的。- 谢谢你的提醒，Jay。（Jay 和 Fahmida 笑）嗨，我是 Fahmida Rashid，我是 Dark Reading 的特稿执行编辑，我非常兴奋有机会…… - [Jay] 是的，我觉得 Fahmida 没有音频？ - 或者我应该直接用？好的。嗨，这样更好吗？好了。- 耶！ - 我现在听到自己了。- 黑客！ （Fahmida 笑）- 所以我是 Fahmida Rashid，我是 Dark Reading 的执行编辑，我很荣幸来到 DEF CON 与 Jay Healey 交谈。
[1:09] 我们将谈论一点信息安全的过去、现在和未来，黑客、政策，我们将涉及很多不同的话题。所以 Jay，非常感谢你今天加入我。- 谢谢，谢谢 Fahmida，很兴奋。- 是的。所以我认为我听到的一件事是，这是 DEF CON 30，但我想你跟我提到这也是意识到 - 是的。- 黑客几乎总是会成功的 50 周年。- 是的。- 那么这告诉了你什么？这让你感觉如何？
[1:40] - 是的，让我把这个问题推回到是什么导致了那个问题。我们，感谢那些给我通用手势的人，我们在这方面做得更好吗？好的。- [工作人员] 把麦克风放到嘴边。- 测试一，测试二。我刚在这个上。测试一，测试二，测试，我穿着裤子和衬衫。- 不，不是。- 测试一，测试二。是的，谢谢。我们已经连接了。
[2:12] 很高兴听到你，或者很高兴你能听到我。所以 Fahmida 的介绍，她在谈论我们作为一个社区没有做到我们想做的那么多。这是 DEF CON 30，对吧？如果我们看看为什么很多黑客做我们所做的，对吧，很多是出于好奇心，很多是因为我们被驱动这样做，但很多是为了让事情变得更好。我们中的许多人这样做是有目的的。我遇到了这句话，说：“很少有，如果有的话，当代计算机安全控制能阻止一个专注的红队轻易访问任何寻求的信息。”
[2:59] 所以它说红队会通过，对吧？黑客会通过，攻击者有优势。那句话来自 1979。我找到了可以追溯到 1972 的实际引述，说红队会通过。所以，好吧。所以如果我们这样做是为了尝试让事情变得更好，它失败了。用我们正常的方式。这就是为什么我很高兴看到大家在这里参与政策。
[3:30] 这就是我们试图通过政策完成的大部分工作，就是说，好吧，正常的事情，比如黑客攻击并告诉人们，并没有导致我们想要的规模上的成功，因为攻击者，如果有的话，只是变得越来越好。如果你听到了，Chris Inglis 和其他人在这个房间里谈到了这个。所以想想这个，自 1972 以来，对吧，想想所有的专利，所有数千亿美元，所有工作的周末，所有错过的孩子的生日，我们作为一个社区在 50 年里所做的。
[4:08] 我们还没有改变最基本的动态，因为现在事情并没有更好。- 我的意思是，我在回想，就像你说的，就像所有那些工作的周末，我们在想，“嘿，这一切的目的是什么？”所以它确实让人有点沮丧。- 是的，过去 30 年这个社区的很多心态，我开始，我自 DEF CON 9 以来一直来，我在过去六七年一直在 CFP 审查委员会，就是如果我们搞砸了，对吧？
[4:44] 如果我们黑掉这个星球，它会更好，但并不是那样运作的。我们在黑东西，但它并没有变得更好，至少没有以我们想要的速度和规模。如果有人今天早上在这里听到了 Dark Tangent 的讲话，他在谈论选举村是如何运作的。所以我们可以做得更好，对吧？我们可以做到当我们破坏东西时，它真的会在另一边带来更好的结果。- 所以，我的意思是，在我们甚至开始弄清楚，好吧，我们要做什么不同的事情之前？
[5:14] 我们为什么不稍微往回退一点。早期的黑客行为是什么样的？我的意思是，我知道我们中有些人经历过，但我知道不是所有人都经历过那个时期，所以那是什么样的？- 是的，就是。所以我没有CFP董事会其他很多人的黑客技能。我在那里是为了帮助政策讨论。但看到DEF CON作为其中一部分是如何变化的，真的很有趣，对吧？
[5:46] 当我们刚开始的时候，你知道，早年在Alexis Park，对吧？那是关于恶作剧的。有很酷的黑客行为。有搞砸东西和做酷黑客行为。我的一个朋友，有一天早上对我说，“天哪，我昨晚喝得有多醉？”“哦天哪，我不知道，我觉得你没那么醉。发生了什么？”“哦，我在口袋里发现了一张来自Alexis Park的ATM收据。”那被认为是你能做的最愚蠢的事情的顶峰，就是实际使用Alexis Park的ATM，因为那是拉斯维加斯，可能也是世界上被黑客攻击最多的ATM，而DEF CON绝对100%是一个为黑客举办的黑客会议。
[6:32] 现在它基本上仍然是这样，但如果有人今天在这里听到Jeff的发言，对不起，Dark Tangent，特别是在Snowden和Stuxnet之后，DT取消了联邦调查局人员来参加会议的邀请。他说，“你不再受欢迎参加我们的会议。我们需要一些时间远离。”那是在DEF CON前后，有人记得吗？那是在DEF CON 22前后？- 22。- 差不多是这样？
[7:05] 看看今天有多么不同，对吧？不仅我们现在修复了那个裂痕，而且Jeff说过，DT说过，我们需要做得更好。我们作为一个黑客社区，仅仅靠自己并没有做出改变，但我们需要更好地与政策制定者融合，不仅在美国，而且在全世界，所以我们有一个实际的政策轨道来尝试做出更多改变。这仍然是一个黑客会议，但我认为你看到了DT的承诺，我们需要开始做得更好。
[7:37] 我们需要开始让防御比进攻更好。- 我认为这实际上是我们看到的更积极的方面。就像黑客一直有点处于边缘，有点做自己的事情。但现在随着政策的参与，我们看到了一点更多，不一定是主流，但我们的想法很重要的理念。那么在过去几年里，你看到了哪些来自黑客社区的这种征求想法的情况？
[8:09] - 是的，首先我必须说，我现在以个人身份发言，不代表任何我的所属机构。我们开始看到黑客可以参与的更多方式。仅仅是你在这里，我们这里有一个政策轨道。我们今天早上听到了一些很棒的想法。我们有一个小组讨论，很多参与政策村的人，从中产生了一些非常棒的想法。我们听到了Mosfet的发言，她是一位出色的黑客，她去了国会。
[8:40] 她是TechCongress研究员的一部分，去帮助国会议员和他们的工作人员学习做得更好，制定更好的法律。我们这里有Monica Ruiz，她在帮忙，我想，是一个叫做Digital Peace Now的组织，这是一个全球青年运动，说我们厌倦了民族国家黑客行为，而其他所有人都必须付出代价，那么我们能做些什么来帮助政府更负责任？
[9:14] 他们真的很有善意。有没有人是Digital Peace Now的？有没有人注册了Digital Peace Now？超级有善意，但他们可能不像他们应该的那样了解技术。所以如果这听起来像是你感兴趣的事情，他们真的可以在你所在的任何国家使用你的帮助。比如与你的市议会核实。那里有人需要你作为黑客的帮助，说：“好，是的，我需要帮助。我需要一些建议，关于我们如何做得更好。”无论是在你的村庄、你的城市、你的州、你的地区，不管那些是什么。
[9:49] 我们今天早上这里有Jack Cable，他参与了Hack the Pentagon，这是第一个针对国防部的漏洞赏金计划。这就是他的起点，在五角大楼找到这些漏洞，然后继续前进，然后他转到政府工作，帮助做诸如改善美国选举安全的事情。他这样做是因为他通过前门进入，只是做了一个漏洞赏金计划。所以这是一个美国的例子，但我们开始看到这些“hack the blank”出现在各种国家。
[10:27] 我要提到的最后一个是美国政府以及其他政府，当他们出台新规则时，他们会征求输入。所以我们今天早上听到，Harley，一位前国会工作人员，说：“看，FTC正在就网络安全应该是什么来帮助保护消费者出台新的规则制定。”这非常符合我们正在做的事情。规则制定，听起来很无聊，但它是大事随时间变化的方式。
[10:59] 不仅在美国，在其他地方也是如此。所以无论你的背景是什么，无论你对什么感兴趣，看看这些东西，对吧？Beau Woods与Josh Corman和其他人一起运营I Am the Cavalry。所以看看I Am the Calvary。他们做这个大概，多久了？六年，也许？七年？- 稍微长一点。我的意思是，- 是的。- 在所有事情锁定之前，他们至少存在了四五年。- 哦哇，好的。
[11:29] 而“我是骑兵”传达的信息是，我们不能只是搞破坏，然后等着别人来承担这件事的责任。如果你黑了某个东西，你就要为结果负责，无论它最终是否被修复。所以这个名字来源于“骑兵不会来”，对吧？不会有成年人走过来对你说：“谢谢你让我们注意到这件事。接下来交给我们吧。”这不会发生。或者至少，它一直没有发生。
