SOS (Same Old Shit): 5 Lies Enterprise Security Still Tells Itself

Johnny Xmas

Abstract:

Nearly 10 years ago Johnny quit full-time penetration testing out of shear boredom. The repetitive nature of finding the same systemic problems at company after company made the gigs not only a cure for insomnia , but also exceptionally frustrating to someone who cares deeply about security.

Now he’s back, and wow is he pissed about what he found. Join him as he rants about the biggest (and most actionable) things Large Enterprises are **still** doing wrong from a synersecuroty perspective, and presents basic frameworks for fixing them.

Johnny Xmas

Magnetic to keyboards

Johnny Xmas doesn’t seek to be well-known; he seeks to be worth knowing. He is prominent figure in the Information Security community since 2002, is a board member of both Chicago’s famous BurbSec community, as well as the BSides312 conference. He’s most notably recognized for his pivotal role in exposing the American TSA Master Key leaks (2014-2018), uncovering Venmo stalking vulnerabilities (2018), and being an overall nuisance.

Past experience includes being: Director of Cyber Training at security research firm GRIMM, defending against the automated abuse of web infrastructure with Kasada, and as the Lead Researcher on Uptake’s Industrial Cybersecurity Platform. Before this, he spent many years in the field as a penetration tester, security engineer for a global Fortune 500 retail corporation, and Mainframe auditor and Systems Engineer for several IT asset recovery firms.

Today, Johnny continues to shape and elevate the Information Security landscape with his expertise and contributions as the President of the Burbsec Information Security Network and the Head of Offensive Security for a Fortune 159 Food & Bev corporation.