Everybody, Blueteam and Redteam players alike, are driven by incentives. Good incentives persuade us to do the right thing and patch our servers. Bad incentives make us eat unhealthy food and follow stupid security practices. There is a huge resource problem in the IT industry and especially in the security industry. So you would expect people to pay attention to the existing incentives and th incentives they create with their documentation, their awareness trainings, their security reports, etc. But reality paints a different picture: Bad incentives all around! We see insane security practices eating valuable time and online trainings annoying users, slowly teaching them to become a brainless zombie whenever they hear the keyword "security". But it's even worse. I've come across incentives that lure companies into creating bad products and I've seen companies create products that incentivize their customers to waste their time and money. Sometimes the mechanisms are too strong to fight. But sometimes it takes people like you and me to say NO and stand up for real security! Follow me on a journey and security will never look the same to you again!

1. Crazy incentives
and how they drive
security into
no man's land
Christian Folini
Keynote 2023

2. Streaming
in China
Source:
@RealSexyCyborg
(Naomi Wu)
Streaming
in China

3. Hello Insomni’Hack!
I am Christian Folini
Find me at @ChrFolini / @folini@infosec.exchange
Swiss Security Engineer
OWASP CRS Co-Lead
Wearer of Many Helmets

4. “
In general, incentives are
anything that persuade a
person to alter their
behaviour. (Wikipedia)

5. “
In general, incentives are anything that
persuade a person to alter their behaviour.
...
Higher incentives amount to greater levels
of effort and therefore, higher levels of
performance.

6. Elon scrambling
for money

7. “

8. Nessus
Reports

9. More Nessus
Madness

10. Inflated
Numbers

11. Even Bigger
Numbers
Source: https://techjury.net/

12. The Infamous
Norse
Dashboard
A Kibana Example

13. Typical ModSecurity Dashboard Element

14. Survivorship
Bias
Source: Wikipedia: Survivorship Bias

15. Bug Bounty Hunters
Source:
https://pexels.com

16. Bug Bounty
Hunters
Penetration Testers

17. Large
Baskets
with
Many,
Many
Eggs

18. Crisis
Communication

19. Ransomware
Source: Wikipedia: AIDS DOS Trojan 1989

20. Ransomware and Cyber Insurance

21. Commercial WAF Detection Rates
Source: https://fraktal.fi (Tuomo Makkonnen, 2020)

22. Unce upon a time, there was a boy ...

23. The boy was a shepherd

24. His little herd also included a ram

25. He took them through a forest

26. In the forest, there was a wolf

27. The boy screamed and called the hunters

28. The hunters came and wanted to kill the wolf

29. But as it turned out, it was all a false positive!

31. The alternative: a false negative!

32. The alternative: a false negative!

33. The alternative: a false negative!

34. Commercial WAF Detection Rates
Source: https://fraktal.fi (Tuomo Makkonnen, 2020)

35. Summary
Let’s wrap this up!

36. Level 1
An overly relaxed attitude,
ignorance, negligence and
carelessness lead to bad
incentives for users.
Tricking them into weak
decisions undermining
security.
Two Levels of Bad Incentives
Level 2
Deliberately following or
setting crazy incentives for
immediate gain;
consciously prioritizing
financial benefit over
security of users and their
data.

37. It’s your job to raise the alarm when incentives
and security don’t align!

38. Contact
christian.folini@netnea.com
@ChrFolini
@folini@infosec.exchange