[12:00] 我们正努力做得更好。所以“我是骑兵”这整个运动，就是为了帮助黑客们正视那个行善的时刻。我们怎样才能做得更好？我们怎样才能对结果负责？不只是把东西搞坏，也要把它们修好，并确保它们保持修好的状态。这是专业术语。——我觉得，其实当我们谈论这一切、当你说这些的时候，我在想，这大概就是最大的区别，早期黑客和现在的区别，多了一点问责意识。
[12:31] 黑客们会说，是啊，我做了所有这些很酷的事，但让我告诉你怎么修。或者即使我不知道怎么修，也给我找个能坐下来和我一起修的人。而这种问责程度，我认为是我们所做事情中比较积极的方面之一。——我经历过一个非常艰难的时刻，大概是在DEF CON 22前后，因为任何、任何与NSA工具集有关的人，以及那些进来做NSA工具集演讲的人？如果你真的在做NSA工具集，就别举手。
[13:01] 那是在斯诺登爆料之后，有一群了不起的安全研究人员说：“我们想搞……我们想研究斯诺登曝光的NSA所作所为，我们想把它做得非常简单，”这是他们的原话，“简单到一个10岁的小女孩都能做到。”不确定他们为什么非要加上性别，但是。他们这么做是为了隐私。所以他们的目标是，我记得我当时说，他们在破解GSM加密，他们想让破解GSM变得如此简单，而他们这么做是为了隐私。
[13:32] 我实在很难理解这一点。那是一场精彩的演讲。那是一个伟大的目标。但需要多久，尤其是在当时，那种我们破坏东西然后它就会被修复的过程，并不是直接的因果关系。抱歉，我现在是个学者了。我们谈论的就是这个，因果关系。如果你做了某件事，你是否期望它真的会……它实际会得到什么结果？所以我认为，如今社区在这方面做得好多了，会去审视那种因果关系。
[14:05] “好，行吧，如果我们把它搞坏了，那就确保它被修好。”——甚至只是因为我们有了更多的结构，所以即使我做不到，或者我不知道该找谁，我现在有可以求助的资源，我们有漏洞赏金计划，他们会说：“我来帮你建立那个联系。”所以我认为我们有了更多的基础设施支持。——而且我认为媒体，我认为记者们也做得更好了，对吧？——谢谢。——是的。如果大家昨天在DEF CON，抱歉，是黑帽大会上听到杰夫介绍金·泽特，讲到早期记者们只是匆匆来匆匆去，谈论疯狂的发型，利用社区达到自己的目的。
[14:50] 现在你们有Dark Reading，有金·泽特，还有很多其他优秀的记者扎根于社区，就像你自己一样，在应用安全方面有深厚的技术功底，所以帮助我们讲更好的故事，这样我们才能在另一边带来更好的改变。——我其实想谈的一点，你也暗示到了，我觉得很多时候当人们听到“黑客和政策”时，他们会想，好吧，我不会去竞选公职。
[15:22] 我不是律师，所以我不懂法律。所以你提到和市议会合作之类的。你甚至怎么开始那种对话？你甚至怎么让这个房间里好奇的人们明白，你不需要是法律专家才能参与政策？——对，他们会那样做，对吧？他们懂法律那一面。他们对你知道的东西感到好奇，所以就聊一聊，对吧？我的意思是，无论哪个层面让你觉得舒服，无论你走哪条路，都会是好的。
[15:53] 可以去看看TechCongress和“我是骑兵”的资料。这方面有很多好材料。如果你去过BSides。BSides拉斯维加斯通常是很多这些人聚集的地方。如果你去政策专场，找博·伍兹，他有那个，他有那个，我记得今天头发是蓝色的？——我想是的。——就在那里问问周围的人。会有很多人能帮忙，不只是有一般性的想法，而是亲身经历过，并且在你带来的任何背景下帮助过别人。
[16:25] 还有一些其他建议，第一，至少试着去，学会这门语言需要一段时间，但对这门语言要宽容，对吧？政策圈的人，我们经常说“网络”。如果你不能原谅我们这一点，（笑）那就会有困难。如果你想让别人理解你，你就必须在人们谈论事情的方式上主动靠近他们。所以在政策方面，归因对我们来说很重要，因为归根结底，关键在于哪个国家该负责。
[16:55] 我在白宫工作了几年，对吧？我不在乎归因。我在乎的是国家责任。归根结底，总统得拿起电话，打给某位首相、某位总统说：“住手，否则后果自负。”这不是归因。所以这些东西在白宫、国会或你们国家的对等机构里很重要。所以再说一次，如果你无法接受“归因是愚蠢的”这个事实，在你的完整版 Threatbutt 和 Attribution Dice 里，那些东西很有趣，在你的语境里可能不太重要，但当你考虑国家安全政策的某些方面时，它绝对重要。
[17:40] 但一定要做你自己，对吧？如果你愤怒、你恼火，别丢掉那股劲。（笑）保持愤怒，保持恼火。只是，让我们保持引导并保持活力。- 是的，我觉得有时候当我们生气、当我们只是烦躁、沮丧时，我们会想，“嘿，什么都不会改变”，我们往往会变得有点封闭。所以我觉得这条路是解释“不要变得封闭”的完美方式。- 而在一年之内，大约在 2011、2012 前后，我让 Jeff Moss、Dmitri Alperovitch、Richard Bejtlich 和其他人说我们不能这样，我们很沮丧，因为我们没有通过技术实现我们想要的影响，但我们不知道如何在政策上实现这一点。
[18:29] 当时我在一家智库工作，抱歉，是大西洋理事会。所以很多人已经走过这条路，说“我需要做出改变，我需要找到其他方式让我的声音被听到，并发挥我的知识和技能。”所以这是一条被广泛走过的路。- 我们谈了很多关于我们现在做事方式的不同，但如果你能给我一个我们做得更好的例子。
[19:00] 我不想只是悲观地说我们没做得更好。- 所以我自认为是一个战略型的人，对吧？很久没有真正地敲键盘了，或者说对你们来说有意义地敲键盘，记得我说过的方式是回到 1972，我们已经过了 50 年，却没有产生我们想要的效果。大约五年前，我在《经济学人》上读到一篇新闻文章。他们研究气候变化，说：“作为物种，我们采取的哪些干预措施从大气中带走了最多的二氧化碳当量？”
[19:40] 他们给这些措施从 1 到 30 评级。他们说：“据我们所知，从来没有哪个傻瓜用这种方式问过这个问题。”这就是了，人类面临的最紧迫问题之一，却从来没有人说过：“我们做了什么，以最大的规模和最低的成本产生了最大的影响？”于是我灵光一现，（模仿爆炸声）那么我们作为一个社区，做了什么让防御者在更大规模上以最低成本获得对攻击者的最大优势？
[20:15] 让我们多做这样的事。那个数字，有人猜吗，直接喊出来，我们认为我们作为一个社区在规模和成本上做的头号事情是什么？Windows Update，对，谁说的 Windows Update？绝对。因为与其做只影响单个企业的事情，我们可以想出最完美的工具，它拿到所有风投的钱，因为它是最聪明的东西。我们仍然得买十亿个。
[20:46] 我们得把它整合到企业或我们的家庭网络中。我们得监控它。我们得保持更新。我们得培训人们使用这个工具。我们得让它与我们拥有的所有其他该死的工具集成，并且做十亿次。像 Windows Update、云、端到端加密这样的事情，你做一次，十亿台设备或人就能受益。这就是为什么，尤其是我们很多做政策的人，对政府人士试图破解端到端加密如此不满。
[21:22] 如果实施得当，这是少数能轻松大规模帮助防御者的事情之一。这确实是少数你能得到的东西之一，它真的让对手很难办。- 而且它实际上是我们看到真正成为主流的事情之一，因为它变得更容易使用。就像我认识的很多人说，“哦，我对安全一无所知”，但他们用 Signal，我说，“这就对了！（Jay 笑）就像那样，你正在做一件重要的事。”- 如果我能在一个领域推进一下。
[21:53] 所以对我来说，作为那战略的一部分，我们从来没有过真正的战略。美国冷战时的战略是什么？一个词，遏制。抱歉，我是老兵，你知道，对于在军队里的人来说，每个人都知道彼得雷乌斯将军的制胜战略是什么。那就是赢得人心。不同的将军会有不同的战略，比如进入交火并杀人。彼得雷乌斯非常简单。不，我们想赢得人心，或多或少。
[22:26] 这是一个你可以写在一张小纸片上的战略，就这个短语。所以我的战略，自从我读了 1972 和 1979 的那句话，就是可防御的。我们必须让防御者以最大规模和最低成本获得对攻击的最大优势。有时我喜欢反过来讲，谈论可持续的互联网。就像我们希望我们的孙辈拥有一个互联网，拥有比我们今天更清洁的空气和水，我们可以同样思考，对吧？
