[Music]
a little while ago I'm sorry Sam who Sam
Sam C son you know the guy who saved
ethereum's ass like oh I think I know
that guy the guy with the Anime Avatar
and a
sword and I think I remember that post
but no clue where to find it yeah I'm
just keeping Sho it's a pain let me let
me see if I can dig it up for you um
H yeah I don't know it's like all these
telegram group chats trying to find
information it's just so hard these days
um you know what now that you mentioned
telegram I think someone sent it to me
but I have to really it's going to be
really hard to find it there yeah wait
what did you need the D here uh yeah I
didn't realize you um you remember that
upset guide that you mentioned yesterday
did the one with all these um Sim
protections
and seam swapping protections and
fishing prevention techniques does that
ring a
bell I think you you're not mentioning
the officer Si's recollection of and
post and you're not not talking about
the insights from the book How to
Disappear no no that's something super
detailed like a stepbystep guide giving
you detailed instructions on how
to I was one of us um I was one of us a
little while ago wait I wrote something
that's on our our internal notion which
is like a transcription from something I
did with in
AI wait was it one or many guides
because awesome privacy has like a ton I
think it was one actual
guide wait Pascal Pascal shared one on
Twitter one that's the one thank you
thank you thank you let me go back to
his Twitter page I'm going to have to
scroll over hundreds of tweets to find
it but we'll get there thank than you
thank I would have fun it without you do
you have a minute now that you're here
would you be so kind to share me some
best practices for developers oh dude
there's like there's dozens if not
hundreds of resources these days on that
topic oh yeah so much I think we put
together a Google doc listing all of
them let let me see if I can find that
didn't realize there were so many
yeah so tons these days man it's pretty
crazy yeah I can see wow
I was thinking I can't find it now no no
worries but if only there was a more
organized structural place where we can
all go and and see all this stuff you
know and you know what people say people
say that the security issues are not
because of lack of information but
rather because of ignorance that makes
sense that makes complete sense you mean
something like maybe a community owned
Wiki of s so we can all contribute and
point our um lovely users towards yeah
man I mean I'm tired of scraping the
entire internet looking through my
bookmarks and when I'm thinking about
this centralized thinging I'm not
thinking about notion or Kota or TR so
please not I'm thinking of something
else yeah man that makes sense um yeah
it it it's crazy I spent so much time
all the every day trying to dig up you
what I was also thinking that even if
the information is out there but it
lacks Readiness it's outdated and you
have to look for it everywhere it's I
mean what you going to do right yeah
well maybe we can help maybe we can
build that Central
repository single source of Truth when
it comes to security best practices you
mean like a
generic best practices thingy yeah like
security guidelines or security
security
Frameworks yeah man I love I'll leave
you to it thank you God
speed oh didn't realize we were here how
are you so today I'm going to be talking
about the security Frameworks which are
high level best practices and say in we
three so I'm not going to be speak much
Amar Amar oh I'm not going to speak
more about seal since it has already
been presented uh but the only thing I'm
going to say is
that we are working with a lot of
respectful people from the entire
ecosystem and we try to do good
so the other thing that I'm going to say
is not to confuse us with this security
Alliance because I don't know why they
are on a triangle formation that's some
Illuminati right there it suits
them apparently pun intended and also
with the seal Alliance which is an
organization that tries to save
endangered species of Penny Peds and
seals I wonder if we fit into that
someone has to protect us too right so
back to the presentation we do many
things but it's outside of the scope of
the presentation and Frameworks is yet
another one initiative a pretty recent
one so my name is MAA I work at the red
Gill I am one of the founders the other
founder is there tincho and I'm also
leading the security works at
se and the red Guild we work as a
nonprofit organization doing public
goods for the benefit and we're very
much aligned with SE that's where we're
working together so this is going to be
like really really really quick FAS
because I don't want to bore you and I
just like talking more than it's
necessary
so like the book John Dies at the End
instead of pitching something and
leaving the product to the end I'm just
showing it straight at the beginning
so if you go there to the QR code it
will safely take you to my latest
malware just kidding it will it will
take you to one of those links I forgot
which one I think it's the the main one
so as you can see here on the
links both are synced and are
deployments of those two branches so the
main branch is at.org and the develop
branch is at
Dev and I'm going to show you some
screenshot so you don't stare at the
phone and look at me or look at the
presentation so here as you can see it's
very basic the current state is like a
Wiki if you use gitbook is something
really similar to it and on the left you
have the outline you have like a brief
introduction how to how to navigate it
all the Frameworks there of course and
on the right the content and also
there's a disclaimer that reads this is
a work in
progress not a release not a release
this is very important we are looking
for volunteers see issues to know how to
collaborate you're going to hear me a
lot about asking for collaboration and
kind of desperate just kidding so if you
go there and you click on the on the on
that icon it will take you directly
directly to edit on GitHub and if you
are on the doev domain and you log in
with Vel you will be able to select any
