Abstract: This is a tale of Dennis’ first real job, as a penetration tester, at a company that is so into security that even the employees must maintain their own defenses… against each other. The story goes from his first day on the job, when he caught a system administrator adding a backdoor before his OS was even finished installing, to the entire office environment becoming a miniature version of threat models that clients would be facing in the real world every day (but probably worse). This presentation covers the attacks Dennis has successfully used against his co-workers and the defenses he has employed to protect himself. Explanation: The presentation will include: the attacks Dennis has used to break into his co-workers (both successfully and unsuccessfully) as well as the defenses he has put in place. The nature of these attacks almost always relies on social engineering. Dennis will be releasing the source code of all attacks/defenses that he has developed. He will also go into detail on his unique Linux setup (both its strengths and weaknesses). What Makes This Interesting? The subtext of this talk is the policy of Dennis’ employer (the one who allows the office mayhem to continue). It provides a unique way to inspire creativity and ensure that ALL measures are taken to secure a system. It also gives employees an avenue to learn new attacks/defenses that one might not see in your average pentest.

After getting a degree in Mathematics from Miami University, Dennis spent the following Summer performing magic on the mean streets of Newport, Kentucky. The only payment he asked for was a grown up job. Hurricane Labs was kind enough to take him in and give me a chance. So far they have yet to fire him (despite a few threats) and he's managed to become a vital member of the penetration testing team.

Back to Bsides Cleveland 2015 video list