[23:00] 让我们的孙辈拥有一个至少和我们今天一样棒的互联网。因为我们可能会过于沉迷于对手和其他事情，以至于没有去思考我们想做的所有了不起的事情，以及我们希望后代去做的事情。 - 既然我们在谈论未来，以及我们希望互联网至少能为我们的孙辈、我的孩子们所用，但涌现出了太多新型技术。对于我们将如何使用它、如何监管它，我们才刚刚触及表面。
[23:35] 对于新兴技术，我们应该考虑哪些政策影响？ - 是的，就想想新兴技术吧，因为我知道我关心什么，一个可防御的互联网，其防御要优于进攻，每当我被问及某个新的X、Y或Z时，我总是想，好吧，这会优先帮助防御者还是攻击者？几乎每次我们做任何事情，它都优先帮助了攻击者。攻击者能够比防御者更有效地利用互联网的规模，为我们的行动和我们想做的事情增加规模。
[24:15] 所以每当我被问及量子X、Y或Z之类的东西时，几乎总是，不，那会更多地帮助攻击者。云，绝对是能帮上忙的之一，Beau Woods、Josh Corman，他们很好地讨论了这个问题，最初的互联网从未被设计成安全的。我们给它添加了东西，我们只是给那些打了补丁。现在，当涉及到互联网的安全时，我们已经有了五十年的补丁一路下来。云是那些我们可以从一开始就做对的机会之一，一旦我们让人们为此接受培训。
[24:47] 我们确实必须让更多人接受培训，以便我们能够…… - 有一个明确的思维模式转变，我们需要确保人们不只是把同样的错误、同样的想法带过来。 - 在我们切换之前，我知道我们可能很快会切换到问答环节&，今天早上我们有一个小组讨论，有人问：“你最喜欢的跨性别或女性黑客是谁？”我们有很多很棒的答案，很多你会想到的从Grace Hopper到Katie Mou，到Amelia Koran等人。
[25:19] 我想提一位女性，她的婚后姓名是Hilda Mathieu。有人听说过Hilda Mathieu吗？她在NSA名人堂里，因为Hilda在80年代提出了一个想法，即NSA，这些新的计算机网络给了NSA这种不可思议的能力，可以进行惊人的数字间谍活动。而她在80年代作为一名女性技术工程师就在做这件事。
[25:50] 想想这有多罕见。她就是那个发现，没错，我们可以，这将会很了不起的人，但她也意识到这对美国来说将是一个真正的问题，因为我们极其脆弱。所以他们在1980年代在米德堡就已经理解这一点了。我真正喜欢Hilda的不仅仅是她意识到了这一点，而且她是一位我们从未听说过的真正的先驱女性工程师，还有她结婚前的名字是Faust。
[26:24] 所以在这里，我们有了这个真正的浮士德式交易，既想要NSA两全其美，又想要美国政府两全其美，我们可以黑东西，同时我们仍然可以足够好地保护东西。我们可以黑它，而对手不会看到我们在做什么并决定他们需要复制我们。但对我们在这个房间里的人来说，以及那些每年八月来拉斯维加斯已经30年的人来说，我们可以黑东西，而不必担心结果会怎样。
[27:03] 这是最初的浮士德式交易，（笑）部分归功于像Hilda Faust-Mathieu这样的伟大工程师。 - 没错。所以，我的意思是，我们整个对话一开始你就说我们一直在反复做这件事，什么也没改变。我们现在谈论的是一种可防御性策略。我们将如何改变？我们可以开始说，好吧，这些是我们要做的事情，以便让蓝队比红队更强？
[27:39] - 我想你今天早上从Chris Inglis那里听到了很多，对吧？当我看到那个问题时，所以我们研究了，我们通过哥伦比亚大学的纽约网络特别工作组做了这份报告，我们回过头来说，好吧，在过去五十年里，从最初的密码开始，哪些实际创新在最大规模上和最低成本上产生了最大的影响？我们研究了那些倾向于在企业内部运作的和那些在整个网络空间运作的。
[28:14] 而我提到的大部分东西都在这里的企业技术事物中。所以第一，我们真的想强调那些我们可以以更大规模和最低成本获得的东西。端到端加密、云，我们已经谈过了。我还真的想强调运营创新。当莫里斯蠕虫在1988年袭击早期互联网时，它瘫痪了早期互联网的10%。现在，是的，那只是大约6,000台计算机之类的，但它瘫痪了互联网的10%，因为他们没有任何人在那里事先寻找漏洞并打补丁，而且一旦发生灾难，他们没有任何协调机制。
[28:56] 他们唯一的协调机制就是互联网本身。所以他们发明了计算机应急响应小组。我们不得不发明一个CERT。现在，当然，每个组织都有CERT，它们被认为是环境的一部分。我们不得不发明CISO的角色，首席信息安全官。Vladimir Levin，一个俄罗斯黑客，在1995年从花旗银行拿走了大约$15百万。我们不得不发明CISO。我们不得不发明ISAC。
[29:29] 我曾是FS-ISAC的副主席。我们当年是依据一项总统指令在1999年不得不创立ISAC的。MITRE ATT&CK框架、洛克希德·马丁杀伤链。这些东西，比如杀伤链或网络框架，几乎都是免费的，对吧？它是一种学说。它是一种关于如何做事的理念。想想我们从MITRE ATT&CK框架中获得的所有防御性创新，以及它如何让我们能够大规模地讨论问题，并实施那些真正管用的东西。
[30:04] 所以，当你在思考如何产生最大规模的影响时，这并不全是技术问题。很大程度上是这些运营层面、流程层面、组织层面的创新。实际上，也许就像CISA，对吧，现在正在做JCDC。——是的。——联合网络防御协作组织。——我真正感到震撼的是，CERT、ISAC，甚至MITRE ATT&CK框架，本质上都是协作。就像，好吧，我如何与你合作？我无法独自完成这件事。
[30:35] 我需要让其他人跟我一起。而什么是共同语言？我很喜欢你举的那些例子，因为它某种程度上回到了我们之前所说的，我们需要与社区合作。我们需要与社区互动。——有一位叫Rob Knake的人，他曾在外交关系委员会工作。现在他是国家网络总监办公室的战略副总监。他对此有一个很棒的说法。他称之为家得宝模式。（Fahmida笑）你能做到，政府也能——我们都知道家得宝，那是肯定的。
[31:06] ——你能做到，政府可以提供帮助。因为当我审视如何实现可防御时，这不是通过政府来实现的。我们不会通过设立某个新的政府办公室、在任何国家或每个国家雇佣更多公务员来达到目标。政府可以提供帮助。但真正实现可防御的唯一变革将来自私营部门。而对我来说，对政府而言，就是你必须赋能他们，对吧？想象一下，抱歉用个体育比喻，就说美国棒球，对吧？
[31:37] 场上有九名球员。当年亚历山大将军在米德堡时，他在这里尝试过，嗯，他在黑帽大会上尝试过，对吧？他会到处说：“球打到哪里，我们都能接到。我们在米德堡，我们能完成防守。让政府来做这件事。金融部门，你们做得不错，但让我把传感器放到你们的网络上，这样我们就能为你们收集数据。”但大多数时候，每当球被打出去，都是私营部门中的某个人处于能够完成防守的位置。
[32:09] 现在，他们可能看不到球。他们可能有一个旧的——而政府必须帮助他们看到球。他们可能手套不好，我们可能需要用一些能力来帮助他们。他们可能像我当年在少棒联盟时那样，直到听到球棒击球的清脆声才想起自己在比赛中，他们需要被提醒。另一些人不需要赋能，他们需要鼓励。他们知道这是个问题。他们有这个能力，但他们没有站出来。
[32:41] 而他们的政府有办法提供帮助。不仅是美国政府，还有其他政府。最后，归根结底，可能归结为在已经发生的地方执行，金融部门、能源部门、上市公司。执行已经在许多受监管的行业中发生。我们最早在1998年的总统指令中说过，如果市场不起作用，我们可能需要监管。所以已经过去25年了，也许我们快到了。
[33:11] ——在我们进入观众提问之前，我想提一点：有很多人无法参与国会的事务。他们无法参与FTC的事务。我听到很多律师朋友说，他们的律所要求他们做公益工作，算是回馈——有意思。——回馈社区。从黑客社区的角度来看，这会是什么样子？——这是个很棒的想法，哇。我真的没想过。这是个美好的，我喜欢这个想法。
[33:42] 所以想象一下，Fahmida在这里提出的，对吧？如果你在工作，如果你是某家科技公司的CEO，而你关心这些问题，比如选举安全，或者你担心供水，你知道你当地的供水公司可能不安全。就像律所可能会做公益服务一样，你可能会说：“嘿，你知道吗？我们要去帮助供水公司。我们要免费做这件事，因为我们是科技公司。”
[34:13] 你可以想象，这不仅适用于科技公司的CEO，任何人都可以说：“嘿，我来帮忙。”这是个好主意。——我是说，如果你是一名事件响应人员，去找记者、人权活动人士，说：“嘿，你们想让我们看看吗？”我就觉得我们有太多方式可以运用我们的技能了。——而且，你知道，这与很多公司担心自己的ESG有关，对吧？他们的环境、社会和治理。他们想在做这件事的同时做得好。公司想在自己的ESG上提供帮助，人们会自愿参与。