part of the content and leave comments
that I can read later and if you are
like really interested in some of the
Frameworks or the pages that you have
found you can book them bookmark them so
what we did in in on top of this is we
implemented a way to navigate it
depending on your role on your
background on your profile so we have
TXS now the TXS have been implemented by
Ani so it's kind of generic and there's
room for improvement but as you can see
here right next to the magnifying glass
you you see a tag and you can search
there and in this case I'm showing
Community
marketing and of course some of the
Community Management platforms that that
role may use and of course also
something related to awareness so
filtering by tax the tax that are
outside the screenshots the bullets are
the rest of the TX that have been
implemented recently and on the left I
have another example if you see it reads
security places and procedures
governance risk management compliance
with regulatory requirements metric KP
kpi so it's basically Leal and
compliance on the on the right side you
have HR and if you pay attention to that
it's mainly related to onboarding and
off offboarding of employees and and
members of an organization so if you
want to look your bookmarks you just
click on bookmark and and that's it and
now I'm going to show you a a few
classic examples of in this case the
category operational security you may be
tired of here and I say hey don't use
msf SMS TOA but here it is again an
entire category for you to read at your
home with your family sharing a nice
meal and also here this is one of my
favorites it's one of the outputs of one
of the other initiatives SE 911 so let's
say an incident happened and you don't
know how to organize your information
well here you can use this template to
assess and act as fast as you can and
another simple one which is more Bas to
an implementation of a platform which is
Discord and it explains basically how to
harden a Discord server
so technical details this is as you can
see this is really simple we have a an
open repository there it we we are using
a set of kbook MD
book and it Auto deploys with verel you
commit and you see the preview of the
deployment and right now only the dot
Dev is accepting comments so so it's
basically markdown files and pure docks
I had to admit it but my mother was
right I did end up studying 15 years
just to write documents but
whatever what you're going to do so on
General details uh we have a currently
Community cor team I'm really fortunate
to be working with Freddy and
medy I have them by my side and we try
to put minimum contents on every page so
you don't see some of the Frameworks and
empty and so and you can jump there and
criticize what we have wrad but a lot of
work is really needed for the first
release so this is why I put the
disclaimer this is not relas and the
next phase is currently right now moving
everything to public so we are seeking
Community collaboration and we hope that
making everything public will inight for
the collaboration so what's the problem
that we want to tackle you've seen that
security threats don't diminish by the
year uh as a was saying if you paid
attention to H talk and something that's
happening is that
most recks let's say are not only aimed
at decentralized infrastructure so and
and even they are getting better
so related to the
information if you remember the sketch
it's like really difficult to keep track
of all this stuff it even happens to us
at the at the guild WE Post articles and
I don't go back to update them I I have
a lot of repositories in GitHub where I
put notes and you know how it is it's
like really difficult to keep track and
it happens they get updated
so we propose this solution so what can
we do to to solve this we can transform
it to a way where you can access it and
understand it independently of your role
in an organization so which is our aim
our aim is to create best practices make
them comprehensive help organization to
secure different aspects of their
projects and if we can do that
regardless of the specific technology
the better but this doesn't come without
challenges
so what might difficult
process I mean if you come to DSS or
this track you know that the knowledge
is out there you possibly all have
something in your head that I don't know
and the other way around so I just need
to understand how to get to each one of
you even proof reading is something that
helps and that's why I'm insisting on
that we need collaboration this is
something that we all try to have to do
to her
so then let's say that we created
something and it's useful we need to
convince people that they should follow
these practices so seeking adoption is
something really important and to do
that we have to make make it at least
usable or easy to navigate otherwise it
would be like a painful experience
so of course of course of course now
that we created everything like that and
it's public then we can keep it
updated and another stuff that happening
is if you saw we have more generic
approaches but then you sell something
like Google s Discord Telegram and you
are going to say hey but that's like
really close to an implementation yeah
so the thing is that we don't want to go
too abstract in order not to get to uh
and and how to draw an draw an old
situation so the idea is that we have to
understand better how
to see where it is needed to go further
deep on the impation versus on High
level
practices back again to how collab at
how to collaborate number I'm going to
drive you crazy about this so you can go
there log in with um with your veral
account and leave comments annotation
whatever and of course since it's on a
public kab you can create a PR you can
create an issue you can create a
discussion hop on on the previously
created ones here I am showing you just
a few where currently there are 25 more
than 25 so if you don't know where to
start there is even the label good first
collab and there are 15 of them right
now and I will start creating more after
Devon so why should you
collaborate I think that we need to
