Static security models and "business as usual" directives have naturally resulted in a collective eyes wide shut mentality of organizational entropy. Organisms, as well as organizations, can only adapt to changing environments by leaving (or being forced from) their comfort zones. It should be obvious that today's threat landscape is changing at a breakneck pace, yet most organizations are seemingly content in adding "spend" to the annual budget for more systems that claim to protect against the latest FUD. This is not learning and without learning adaptation cannot occur. Challenges to the organism and organization that move them both out of their respective comfort zones are crucial for successful adaptation. This talk will explore these adaptation requirements in an effort to develop a framework for more naturally secure systems and organizations. At its conclusion it will present a challenge for all those willing to get out of their own respective comfort zones and organically contribute to naturally stronger systems and organizations.

1. The Challenge of Natural Security
Systems
Rockie Brockway
Information Security and Business Risk
Director
Black Box Network Services
@rockiebrockway

2. Credentials

4. Disclaimer A
Nothing I say represents past, current or future employers

5. Disclaimer B
Not a box popper talk
Not a cool tool talk
This is NOT about Darwinian Evolution vs Religion
Arguments are expected
Focused on natural security systems

6. Generic Problems with InfoSec
It is viewed as a tactical IT function (Reactive)
It is usually not, but needs to be accepted as a business risk
management function (Rational)
“Rational behavior requires theory. Reactive behavior requires only reflex action.”
- W. Edwards Deming
http://www.fiercecio.com/story/w-edwards-deming-hates-your-approach-it-security/2013-08-19

7. InfoSec’s Role
Prevent the loss of Business critical data
Protect the Brand
Promote Innovation/Allow the Business to TAKE Risk
What is the organization’s Business critical data?
Who else might find value in that data?
Where does that data actually live?
What are the Business initiatives and goals?
InfoSec’s Problems

8. <FUD> Insert standard sky is falling breach statistic slide here </FUD>

9. Organization/Business Reaction?
Irony – Big Business arrogance and the natural reaction to their entropy
has fueled a larger Big Business of product “solutions”
Buy more blinky lights (apologies to our sponsors)
Hackback?
Legislation/Balkanization
If you get to the point where a problem becomes so big that you
need to try to legislate it in order to protect national and/or
economic interests, you have completely missed what was wrong
to begin with. #FAIL

10. What problem(s) does this talk address and attempt to Solve?

11. What problem(s) does this talk address and attempt to Solve?
IT/InfoSec spend increasing, breaches continue to increase
As an Industry we are most likely at least two years behind the innovative and
lucrative industry of stealing the data we are trying to protect
Gartner Verizon DBIR
0
200
400
600
800
1000
1200
1400
1600
2008 2009 2010 2011 2012 2013
Breaches
2.9
3
3.1
3.2
3.3
3.4
3.5
3.6
3.7
2007 2008 2009 2010 2011 2012 2013
Spend (T)

12. What problem(s) does this talk address and attempt to Solve?
IT/InfoSec spend increasing, breaches continue to increase
Our obsession with static models (e.g. The Problem with Walls)

13. Our obsession with static models (e.g. The Problem with Walls)
So what is commonplace throughout most organizations reactionary,
static take on security? < cheap “fixes”
Dikes, levees, firewalls - all examples static security incident reactions
intended to protect against naturally dynamic threats. That eventually
fail.

14. What problem(s) does this talk address and attempt to Solve?
IT/InfoSec spend increasing, breaches continue to increase
Our obsession with static models (e.g. The Problem with Walls)
Organizational Entropy

15. Organizational Entropy
(the natural result of assuming you are smarter than your adversaries)

16. What problem(s) does this talk address and attempt to Solve?
IT/InfoSec spend increasing, breaches continue to increase
Our obsession with static models (e.g. The Problem with Walls)
Organizational Entropy
The current Unnatural state of our business organizations

17. The current Unnatural state of our business organizations
The longer we accept these unnatural systems that our reactive
policies have dictated, the larger the window exists for our
adversaries to catch up and surpass us.
“Business as Usual”
Organizational learning and adaptation is stagnant at best

18. What problem(s) does this talk address and attempt to Solve?
IT/InfoSec spend increasing, breaches continue to increase
Our obsession with static models (e.g. The Problem with Walls)
Organizational Entropy
The current Unnatural state of our business organizations
Can we modify our organizations’ static, reactionary behavior without blatantly telling
our CEOs and board members that they are conducting business wrong?