[34:46] 所以我在一家银行工作过，我们会出去做“仁人家园”活动，或者清理公园，或者参加5公里慈善长跑。为什么不能有技术方面的类似活动呢？说：“不，我们要把我们这群超棒的极客聚在一起，去帮助别人。”比如帮助高风险群体，比如记者，或者罗兴亚人，或者维吾尔人。——去你当地的学校帮助老师。——（笑）去学校帮助老师。是的，把这视为ESG，视为我们应该通过公司去做的公益工作，并为此获得报酬，作为让世界变得更美好的一部分，这是个很棒的想法。
[35:26] 我很喜欢，这是个好主意。——那么，Q&A（问答）的麦克风在你们那里吗？如果你们对Jason有任何问题，请举手——或者对Fahmida。——（笑）我们欢迎在这里提问。我几乎看不清。——有一个。这边有一个。这就是我戴帽子的原因。是的。——那边有人，还有一位穿蓝衣服的先生。——[工作人员] 给你。
[36:02] ——[观众] 我的意思是，这可以追溯到黑客和计算机安全的起源。我们如何仍然应对这个观念：你有什么权利来检查我的门？你知道，如果你走在街区里挨家挨户试别人的门，你会被逮捕的。这与黑客社区中发生的一些事情有类比。我们如何……从法律角度和接受度角度，我们是否仍在努力为这一点辩护？你知道，你算老几来检查我的门？——是的。这是个很好的问题，对于没听到的人，你算老几来检查我的门，对吧？
[36:36] 我的意思是，很多，我认为我们的社区从一开始就有这种想法。你算老几来告诉我不要检查你的门？它是公开可用的，为什么我不能扫描它？我甚至不应该能够进入你的电脑，因为你没有足够好地保护它。这是我们作为黑客的遗产的一部分，也是每年这个时候在拉斯维加斯的一部分，对吧？但也要说我们也关心隐私，我们想这样做。我喜欢Chris Inglis在这里的表述，至少政府是这样看的，说我们都在同一条船上，仅仅因为你那边船漏水，也会影响到我们其他人。
[37:14] 我诚实地对待这件事。我谈到了可持续性，即我们希望我们的孩子和孙辈至少能拥有和我们今天一样好的生活。这导致了各种规范和心态，即放眼全球，立足本地。但也要知道我们所做的事情有外部性，我可以说，好，我有权使用我想用的那么多水，或者我可以拥有我想拥有的那么污染的公司或汽车。但就我个人而言，我说这有点混蛋。
[37:48] 是的，你有权这样做，但你把这一点强加给别人，你让别人的处境更糟。所以我们将不得不更多地思考这对我们有什么影响，好，你那台未打补丁的系统。不仅仅是你被黑了，而是你把这一点强加给别人，因为你会成为DDoS的一部分。Inglis谈到了这种新的社会契约，我们彼此欠什么，我们可以要求什么权利和责任。
[38:18] 但我们欠别人什么相应的责任呢？我认为这是对话中很棒的一部分。我们要真正重新解决这个问题，因为很多时候归根结底就是这个。我们被欠了什么？即使我们有未打补丁的系统，而FBI进去为他们打补丁，就像他们对Cyclops Blink所做的那样，对吧？让我们解决这个问题。我认为这是个很好的问题。——或者ISP基本上说：“我要扫描，我要把你的电脑从网络上移除，因为你有恶意软件。”
[38:52] ——这是个很好的问题，我知道它们不会发生。我记得有一个很好的，是，或者我认为是Arbor Networks做的。他们调查ISP说，哪些，这大概是10年前，ISP你们监控入站攻击吗？大约90%家监控入站攻击。他们说：“你们监控出站攻击吗？”其中一半甚至懒得监控出站攻击，而那些监控的，大约一半对此什么都不做。他们只是看到攻击在出站。
[39:23] 他们说：“不是我的问题。”我们怎么看待这个？我的意思是，这是典型的公地悲剧，他们要么不知道，当时一半的受访者不知道或不在乎他们正在把问题强加给别人。这就是外部性。归根结底，这就是在正常的社会契约中，我们期望政府介入说：“不，你不能通过自己的不作为把这些成本强加给别人。”——是的，我们能问下一个问题吗？——是的。——[观众] 嘿，下午好。
[39:54] 所以我这里有一个可能不太受欢迎的观点，所以这可能会让一些人感到不安，但我认为我们在政策方面有问题的原因之一，而这确实是这次对话的主旨，是很多人关注黑客，也就是在这里的人。但如果你真正看看我们什么时候擅长战略之类的事情，那是来自抵消战略。我们有第一个抵消战略，核武器。我们有第二个抵消战略，ISR。我们尝试过第三个抵消战略，技术。
[40:24] Ash Carter、Bob Work，以及另外几位，Jim Baker，还有另外几位在那栋大楼工作的人，都是这件事的拥护者。然后不知什么原因，它就这么不了了之了，因为某次会议，我们就这么称呼它吧。所以对我来说，我们作为一个国家面临的最大问题——因为我想把这件事扩展到黑客攻击之外，它实际上是关于网络安全以及你如何保护事物——就是我们没有一个明确的抵消战略。而从那里开始，你的作战战术、你的作战行动和你的战术才有着落。
[40:56] 我想问您的是，会不会有朝一日有人站出来说：“别废话了，赶紧醒醒，搞一个抵消战略出来。”完毕。——好，酷。这大概是最后一个问题了，除非你想再提一个，然后我两个一起回答？我不知道我们时间还剩多少——[工作人员] 还有两分钟。——好，你想再提一个问题，然后我们就可以，好。——那么他，那位穿蓝色衣服的先生，——太棒了。你还有问题吗？你没问题？好，然后我想那位穿黑色衣服、挂着橙色挂绳的先生，他是最早举手的人之一。——谢谢，Mike，我们回头再聊。
[41:32] ——[工作人员] 我们还剩两分钟。两分钟，不用急。——[观众]（笑）谢谢。嘿，Jason，一如既往非常精彩的演讲。你之前提到控制有效性，说近50年来，我们并没有真正看到控制有效性有显著进步。我很好奇，特别是从政策角度，我们能否让所有公司都同意改善网络卫生、网络控制、能力和有效性。你会建议如何衡量控制有效性，以及界定“良好”的门槛。
[42:07] ——完美，谢谢。那么，第一个是一个非常美国国防部的战略。这个东西叫第三次抵消。抵消是一种军事战略，意思是说，有哪些事情是美国和盟友做起来超级容易，但对我们的对手来说却非常困难。我实际上把它想成一个加密问题，（笑）对吧？因为加密就在那里。它本意就是让一个方向非常容易，另一个方向非常困难。然后我就把它套用到军事战略上。所以过去几年我们一直在尝试这个，华盛顿的人会说：“网络是我们实施这种抵消战略的一种方式。”
[42:49] 而我完全不知道他们在说什么，因为我们的对手获得进攻性网络能力，和我们一样容易，甚至更容易。对他们来说真正困难的是与私营部门合作。当你回顾我们曾经发生过的几乎每一起重大网络事件，世界上任何地方，几乎总是私营部门拥有敏捷性、专业知识，而且他们深入网络空间，他们能够修复它。政府缺乏这些。所以我们需要做那些俄罗斯人、中国人、伊朗人做不到的事情，就是以我们在西方这样的丰富方式与私营部门合作。
[43:26] 然后关于衡量的问题，最后再说一句，这是个极好的问题。我真正感兴趣的不是逐个控制项地衡量，而是我们如何衡量在互联网的最大规模上，防御是否正在变得比进攻更强。例如，如果我们看到突破时间变短，我们可能就没做好我们的工作。如果我们看到突破时间变长，如果我们看到他们需要更长时间才能进入，这些都是我们可以想象的、如果互联网变得更可防御时会出现的情况。——那可能得留到明年再谈了。
[43:57] ——对，正是。（笑）——Jay，非常感谢你今天加入我们。——谢谢。——也谢谢大家。谢谢你们提出的好问题。——好。（观众鼓掌）谢谢提问。谢谢你们关心政策。保持愤怒。去把烂摊子收拾好。
查看英文原始字幕
[0:00] - We'd like to welcome Jay Healey from the CFP team, and then Fahmida. Welcome to DEF CON. They'll be giving a fireside talk. Please watch your schedules and you'll see the latest information on the Hacker Tracker app. So if you're following which times and rooms you'd like to see, that's the best place to find your updated information. So please give a warm welcome to our panelists. (audience applauding) - [Jay] Fahmida.