shift our perspectives stop negating the
human nature and like we're going to
make mistakes so if we use mechanisms of
of control trying to avoid people
committing mistakes is negating the
human nature right so what we we should
do is just accept that we are going to
make mistakes as I said and build more
mechanisms of resilience to be able to
recover which is more
important and of course we can do this
alone so since we can do this alone I am
also going to show you this
recent initiative that we're
participating along with secum and theum
Foundation from the red Guild I'm not
going to say much because you can find
anything everything there on E Rangers
but if you have participated in public
goods working in security for the past
year or past month then you may be
eligible for 25k in two trenches and
even if you participated in the past and
you're eligible and don't know what the
you should do we are going to give
you
different initiatives where you can
support continuing your work which
because is like is really valuable and
of course security Frameworks fits into
one of the initiatives that you can
continue supporting so that's it I thank
you very much all for your time and I
hope you contribute to the security
Frameworks awesome let's give Mata a big
round of
applause can I just say I love his
outfit as well so colorful and I like
the fact that he took out his shoes
that's why he calls himself a techno
hippie yeah one one with the stage one
with the environment and one with the
security now we haven't got any
questions yet maybe because I forgot to
remind everyone to please send in the
questions I know you're really
interested by his presentation of the
Frameworks so let's give everybody just
maybe one or two minutes quickly send in
some questions you can scan the QR code
submit some questions if you want to ask
about the seal Alliance about the
security Frameworks that you briefly
mentioned in fact I was just looking at
the security framework let me open it so
you can actually get the um QR code that
he got on screen I scanned it and I got
it um if you miss the QR code it's uh
frameworks. security alliance. deev very
very interesting it's a resource a
collection of best practices written in
abstract or general fashion to be
applicable regardless of the specific
technology right so it doesn't matter
whether they web through whether you're
web 3 everybody can read it is that
right M absolutely everybody can access
completely free online I love the fact
that this is the kind of things that we
collaborate and we build together
speaking of building together I see you
guys building the questions on the
screen so let me look at some of the
questions and let's go right to the top
oh do vote for your question so we can
Target the most popular ones first one
on the top Mata why create oh excuse me
it moved okay they voted for this one
what's the highest impact action a web
three user can take to improve their
security or it moved away but we'll go
to that one highest impact that you can
take to improve your security what would
you say they are all good questions
really hard to to to reply to them so
I'm I'm going to try to to be brief
sure I think this answer has to be more
it's more related to the relationship
everybody has beat war3 or two to the
Technologies I feel like we're using a
lot of technology and we don't
understand it it happens like on even on
household items you have a router you
have a portable computer that which is
capable of doing a lot of stuff and
people don't know like for example on
the iPhone you have a lockdown mode
which protects you for a lot of stuff
you can even disable I don't know a lot
of stuff that may pose you to other
threats
so I'd say that getting awareness and
understanding the technologies that you
use it's a more important stuff because
I've seen people say no you should use
this extension when you interact with
protocols or you should use this snap
but those things can be tricked and have
been tricked in the past and if you only
R to that kind of Technologies to
protect you what happens when they don't
are you going to get wrecked so I'd say
understanding the technologies that you
use and the risk that they pose it's the
most important stuff excellent very good
understanding the Technologies we use
right we use it every day but we don't
always take time to understand it now
three votes at the top why create a new
framework instead of adding to existing
ones from the web to companies I like to
see those
I like to see those and what happens at
least to the ones that I
known I don't know if you ever try to
look information in the Internet and try
to contact a company to do a
collaboration most of the things that I
have seen from organizations are like
really jealous of on like other stuff
and they mostly do it like a marketing
stunt I'm not saying it's not valuable
so working
on with with organizations that did this
as as as um yeah as a stun is like
really hard and for example if I want to
collaborate or others want to
collaborate it's like really difficult
so we we thought of doing something that
everybody could participate and it's
free I mean it's on the security
Alliance but it could be elsewhere you
can even Fork it and start doing a new
one if you think that our our ways suck
so this is an approach I'm not saying
it's the best one this is an approach we
have more ideas to improve the the
interface that will come later this this
year so we wanted to be more to give the
the community more control over this
stuff that is really important to us I
completely agree it's not always
companies that are willing to share
companies usually protect their stuff
they don't want you to know their
security practices because otherwise you
might then take advantage right so but
this is collaborative what seal is doing
is to collaborate with everyone to build
a document together the okay four votes
at the top Mata do share any memorable
incidents if you don't mind what can you
share something that happened that you
want to maybe share a story um I'm going
to share like a personal experience
which made me get interested in security