20. Posit -
Naturally adaptive systems are inherently more secure

21. Inspirations/Sources

22. General “Rules of Engagement” for Naturally Adaptable Systems *
* http://www.security-informatics.com/content/1/1/14
They are organized semi-autonomously with little central control
They learn from success
They use information to mitigate uncertainty
They extend their natural adaptability by engaging in a diverse
range of symbiotic partnerships

23. 1st Point
Adaptation arises from leaving (or being forced from) your comfort zone.
Adding more expensive anti-X/APT/FUD systems is not adapting

24. Details of Successful Adaptation Techniques (Sagarin)
Decentralized and Distributed organizational systems

25. Decentralized and Distributed organizational systems
The benefits of Decentralized and Distributed organizational systems
Multiple sensors
No preconceived notions
Specialized tasks
Redundancy

26. Details of Successful Adaptation Techniques (Sagarin)
Decentralized and Distributed organizational systems
The Requirement of a Challenge ( Important/2nd point)

27. The Requirement of a Challenge
There must be some sort of challenge to initiate competition, cooperation
and learning (more on this later)
Finding food/shelter
Finding a lost nuclear submarine
Predicting the outcome of a presidential election
Protecting business critical data

28. Details of Successful Adaptation Techniques (Sagarin)
Decentralized and Distributed organizational systems
The Requirement of a Challenge
Information sharing, filtering and prioritization

29. Information sharing, filtering and prioritization
Information use and sharing is as essential to survival as any other
adaptation
When used properly, information in survival situations creates and/or
reduces uncertainty
Organisms seek to reduce uncertainty for themselves and increase
uncertainty for their adversaries (unpredictability).

30. Details of Successful Adaptation Techniques (Sagarin)
Decentralized and Distributed organizational systems
The Requirement of a Challenge
Information sharing, filtering and prioritization
Symbiosis

31. Symbiosis
Symbiosis - A working relationship between organisms
Mutualistic - both parties benefit
Commensual - one party benefits, one is not affected
Parasitic - one party benefits, one suffers
Symbiosis creates reactions that are more than just the sum of two
organisms working together - emergent properties that both transform
the organism and transforms the environment around the organism

32. Details of Successful Adaptation Techniques (Sagarin)
Decentralized and Distributed organizational systems
The requirement of a Challenge
Information sharing, filtering and prioritization
Symbiosis

33. Competition and Cooperation (3rd point)
Competition between organisms can lead to group cooperation
This group competition can then lead to group cooperation
Group cooperation then increases the effectiveness of the group against
other social groups

34. The Quandary
Successful organizational leadership has little incentive to change
Therefore, business as usual comfort zones will prevent true
adaptation
Incentivized adversarial innovation will continue to run away from
our static, artificial barriers that we hope might prolong the
inevitable
How can we build more naturally secured systems in this
environment?

35. Aren’t we human beings somewhat good at adaptation?

36. The Big Contradiction
Yes! We humans are quite adaptable.
Yet we rarely leave our comfort zones unless we find ourselves in an
emergency situation (BREACH) and then we once again show our amazing
adaptability – The problem with Business as Usual
Organizations = Organisms, e.g. self regulating, not static
How can we as amazingly adaptable individual organisms have created
systems and institutions so non-adaptable?

37. The Challenge
How do we end up with systems within organizations that can deal
with security problems and respond to them organically and
automatically?

38. The Basics (getting outside your comfort zone)
Introduce challenges, not directives. Without challenges, organizations
don't learn. Decentralize your problem solving. No Orders.
Amplify, reward and replicate your successes. Innovation comes first and
learning accrues from successful innovations.
Take advantage of localized problem solvers, share and distribute
information
Promote learning, competition/cooperation and symbiosis

39. IT Calisthenics
Who here thinks these behavioral and process changes are too radical
for your stodgy organization?
Who here is either in charge of a team regardless of size and/or is in a
position of influence in such a team?
Who here never raises their hand when asked to raise your hand at a
talk?

40. Everyone with your hands up – this is your homework. Introducing these
changes into your small sphere of influence will improve your business unit’s
metrics and create competition between other units within your organization
My Challenge to You
Your small successes lead to bigger successes, and in the end we are all the
better and naturally more secure
That will lead to cooperation once you realize the goals are the same, leading
to group cooperation that then will introduce competition at higher levels
and you are now on your way to changing your business culture

41. All without telling the CEO he’s doing it wrong

42. Feedback
Rockie Brockway
Information Security and Business Risk
Director
Black Box Network Services
@rockiebrockway