[0:33] Yeah. - Thank you for the reminder, Jay. (Jay and Fahmida laugh) Hi, I'm Fahmida Rashid, I'm managing editor of features at Dark Reading, and I am so excited to get a chance to... - [Jay] Yeah, I don't think we have audio for Fahmida? - Or should I just use? Okay. Hi, is this better? There we go. - Yay! - I hear myself now. - Hacking! (Fahmida laughs) - So I'm Fahmida Rashid, I'm the managing editor at Dark Reading, and it is my pleasure to be here at DEF CON to speak with Jay Healey.
[1:09] We're gonna be talking a little bit about the past, present, and the future of info sec, hacking, policy, we're gonna be touching on a lot of different topics. So Jay, thank you so much for joining me today. - Thanks, thanks Fahmida, excited. - Yeah. So I think one of the things that I was hearing is, this is DEF CON 30, but I think you mentioned to me it's also the 50th anniversary of the realization - Yeah. - that hackers will almost always succeed. - Yeah. - So what did that tell you? How did that make you feel?
[1:40] - Yeah, let me push that back on what led to that question. Are we, thank you for those that are giving me the universal sign of, are we doing any better on this one? Okay. - [Staff] Get the mic up to your mouth. - Check one, check two. I was just on this. Check one, check two, test, I'm wearing pants and a shirt. - No, it's not. - Check one, check two. Yes, thank you. We have connected.
[2:12] Great to hear you, or great that you can hear me. So Fahmida's intro, she was talking about how we haven't done as much as we want to as a community. This is DEF CON 30, right? If we look at why a lot of hackers do what we do, right, a lot of it is for curiosity, a lot of it is because we're driven to do so, but a lot of it is to make things better. We're doing this for a purpose, many of us. And I came across this quote that said, "Few, if any, contemporary computer security controls can stop a dedicated red team from easily accessing any information sought."
[2:59] So it's saying the red team is going to get through, right? The hacker is going to get through, the attacker has the advantage. That quote was from 1979. And I found actual quotes that go back to 1972 that say the red team's gonna get through. So, all right. So if we're doing this to try and make things better, it's failing. Using the normal way we go about things. And that's why I'm glad to see everyone here in policy.
[3:30] That's a lot of what we're trying to get done with policy, is to say, all right, the normal things, like hacking things and telling people about it, isn't leading to the success at scale that we wanted, 'cause the attackers, if anything, are just getting better and better. And if you heard, Chris Inglis and others talked about this in this room. And so just think of that, since 1972, right, think about all of the patents, all of the hundreds of billions of dollars, all the worked weekends, all the missed kids' birthdays that we, a community, have done in 50 years.
[4:08] And we haven't changed the most fundamental dynamic, 'cause things aren't better now. - I mean, I'm thinking back, and like you said, it's like all those work weekends, we're thinking, "Hey, what is the purpose of all of this?" So it does get a little bit disheartening. - Yeah, and a lot of the mindset from this community over the last 30 years, I've started, I've been coming since DEF CON 9, I've been on the CFP review board for the last six or seven years, is that if we fuck things up, right?
[4:44] If we hack the planet, it's gonna be better, and it's not working that way. We're hacking stuff and it's not getting better, at least at the speed and scale that we want. If anyone heard Dark Tangent in here this morning, he was talking about how it worked for the Election Village. So we can do better, right? We can make it so that when we break things, it really is gonna lead to better outcomes on the other side. - So, I mean, before we even start figuring out, okay, what are we gonna do differently?
[5:14] Why don't we just kind of go back a little bit. What was the early days of hacking like? I mean, I know some of us have been around, but I know not all of us have been around for that, so what was that like? - Yeah, it's. So I don't have the hacking chops of a lot of the others on the CFP board. I'm there to help out on the policy talks. But it's really interesting to see how DEF CON has been changing as part of that, right?
[5:46] When we started off, you know, the early years at Alexis Park, right? It was about shenanigans. There was cool hacks. There was fucking stuff up and doing cool hacks. One of my buddies, he said to me one morning, "Oh God, how drunk was I last night?" "Oh man, I don't know, like I didn't think you were that drunk. What happened?" "Oh, I found an ATM receipt in my pocket from the Alexis Park." That was considered the height of the stupid thing you could do, is actually using the ATM at the Alexis Park, 'cause it was the most hacked ATM in Las Vegas, and probably the world, and DEF CON was absolutely 100% a hacking conference for hackers.
[6:32] And it still substantially is now, but if anyone heard Jeff here today, I'm sorry, Dark Tangent, especially after Snowden and after Stuxnet, DT disinvited feds coming to the conference. He said, "You are no longer welcome in our conference. We need some time away." And that was around DEF CON, anyone remember that? That was around DEF CON 22? - 22. - Something like that?
[7:05] And just look at how different it is today, right? Not only have we repaired that rift for now, but Jeff has said, DT has said, we need to do better. We're not making a difference as a community of hackers just on our own, but we need to better integrate with the policy makers, not just in the United States, but across the world, so we have an actual policy track to try and make more difference. This is still a hacker conference, but I think you're seeing that commitment at DT that we need to start doing better.
[7:37] We need to start getting defense better than offense. - I think that's actually the more positive aspect that we've seen. Like hackers have always been a little bit on the outskirts, a little bit doing their own thing. But now with policy involvement, we're seeing a little bit more, not necessarily mainstream, but the idea that our ideas matter. So what have you seen in the past few years where you were seeing these kind of solicitation of ideas from the hacker community?
[8:09] - Yeah, and first I have to say, I'm speaking in my personal capacity right now, not with any of my affiliations. And we're starting to see a lot more ways that hackers can get involved. Just that you're here, that we have a policy track here. We heard some great ideas this morning. We had a panel and a lot of folks that are involved in the Policy Village, and some really great ideas came outta that. We heard from Mosfet, who's a fabulous hacker, and she went to Congress.
[8:40] She was part of TechCongress fellow that went to help members of Congress and their staff learn to do better, to have better laws. We had Monica Ruiz here, who was helping out, I think, something called Digital Peace Now, which is a global youth movement to say we're tired of nation states hacking, and everybody else having to pay the penalty, and so what can we do to try and to help make governments more responsible?
[9:14] And they're really well meaning. Is anyone with Digital Peace Now? Anyone signed up to Digital Peace Now? Super well meaning, but they don't understand the tech as well as they might. And so if that sounds like it's something that's of interest to you, they can really use your help in whatever country you're in. Like checking with your city council. There are people there that need your help as a hacker to say, "Good, yes, I need help. I need some advice on how we can do better." Whether that's at your village, your city, your state, your region, whatever those are.
[9:49] We had Jack Cable here this morning who was around, he got involved in Hack the Pentagon, the first bug bounty program against the Department of Defense. That's how he got his start, was finding these bugs in the Pentagon, and then moving on, and then he switched to a job in government to help do things like improve election security in the United States. And he did that 'cause he got in through the front door, in just doing a bug bounty program. So that's a U.S. example, but we're starting to see these "hack the blank" come up in all sorts of country.
[10:27] And the last one I'll mention is the United States Government, as well as other governments, when they're coming out with a new rule, they'll ask for input. So we heard this morning, Harley, who's a former congressional staffer, said, "Look, the FTC is coming out with a new rulemaking on what cybersecurity should be to help protect consumers." That so fits into the kinds of things that we're doing. And rulemaking, it sounds boring, but it's how big things change over time.