like totally off topic because I mean we
can talk about like dpk or some other
stuff if you wanted I know who wrote
this if you wanted something more like
that we can talk we can discuss it out
stage
but I started in security
doing let me go back I started playing
online games like in 2000 there was a
very popular Argentinian game called
called arum online arum online arum
online yeah it was the me the the first
mm op orpg orpg there so I met a friend
there a female okay nice nice and then
we started exchanging messages MH and
back that the day we used messenger for
4.0 wow yeah and old yeah we were
chatting and and she she told me hey you
can see this emoticons not emojis let me
send you this pack so I accepted the
pack and then my compa dicks was started
the tray was started open and closing
and she said thanks you thank you for
your IP I was like what the so I
got locked off and all my contacts were
erased and I lost contact with bunch of
friends online I was like I feel like
violated my you got hacked from MSN
Messenger yeah from an emoticon pack
yeah wow 24 years ago so that's when my
evil Arc started wow I'm on my good one
right now now that is you can see I'm
working for two nonprofits I'm not good
I'm not bad I'm not bad thank you slip
of the tongue there wow that I've never
heard of anyone getting hacked on MSN of
all things but um thank you for sharing
the story I I I mean that was really
memorable uh we got a we got a few more
minutes so let's uh let's uh see the
question at the top two simple things to
enhance SEC security the most so you
mentioned awareness and I think maybe if
you want to add one more thing that you
think would be a practical something
practical that everybody in the room can
do well I can tell you what I do uh for
example I have a Linux machine I have
full dis encryption and I also sometimes
paint with nail polish the the the the
screws you paint the screws with nail
polish uh yeah in case I I get an ail
made
attack you know what ail made attack is
no it's when you leave your room on your
your computer on your room and you leave
and someone enters and hijacks into the
room and then unscrews your computer and
puts a VOR in it so if you oh I see you
have to yeah this this is like really
Paran so you paint it so that you'll
know if someone has taken out the screws
wow but if you have full disc encryption
it's like it's okay yeah I mean it it
depends what's your thread model if
you're like a very high profile Target
okay you may be doomed but that is quite
extreme what I do what I do is for
example uh I use a firewall firewall uh
in my case I use open snitch but on Mac
you can use little snitch or Lulu I
prefer Lulu better and I have a virtual
machine and inside the virtual machine I
run containers and every project that I
try to run even the ones that we have
created I run each one of them inside a
container because the container even
runs the extensions inside the container
but as we showed on yesterday's Workshop
M there are even
misconfigurations that can leave you
vulnerable yeah unprotected so yeah but
I think what you pointed out is
important as well not everyone has to do
all of these things right it's about
your Threat Level if you're dealing with
things which are dangerous then of
course you have to implement I don't
think I'm going to paint the screws on
my my MacBook at home but um but I mean
those are very interesting uh tips I've
not heard that one before so that's and
and for example here uh I got this tip
from Greg yeah hi Greg the um we are
using a giet giet was it g g IET router
it's the it's called a VAR it's really
small yeah so what we do is we take it
for example to this conferences it comes
with a VPN inside y so we create a local
network and we connect all our devices
there even if you're on a plane and you
are only allowed one device it also
works like that yeah like this so
isolating yourself I'd say correct
creating your own private yeah private
Network okay very cool thank you for
sharing those are some very interesting
security practices we got time for one
or two more questions uh where can we
follow your work so where can they
follow you if they want to follow your
work uh since we work at two
organizations mainly our organization I
mean our organization is the red Guild
you can go to the red guild. red Guild
okay yeah we have created for Devon
especially a
CF on our platform which is called
Direct direct games okay direct games
okay there we have theable defi which
was originally created by tcho MH and
also the CTF which is based on real case
scenarios that made organizations Get
Wrecked so you have to play the role of
an adversan and then you have to help
for example the theum foundation to
retrieve some credential that vital has
pushed and deleted on a file on on a
repository and then we have the fishing
Dojo fishing do
yeah I don't know if you ever went to
those corpo fishing awareness trainings
I have I have yeah they suck yeah yeah
they put you like a video and then they
they ask multiple choice question
they'll send me some emails and if I
click on it then I go for the training
cuz I failed the fishing test yeah this
is this is I I'm really proud proud that
we came up with this y so fishing.
direct games.com there you have for
example it starts with an interface of
an email and you have to understand if
you to see some someone or something
fishy right and and then it changes
sceneries like you sign in a transaction
you're watching ether scan trying to see
if you get spoofed but it's all fake
even the wallet you don't have to leave
the the entire platform it has been
thought that way so it's safe to play
and and have fun and then yeah we have I
think like monthly updates okay kind of
like that and un seal I I'd say join our
community we have a Discord where it's
public there's not much activity right
now but may if you come we can start
talking there and
share everything we have been up to
perfect you finished right on the time
is up 00 let's give Mata a big round of
applause thank you very
much all the way from the seal Alliance
ladies and gentlemen