Opening keynote by Alex Stamos at the 29th Annual FIRST Conference in San Juan, Puerto Rico
by Valerie Lopez of PRLinks for FIRST
Tuesday, June 13th, 2017
FIRST's Annual Conference kicked off on Monday morning, June 12th of 2017 with its opening keynote speaker, Facebook Chief Security Officer (CSO) Alex Stamos. As security lead for one of the world’s most noted companies, Stamos began his lecture with some of the biggest security challenges Facebook deals with.
First stop, Stamos noted that the majority of effort is currently not applied to the majority of harm. Among those are threats such as abuse of technology, cyberbullying, terrorist attacks, online child exploitation, targeted attacks, generic malware, phishing and password reuse.
Another challenge lies in the fact that the modern Internet is not the Internet we grew up with. It has been changing constantly and in a very short amount of time. This makes it more challenging to keep up with security issues and solutions.
One of the biggest security challenges Stamos spoke about was that there is a whole ecosystem of old mobile phones used in developing countries that have not been updated or have patches, thus rendering them vulnerable. These can also be used as zombie phones through which other users and networks can be infected. Facebook has 2 billion users. Even with this issue, Stamos said that “we have to make sure that our platform is usable and available for everyone. We build a platform that supports everyone and every device.”
In addition, Stamos noted that modern networks are not designed to make traditional detections. To deal with this challenge, Stamos said that Facebook adapts its model to these new technologies to make sure the company protects its data. These changes sometimes include detecting on the machine, rather than on the network, recognizing the lower trust guarantees around the data. He also noted that in order to have good preparation for an incident, you must be willing to fail to the red team.
The first suggestion Stamos gave other security experts at the conference was to constantly test your company’s employees. Every October, Facebook holds Hacktober, during which the company plays tricks on the company’s employees to test them. The goal is to keep them alert to possible fraud situations. In one example he showed, a phishing e-mail that was sent to test employees, Half of the people who saw it fell for it, while 20% of employees who received it perceived it as a fraudulent message.
Stamos added that companies should also test their executives. Companies should have security policies in place and carry out drills so they can act promptly and quickly in case of a security issue. Security teams should also test themselves. “Unless you are testing your security system constantly you don’t know what you have,” Stamos warned the audience.
Stamos also suggested that during a security emergency, teams should collect all data and sort it out later. In addition, Stamos said that companies should make security a leader in machine learning adoption.
The Facebook CSO concluded his keynote by urging security experts to be willing to expand the bounds of what they could consider their responsibilities and recommit to sharing information about incidents, issues between companies and providers.