[10:59] Not just in the United States, but in other places. So whatever your context is, however it is that's interesting to you, take a look at these things, right? Beau Woods runs I Am the Cavalry with Josh Corman and others. And so take a look at I Am the Calvary. They did this probably, what, how long is it? Six years, maybe? Seven years? - A little bit longer. I mean, - Yeah. - they were around for at least four or five years before all the stuff locked down. - Oh wow, okay.
[11:29] And the message from I Am the Calvary is we can't just hack stuff and wait for someone else to own the responsibility of it. That if you hack something, you're responsible for the result, whether it gets fixed or not. So the name came from the cavalry's not coming, right? There are no adults that are going to come by and say, "Thank you for calling our attention to that. We got it from here." It is not gonna happen. Or at least it hasn't been happening.
[12:00] We're trying to do better. So this whole movement of I Am the Cavalry was to help hackers own up to that moment of good. How can we do better? How can we own the results? Not just for fucking things, but for unfucking them as well, and making sure that they stay unfucked. Technical term. - I think that's actually, when we were talking about all of this and as you were saying this, I'm thinking that is the biggest difference, I think, the early days of hacking and now, there's a little bit of accountability.
[12:31] The hackers are like, yeah, I'm doing all this cool stuff, but let me tell you how to fix it. Or even if I don't know how to fix it, give me someone who can sit down with me and fix it. And that level of accountability is, I think, one of the more positive aspects of what we've done. - I had a real tough moment after, it was probably around DEF CON 22, 'cause anyone, anyone involved with NSA tool set and the folks that would come in doing the talks on NSA tool set? Not if you were actually doing NSA tool set, don't put up your hand.
[13:01] And it was after Snowden revelations, and it was a set of fabulous security researchers that said, "We wanna make... We wanna look at the stuff that Snowden revealed about what NSA was doing, and we wanna make it so easy," this was their words, "that a 10 year old girl could do it." Not sure why they had to gender that, but. And they were doing that for privacy. So their goal, I remember I was saying, they were hacking GSM encryption and they wanted to make hacking GSM so easy, and they were gonna do that for privacy.
[13:32] And I had real difficulty wrapping my head around that. It was a great talk. It was a great goal. But how long, especially back then, that process of we break things and then it will get fixed, it's not a direct causal relationship. Sorry, I'm an academic now. That's what we talk about, causal relationships. If you do something, are you expecting that it's actually gonna, what result does it actually get to? And so that's why I think we've done a lot better now in the community, of looking at that causal relationship.
[14:05] "Good, all right, if we break it, let's make sure it gets fixed." - And it's even just the fact that we have more of a structure, so that even if I can't make that, or I don't know who to, I now have sources to go to, we have bug bounty programs where they will say, "I'll help you make that connection." So I think we have more of an infrastructural support. - And I think the media, and I think the journalists are doing better too, right? - Thank you. - Yes. And if folks heard Jeff at DEF CON, I'm sorry, Black Hat, yesterday, introducing Kim Zetter, about how in the early days the journalists would just buzz in and buzz out and talk about the crazy hair and use the community for their purposes.
[14:50] Now you've got Dark Reading, you've got Kim Zetter, you've got so many other great journalists that are embedded in the community like yourself, deep tech chops in application security, and so help us to tell better stories, so that we get better change on the other side. - The one thing I wanted to actually touch upon, and you kind of hinted at it, I think a lot of the time when people hear, oh, hacking and policy, is, well, I'm not gonna run for office.
[15:22] I'm not a lawyer, so I don't know the laws. So you mentioned how working with the city council and stuff. How do you even start that language? How do you even get the folks in this room who are curious to understand that you don't need to be a legal expert to be involved in policies? - Right, they do that, right? They understand the legal side. They're curious about what you know, and so just have the conversation, right? I mean, for whatever level's comfortable for you, whatever path that you have is gonna be good.
[15:53] There's check out the stack for TechCongress and I Am the Cavalry. There's a lot of good material on this. If you've been out to BSides. BSides Las Vegas is usually a place where a lot of these folks are. If you go down to the policy track, look for Beau Woods, he's got the, he's got the, I think the hair's blue today? - I think so. - And just ask around there. There'll be a lot of folks that can help, not just have general ideas, but have been through it and helped others for whatever context you're bringing with.
[16:25] Just some other tips is one, trying at least, it's gonna take you a while to speak the language, but be forgiving of the language, right? Folks in policy, we say cyber a lot. If you can't forgive us that, (laughs) it's gonna have difficulty. If you wanna be understood, you have to help meet people halfway in how they talk about things. So on the policy side, attribution matters a lot to us, because at the end of the day, it's about what nation is responsible.
[16:55] I worked at the White House for a couple of years, right? I didn't care about attribution. I cared about national responsibility. At the end of the day, the president is gonna have to pick up the phone and he's gonna have to call some prime minister, some president and say, "Knock it off or there's gonna be consequences." That's not attribution. So that stuff matters at places like the White House and Congress or in your national equivalence. So again, if you can't get past the fact that, no, attribution's stupid, in your full Threatbutt and Attribution Dice, like that stuff's funny, and it might not matter much in your context, but it definitely matters when you're thinking about for some aspects of this national security policy.
[17:40] But definitely be yourself, right? If you're angry and you're pissed off, don't lose that. (laughs) Stay angry and stay pissed off. Just, let's keep it channeled and stay energized. - Yeah, I think we have a big problem sometimes when you get angry, when you are just annoyed, you're frustrated, you think, "Hey, nothing's ever gonna change," that we tend to get a little insular. So I think this track is the perfect way of explaining, don't become insular. - And within the course of one year, this was right around 2011, 2012, I had Jeff Moss, Dmitri Alperovitch, Richard Bejtlich, and others say we can't, we're frustrated 'cause we're not making the difference that we wanted to have through technology, but we don't know how to make this happen on policy.
[18:29] I was working for a think tank at the time, the Atlantic Council, sorry. So a lot of folks have been down this road of saying, I need to do differently, I need to figure out other ways to get my voice heard and to bring my knowledge and skills to bear. So this is well trod path. - We're talking a lot about how we are doing things differently now, but if you can even give me one example of something that we are doing better.
[19:00] I don't wanna be just doom and gloom saying we haven't done anything better. - So I consider myself a strategy person, right? It's been a long time since my fingers were on a keyboard in any meaningful way, or that'd be meaningful to y'all, remember the way I said it was went back to 1972, we're 50 years in where we haven't been having the effect that we want. And I was reading a news article maybe five years ago in "The Economist." And they looked at climate change and they said, "What have been the interventions that we have done as a species that's taken the most carbon dioxide equivalent outta the atmosphere?"
[19:40] And they rated them like 1 through 30. And they said, "As far as we can tell, no chuckleheads have ever asked the question in that way before." Here it is, one of the most compelling issues faced by humanity, and no one had ever said, "What have we done that's made the biggest difference at the largest scale and the least cost?" And so I had an epiphany of, (mimics explosion) so what is it that we as a community have done, that's given the defender the greatest advantage over attackers at the larger scale and the least cost?
[20:15] And let's do more of that. The number, any guesses, just shout out, the number one thing that we think we've done at scale and cost as a community? Windows Update, yeah, who said Windows Update? Absolutely. Because instead of doing something that only affects a single enterprise, we could come up with the most perfect widget and it gets all the VC money 'cause it is the most brilliant thing. We still have to buy a billion of them.
[20:46] We've gotta integrate it into the enterprise or our home networks. We have to monitor it. We have to keep it up to date. We have to train people to use the widget. We have to get it to integrate with all the goddamn other tools that we have and do that a billion times. Things like Windows Update, cloud, end-to-end encryption, you do it once and a billion devices or people can take advantage of it. This is why, especially a lot of us on policy are so upset over government folks looking to break end-to-end encryption.
[21:22] It's one of the few things that aids the defenders at scale, easily, if it's implemented right. It's really one of the few things that you can get it and it really makes it hard for adversaries. - And it's actually one of those things that we've seen really become mainstream, because it's become easier to use. Like the number of people I know who say, "Oh, I know nothing about security," and they use Signal, and I'm saying, "There you go! (Jay laughs) Like that right there is an important thing you're doing." - And if I could push on one area.
[21:53] So for me as some of that strategy, we've never had a real strategy. What was the U.S. strategy for the Cold War? It's a single word, containment. Sorry, I'm a veteran, you know, for folks that were in the military, everybody knew what General Petraeus's strategy was for winning. It was win hearts and minds. A different general would have a different strategy, like get in firefights and kill people. Petraeus was very simple. No, we wanna win hearts and minds, more or less.
