This talk will be an enjoyable conversation with good beer, great bourbon, and terrific friends who are reliving the journey of infosec maturity from the perspective of both a penetration testing company and their client over a three year period. Details of various engagements will be discussed along with post-mortem analysis, lessons learned, as well as resulting mitigation tactics and defensive strategies. We will discuss the outcomes at each stage of rendered service and how both client and vendor adjusted their approach to re-engage again and again. The engagement culminates in Red Team exercises that clearly demonstrate the infosec evolution of the client. The talk will leave the defensive audience with a sense of hope, a list of achievable goals, and several tactics. The red team with get a glimpse into the maw of the blue future and the value of their tradecraft. Special brief guest appearances and commentary are expected from others in the community that assisted the client along the way as well.
Joff has over 15 years of experience in the IT industry in roles such as enterprise network architect and network security defender. He has experience with intrusion detection and prevention systems, penetration testing, engineering network infrastructure defense, and software development. Joff’s role at Black Hills spans anything from software development, to security research and penetration testing. Joff is a SANS instructor for SEC573, and also is a co-host on the Security Weekly podcast. @joff_thyer
Mr. Petersen has been the Chief Information Security Officer and Director of Technology at Causeway Capital Management since June 2001. Pete’s technology experience spans more than three decades. Starting his career in the early 80’s in the finance sector deploying networked PC’s, and the 90’s as a consultant at several high tech firms in Silicon Valley where he was responsible for creating and establishing desktop standardization and management processes and tools. Later, at financial giant, he was involved with a global large scale Y2K remediation project. In 2001, Mr. Petersen chose to leave large enterprise to help found his current firm where he applies those same enterprise level management techniques and rigor. His is on the advisory boards of several finance, technology, and security firms. He currently resides in Southern California with his wife and two children. In his spare time Pete enjoys the roles of Scoutmaster and martial arts instructor. @ccmpete