Brucon Top5 Ways to Destroy a Company [Brucon]
description
Transcript of Brucon Top5 Ways to Destroy a Company [Brucon]
TOP 5 WAYS TO DESTROY A COMPANY
I’M CHRIS
MY CREDENTIALS
Shell doesn’t matter
What do companies care about and how do we know?
Top 5
Born from the Fire
No one cares about your findings!
HOW WE FEEL ABOUT IT
HOW THEY FEEL ABOUT IT
You don’t know… Admit it!
WHAT DO THEY CARE ABOUT?
THE PRODUCT LINE
THE BRAND
THE EMPLOYEES
THE BOTTOM LINE
You don’t know… Admit it!
HOW TO FIGURE OUT WHAT IS IMPORTANT
STEP #1 YOUR OPINION DOESN’T MATTER
STEP #2 THINK LIKE THEM
STEP #3: DO WORKYea… this is the boring stuff…but u gotta do it….
• Information that would be severely damaging to the company and brand.Secret
• Information that would impede or cause significant financial damage to the organization if made public or shared internally.
Confidential
• Information generally available to all or most employees but not approved for general circulation outside the organization
Internal Use Only
• Information approved for general circulation outside the organizationPublic
Confidentiality
Integrity
Availability
Criticality
Confidentiality
Integrity
Availability
Risk Factors
Confidentiality Integrity Availability
Patient Data
Credit card Numbers
Marketing Information
Cash
Cus
tom
er A
sset
s
Risk Factors
Confidentiality Integrity Availability
Patient Data H H HCredit card Numbers H M MMarketing Information L M LCash L M LC
usto
mer
Ass
ets
Legal/ Compliance/ Financial risk
Inconvenience
Possible Image/Brand Effect
Possible profitability loss
Risk Factors
Confidentiality Integrity Availability SCORE
Patient Data H H H 5Credit card Numbers H M M 4.3Marketing Information M M L 1.6Cash L M L 1.6C
usto
mer
Ass
ets
HIGH 5
MEDIUM 3
LOW 1
X
X
Changed to H after conversation of how it impacts profitability
Changed to L after conversation of how it was already public information
But we had to do it to make sure we have a PROCESS to let them tell us what they care about……. Even
when they don’t know what it is…
HOLY CRAP!!! THAT WAS BORING
THE TOP 5 WAYS TO DESTROY A COMPANY
• Tarnish the brand
• Alter the Product
• Attack the Employees
• Effect financials directly
• **It’s your turn…**
TARNISH THE BRANDWhat’s in a name?
TARNISH THE BRAND (WHAT YOU WILL NEED)
• Understanding of the overall brand values
• Identification of key words used in marketing message
• Knowledge of competitor advantages/disadvantages
• Intelligence profiles on the “Keepers of the Brand”
• Executives
• Key personnel
• Entire Marketing/Design Team
• Reverse engineering of the “go to market” strategy
• Identification of the “Customer Feedback” loop
• Identification of the Market’s “Indicators of Quality” and what drives customers to the “product”
TARNISH THE BRAND (HOW TO DO IT)• Attack the marketing team
• Compromise the marketing process
• Alter marketing communication
• Alter brand messaging (logo/slogans/tone)
• Extend Marketing deliverable times through deletion, alteration, confusion
• Increase Time to market
• Pollute the customer feedback loop
• Take over the “Indicators of quality” and create
• False issues (product misdirection)
• Negative reviews
• Use by non standard customers
• False company response
ALTER THE PRODUCTOopse… did I do that?
ALTER THE PRODUCT(WHAT YOU WILL NEED)
• Complete listing of products (or services) depending on the organization
• Chain of command for product development or service integrity
• Historical review of the products timeline
• Understanding of where alteration can cause
• Degradation of the product quality
• Effect to the consumer
• Direct financial loss
• Physical loss
• General Harm
• Loss of competitive advantage
ATTACK THE PRODUCT (HOW TO DO IT)
VERY Company Specific (examples?!)
#1 The Software Company
• Create bugs
• Make backdoors
• Cause errors in function (What if the calculations of a CRM product are off?)
• Add hidden features into their SVN/Software release cycle
• Remove feature tests or other parts of QA process
ATTACK THE PRODUCT (HOW TO DO IT)
VERY Company Specific (examples?!)
#2 The Hospital/Healthcare business
• Change patient diagnosis or history (like allergies)
• Attack HVAC systems to cause heat into Operating rooms
• Disable critical alert functions for disease control
• Attack crashcarts to disable on the fly patient care and records
• Attack Pyxis and automated narcotic dispensing stations
• Alter patient doses through in line network monitored administration devices.
ATTACK THE PRODUCT (HOW TO DO IT)VERY Company Specific (examples?!)
#3 Manufacturing Company
• Alter the production line/process
• Cause the robots to over spray, weld, install wrong parts, go rogue
• Change formulas
• Speed or slow the line
• Create issues causing the company to fall out of compliance (9001/2 etc..)
• Add or remove features of the product
• Decrease quality
• Break shit..... Like a lot…. I mean… like all of it…. Beyond repair…
ATTACK THE EMPLOYEESTonight…..you!
ATTACK THE EMPLOYEES (WHAT YOU WILL NEED)
• Profile who they are
• Find out where they live
• Figure out what “dangers” they may have at the office ;)
• Can you get them sick (attack scada/water/etc)
• Can you attack them with company property (robots!)
• Do they operate anything that could … fail?
• Do they make things that could be dangerous?
• Can you put them in dangerous situations?
ATTACK THE EMPLOYEES (HOW TO DO IT)
• Figure out their daily routine then MAKE A KIDNAPPING PROFILE
• Use the company against them
• Food?
• Manufacturing equipment?
• General Terrorism
• Releasing the horde?
• Kill their benefits
• Reduce their pay
• Charge their accounts (amex DOS)
DIRECTLY EFFECT BOTTOM LINE
All your $$$ are belong to me
DIRECTLY EFFECT THE BOTTOM LINE (WHAT YOU WILL NEED)
• Understanding of the overall of how they make $
• Identify what systems generate income
• Do they take credit cards?
• Do they have cash?
• Do they have other assets that have $$
• Is there a market for their internal information (CI)
• Is there a secret formula?
• Products that they create
PROCESS
Figure Out What the Company
Thinks is ImportantSteal It !
DIRECTLY EFFECT THE BOTTOM LINE(HOW TO DO IT)
YOUR TURNWhat is #5
TRY AND MAKE THE WORLD BURN
WHAT ELSE?
KEEP BEATING THEM DOWN
WHAT DO WE TAKE AWAY FROM THIS
• Shell doesn’t do anything
• Speak in their language
• Remove white/black hat and DO WORK
• Stop trying to rationalize why you are right…and change the game