[22:26] It's a strategy that you can fit on a single small sheet of paper, in this phrase. So mine, since I read that quote from 1972 and 1979, was defensible. We've gotta get defender most advantage over the attack at the largest scale and least cost. Sometimes I like to flip it around and talk about a sustainable internet. Just like we want our grandkids to have an internet, to have clean air and clean water, better than we have today, we can think about the same, right?
[23:00] Let's have our grandkids where they have an internet that's at least as awesome as the one that we have today. 'cause we can get so caught up in adversaries and the rest that we're not thinking about all the amazing things that we wanna do, and we want future generations to do. - Since we are talking about the future, and how we want the internet to be at least available for our grandkids, my children, but there's so many new types of technologies that's coming on. We are barely scratching the surface on understanding how we're gonna use it, how we're gonna regulate it.
[23:35] What are the policy implications that we should be thinking about with emerging tech? - Yeah, just think about, on emerging, because I know what I care about, a defensible internet that has defense better than offense, anytime I get asked about a new X, Y or Z, I always think about, all right, is this gonna preferentially aid the defender or the attacker? It, almost every time we've done anything, it's preferentially aided the attacker. That the attackers have been able to use the scale of the internet more effectively than the defenders have, to add scale to our operations and what we want to do.
[24:15] So anytime I get asked like quantum X, Y, or Z, or the rest, it's almost always, no, that's gonna help attackers more. Cloud, one of those that can definitely help, Beau Woods, Josh Corman, helped talk about it really well, that the original internet was never designed to be secure. We added things to it, and we just slapped Band-Aids on those. And now we've got five decades of Band-Aids all the way down when it comes to the security for the internet. Cloud is one of those opportunities that we can get it right from the start, once we get people trained for it.
[24:47] We really do have to have people more trained so that we're able to... - There's a definite mindset change that we need to make sure that people are not just bringing the same mistake, same ideas forward. - And before we switch, I know we're gonna probably switch to Q&A soon, we had a panel this morning and someone asked, "Who is your favorite trans or female hacker?" And we had a lot of great answers, a lot you'd expect from Grace Hopper to Katie Mou, to Amelia Koran and others.
[25:19] I wanna raise a woman named, her married name was Hilda Mathieu. Anyone heard of Hilda Mathieu? She's on the NSA Hall of Fame, because Hilda came up with the idea, back in the 80s, that NSA, that these new computer networks gave NSA this incredible ability to do amazing digital espionage. And she was doing this as a female technical engineer in the 80s.
[25:50] Just think of how rare that is. And she was the one that figured out, yep, we can, this is gonna be amazing, but she also realized this is gonna be a real problem for the United States, because we're incredibly vulnerable. So they were already understanding that at Fort Meade, in the 1980s. And what I really like about Hilda isn't just that she realized this and she was this real pioneering female engineer whom we've never heard about, but also her name before she got married was Faust.
[26:24] So here we've got this actual real Faustian bargain of wanting to both, NSA to have it both ways, and the U.S. Government to have it both ways, that we can hack shit and we can still secure things well enough. That we can hack it and the adversaries aren't gonna see what we're doing and decide they need to copy us. But also for us here in this room, and the people that have been coming to Vegas every August for 30 years, that we can hack shit and we don't have to worry about how it's going to turn out.
[27:03] It's the original Faustian bargain, (laughs) in part thanks to great engineers like Hilda Faust-Mathieu. - Exactly. So, I mean, we started off all of this conversation with you saying that we've been doing this over and over again, and nothing has changed. We are now talking about a strategy of defensibility. How are we going to change? What are the things that we can start saying, okay, these are the things we're gonna do so that we can get blue team better than the red?
[27:39] - I think you heard a lot of it here from Chris Inglis this morning, right? When I look at that question, so we've looked at, we did this report through the New York Cyber Task Force out of Columbia University, and we went back and we said, okay, what have been the actual innovations that have made the biggest difference at the largest scale and least cost over the last five decades, going back to the original passwords? And we looked at those that tend to operate inside the enterprise and those that operate across cyberspace as a whole.
[28:14] And the vast bulk of things I mentioned were up here in the technical things in the enterprise. So one, we really wanted to emphasize those things that we can get with the larger scale and the least cost. End-to-end encryption, cloud, we've already talked about. I also really want to emphasize the operational innovations. When the Morris Worm hit the early internet in 1988, it took down 10% of the early internet. Now, yeah, that was only like 6,000 computers or something like that, but it took down 10% of the internet, because they didn't have anybody that was there to look for vulnerabilities and patch them beforehand, and they didn't have any coordination mechanism once there was a disaster.
[28:56] The only coordination mechanism they had was the internet itself. So they invented a computer emergency response team. We had to invent a CERT. And now, of course, everybody has a CERT, they're considered part of the environment. We had to invent the role of a CISO, chief information security officer. Vladimir Levin, a Russian hacker, took Citibank for $15 million or so in 1995. And we had to invent a CISO. We had to invent a ISAC.
[29:29] I used to be the vice chairman of the FS-ISAC. We had to invent ISACs in 1999 by a presidential directive. The MITRE ATT&CK framework, Lockheed Martin Kill Chain. This stuff is, like the kill chain or the cyber framework, like, it's almost free, right? It's a doctrine. It's an idea about how you do things. And just think about all the defensive innovations that we've gotten from the MITRE ATT&CK framework, and how it's allowed us to talk about things at scale and implement things that sticks in taxi.
[30:04] So as you're thinking about how we can have the most impact at scale, it's not all about technology. It's a lot of these operational, these process, the organizational innovations. Actually, maybe like CISA, right, is now doing JCDC. - Yeah. - The Joint Cyber Defense Collaborative. - I mean, the thing that really strikes me about the CERT, ISAC, even the MITRE ATT&CK framework, it's actually fundamentally collaboration. It's like, okay, how do I work with you? I can't do this alone.
[30:35] I need to get other people with me. And what is the shared language? And I love the examples you gave, because it kind of goes back to what we were saying earlier, that we need to be working with the community. We need to be engaging with the community. - There there's a guy named Rob Knake who had been with the Council on Foreign Relations. Now he's the deputy for strategy at the Office of the National Cyber Director. And he had a great phrase to it. He called it the Home Depot model. (Fahmida laughs) You can do it, government can, - We all know the Home Depot, that's for sure.
[31:06] - You can do it, government can help. 'Cause when I looked at, how do you get defensible? It's not through government. We're not gonna get there by creating some new government office and hiring more civil servants in any country or in every country. It can help. But it's, the only real change to get defensible is gonna happen through the private sector. And that for the government, for me, is you have to enable them, right? Imagine, sorry to use a sports analogy, say it's American baseball, right?
[31:37] You've got nine players on the field. What we had with General Alexander when he was at Fort Meade, and he tried this here, well he tried it at Black Hat, right? He would run around and say, "Wherever the ball was hit, we got it. We at Fort Meade, we can make the play. Let government do this. Finance sector, y'all are doing a good job, but let me put my sensors on your network so we can collect it for you." But most of the time, whenever the balls hit, it's someone in the private sector that's in the position to make the play.
[32:09] Now, they might not be able to see the ball. They might have an old, and the government has to help them to see the ball. They might have a bad glove, and we might need to help them with some capability. They might be like me when I was in Little League, and they might forget they're in the game until they hear the crack of the ball on the bat, and they need to be reminded. Others don't need the enablement, they need encouragement. They know it's a problem. They've got the capability, but they're not stepping up.
[32:41] And their government has ways that can help. Not just U.S. Government, but others. And last is, at the end of the day, it might come down to enforcing where it already happens, the finance sector, energy sector, publicly traded companies. The enforcing is already happening in lots of regulated industries. And we first said in 1998, presidential directives that said that if the market doesn't work, we might need to regulate. And so it's been 25 years, so maybe we're getting close.
[33:11] - So one thing I wanna touch upon before we go to the audience questions is that there are a lot of people who can't get involved with Congress. They can't get involved with FTC. And I've been hearing a lot of friends who are lawyers, they talk about how they're required by their law firm to do pro bono work, kind of give back - Interesting. - to the community. What would that look like from a hacker community? - It's a great, wow. I hadn't really thought about it. It's a lovely, I love that idea.
[33:42] So imagine, for what Fahmida's raising here, right? If you're working, if you're a CEO of a tech company, and you care about these issues, say election security, or you're worried about the water, you know that your local water utility is probably insecure. Just like a law firm might do pro bono, you're saying that you might say, "Hey, you know what? We're gonna go and we're gonna help out the water utility. And we're gonna do that pro bono, 'cause we're a tech company."
[34:13] And you can imagine that working even not just for the CEO of a tech company, but it's anybody just saying, "Hey, I'm here to help." That's a great idea. - I mean, if you're an incident responder going up to, you know, hey journalists, human rights activists, and being like, "Hey, do you want us to take a look?" I just feel like there's so many ways we can use our skills. - And, you know, and it ties into a lot of corporations are worried about their ESG, right? Their environmental, social, and governance. And they wanna do well doing that. And companies wanna help on their ESG, and people will volunteer.
[34:46] So I worked for a bank, and we would go out and we would do Habitat for Humanity, or we'd clean a park, or we would go on a 5k fund run. Why shouldn't there be a tech aspect of that? And saying, "No, we're gonna get our awesome set of nerds together, and we're gonna go help people." Like a at risk community, like journalists, or Rohingya, or Uighurs. - Go to your local school and help your teachers. - (laughs) Go to school and help teachers. Yeah, it's a great idea to think about that as ESG, to think about that as pro bono work that we should do through our companies and get paid for it as part of making the world a better place.
[35:26] I love it, it's a great idea. - So there's, you have the microphone for the Q&A? So if you have any questions for Jason, please raise your hand, - Or Fahmida. - (laughs) and we welcome any questions here. I can barely see. - Got one. We have one over here. That's why I wear a hat. Yeah. - There's someone over there, and then a gentleman in blue. - [Staff] There you go.
[36:02] - [Audience Member] I mean, this kind of goes way back to the beginning of hacking and computer security. How do we still address the idea of what right do you have to check my doors? You know, if you walk down the neighborhood trying everybody's door, you're gonna get arrested. And there's that analogy to some of what's happening in the hacker community. How do we... Are we still struggling to justify that from a legal perspective and from an acceptance perspective? You know, who are you to check my doors? - Yeah. It's a great, and for those that didn't hear, who are you to check my doors, right?
[36:36] I mean, a lot of, and I think our communities had this from the very beginning. Who are you to tell me not to check your door? It's publicly available, why shouldn't I be able to scan it? I shouldn't even be able to get into your computer because you didn't protect it well enough. That's part of our legacy of being hackers and being in Vegas in this time of year, right? But also saying we also care about privacy and we want to do that. I liked how Chris Inglis put it together up here in that, at least how the government was seeing it, and saying we're all in it together, and just because your side of the boat has a leak, that's affecting the rest of us.
[37:14] And I honestly approached this. I talked about sustainability of how we want our kids and grandkids to have at least as good as we have today. And that's led to all sorts of norms and mindsets to think globally, act locally. But also knowing that the things that we do have externalities and that I can say, good, I have a right to use as much water I want, or I can have as polluting a company or car as I want. But the way I, speaking personally, I say it's kind of a dick move.
[37:48] Like yeah, you've got the right to do it, but you are imposing that on others, and you're making the situation worse for others. And so we are gonna have to think more about how that affects us, that good, your unpatched system. It's not just you getting hacked, but you're imposing that on others because you're gonna be part of a DDoS. And Inglis talks about this new social contract and what it is that we owe each other, what rights and responsibilities we can demand.
[38:18] But what are the concomitant responsibilities that we owe others? And I think it's a great part of that conversation. And for us to really address that afresh, 'cause that's what it's coming down to a lot. What are we owed? Even if we're having unpatched systems versus, you know, FBI going in and patching systems for them like they did for Cyclops Blink, right? Let's address it. I think it's a great question. - Or the, ISP basically saying, "I'm gonna scan and I'm gonna take your computer off the network because you have malware."
[38:52] - And it's a great, and I know they won't happen. I remember there's a great, it was a, or I think it was Arbor Networks did this. And they looked at ISPs of saying, which, and this maybe 10 years ago, ISPs do you monitor for inbound attacks? And like 90% looked for inbound attacks. And they said, "Do you monitor for outbound attacks?" And half of them didn't even bother to monitor for outbound attacks, and those that did, something like half of them did nothing about it. They would just see the attacks going outbound.
[39:23] They said, "Not my problem." What do we think about that? Is that, I mean, that's classic tragedy of the commons, that they either don't, half of the respondents back then didn't know or didn't care that they were imposing problems on others. That's externalities. And at the end of the day, that's where, in the normal social contract, we expect the government to come in and say, "No, you can't impose these costs on others through your own inaction." - Yeah, can we get the next question? - Yeah. - [Audience Member] Hey, good afternoon.
[39:54] So I have kind of an unpopular opinion here, so this might be agitating to some people, but I think one of the reasons why we have issues with policy , and that's really what the gist of this conversation was, is that a lot of people focus on the hackers, so people that are here. But if you actually look at when we actually were good at things like strategy, it was from offset strategies. We had a first offset strategy, nuclear. We had a second offset strategy, ISR. We tried getting a third offset strategy of technology.
[40:24] Ash Carter, Bob Work, and a few other people, Jim Baker, and a few other people that worked at the building were champions of this. And then it fell on its feet for whatever reason, because of a session, we'll just call it. So to me, the biggest problem that we have as a nation, 'cause I wanna take this beyond just the hacking, it's really about cybersecurity and how do you secure things. It's that we do not have a defined offset strategy. And from there that's where your operational tactic, your operations go and your tactics go.
[40:56] My question to you is will there ever be somebody that says "No shit, wake the fuck up and get an offset strategy." Over. - Yeah, cool. And this is probably gonna be the last question, unless you want to take one more and then I answer both? I don't know how we're doing on time - [Staff] Two minutes. - Yeah, you wanna take one more of the question and then we can, yeah. - So he had, the gentleman in the blue, - Awesome. do you still have a question? You're fine? Okay, and then I think the gentleman in the black with the orange lanyard, he was one of the first people to have his hands up. - Thanks, Mike, we'll catch up.
[41:32] - [Staff] We have two minutes left. Two minutes, no rush. - [Audience Member] (laughs) Thanks. Hey, Jason, very good talk as always. You referenced earlier about control effectiveness, that for nearly 50 years, we haven't really seen significant advancement in control effectiveness. I was curious if, especially from a policy standpoint, we can get firms to all agree to improve cyber hygiene, cyber control, capabilities, and effectiveness. How would you suggest measuring control effectiveness and thresholds for essentially defining good.
[42:07] - Perfect, thanks. So first, the first one is a very U.S. Department of Defense strategy. This thing's called the third offsets. And the offsets were a military strategy to say, what are the things that the United States and allies, that are super easy for the United States and our allies to do, but are really hard for our adversaries. I actually thought of it as an encryption problem, (laughs) right? 'Cause encryption is there. It's meant to be really easy one way and really difficult the other way. And it just took that to military strategy. And so we were trying this over the last couple years and people in D.C. would say, "Cyber is a way that we're gonna do this offset strategy."
[42:49] And I had no idea what they were talking about, 'cause it is just as easy, if not easier, for our adversaries to have offensive cyber capabilities as it is for us. What's really hard for them is to work with the private sector. When you look back at almost every major cyber incident that we've ever had, anywhere in the world, it's almost always the private sector that has the agility, the subject matter expertise, and they have their hands deep in cyberspace, and they can fix it. Governments lack that. So we need to do those things that the Russians, the Chinese, the Iranians can't do, is work with the private sector in the rich way that we do in the West.
[43:26] And then to close out on the measurement, it's a fabulous question. I'm really interested, not on a measuring control by control, but how do we measure if defense is getting better than offense at the largest scale of the internet? For example, if we're seeing shorter breakout times, we're probably not doing our job. If we see longer breakout times, if we see them taking longer to get in, those are all the sorts of things that we might imagine if the internet's getting more defensible. - That might have to be a conversation next year.
[43:57] - Yeah, exactly. (laughs) - Jay, thank you so much for joining us today. - Thank you. - And thank you everyone. Thank you for your good questions. - Yep. (audience applauds) Thanks for the questions. Thanks for caring about policy. Stay angry. Go unfuck things.
在Vidleaf工作台中打开
搜索转录文本，选择行，复制带时间戳的引文，翻译。
署名
“DEF CON 30 - 与 Jay Healey 的政策炉边谈话”，作者 DEFCONConference（https://www.youtube.com/@defconconference），依据 CC BY 3.0 许可（https://creativecommons.org/licenses/by/3.0/）。源视频：https://www.youtube.com/watch?v=D_wPMLhXC1w。本页是视频的文本转录，添加了段落分隔和时间戳；创作者与 Vidleaf 无关联，也不为其背书。Vidleaf 添加了 AI 标点和 AI 生成的摘要；原始措辞仍可在本页查看。
您是创作者或权利持有人吗？请求更正或移除：copyright@vidleaf.app（参见关于这些页面）。
最后更新于