A tester walks into a security conference

First published March 2021 

There’s no punchline. sorry.   

This post is all about me attending my very first Security Conference at BSides Leeds on Friday the 24th of January 2020. There are links to resources and tools at the end, some of which are mentioned in the body of this post. Please make your own judgements on using them.   

I’m always keen to pick up knowledge in areas I’m less familiar with. Knock some of my ignorance off if you will, and this seemed an ideal opportunity. I mean, other than Leeds Testing Atelier and now Geordie Atelier, there are not that many opportunities to attend quality conferences for just £5 or less, other than online. I’m not detracting from online conferences and no doubt we will be seeing more of them in the coming months given the current situation. That said, there’s something about being able to hear and join in conversations with people you would otherwise not get the opportunity. I’m looking forward to those times returning when it is safe to do so.   

Mark Carney is the main organiser and made the opening remarks. Mark has been attending the Ministry of Testing Leeds Meetup for some time now, and it was great to hear him encourage the attendees to go to testing meetups. In fact, he said that in some areas, testing was ahead of security by 15 years! I’m not sure about that, but I do know that I’ve learnt a lot from chatting with Mark during and after our meetups, so as much as he encouraged attendance at testing meetings, I’d strongly encourage the same for testers to go to security meetings and conferences.   

The more we can learn to spot that ‘low-hanging fruit’, the more the specialist can spend time focusing their knowledge on the areas they can most add value. Add to the fact that there’s a very real desire to ‘shift left’ testing, then surely that should include all forms of testing.  Security, testability, automation and accessibility can all be thought about early. There is real value in thinking about all of these and more upfront to at least know the potential scope. But I digress.   

Dan Cuthbert gave the keynote following the conference theme of ‘Vision’ and after quite rightly pointing out that Leeds has led the way in building everything (don’t @ me, it's true!). He outlined the revolutions that change the world from the first industrial revolution to the second electrical and third electronic. His vision was that we are currently in a fourth cyber / technological revolution and that geeks have indeed inherited the earth! His rationale was hard to argue with. The FBI (Federal Bureau of Investigation, USA) now have a cyber most wanted list. There are more cybercrimes than physical ones. He spoke of the weaponising of social influencing, giving an example of where texts were sent saying a child was in hospital and to use this link for the location. Of course, the link is malware or similar to harvest data.   

Amongst other things mentioned were a Netflix documentary called ‘The Great Hack’, massive personal data collected on Chinese Muslims and the fact that there are no real InfoSec (Information Security) regulations. Overall, a very interesting and thought-stimulating keynote.   

It’s not my intention to try to document all the speakers or activities, but I will try to summarise a few. If you get the chance to go to a lock picking workshop, I would highly recommend it. It was great fun learning the basics and the sense of achievement of that first ‘click’ to open a lock is quite something. So too is the ‘Car Hacking Village’ where you can see all the components of cars' security systems laid out and try to hack them.   

So, to the summary. 

CI/CD Pipeline Ideas (Continuous Integration / Continuous Delivery)  There were things suggested through the day that could be added to the process. These are also things that can be learnt and executed by every tester and / or things to question early in the project. It was generally noted that good clear logs are needed to help these and useful in general. While not specifically called out I did think about observability a few times through the day as helping security in general.  

Shift Left ideas 

Similarities  

Conclusion 

For me, this was a really valuable day where I took away lots of learning to apply in projects. One of a tester's powers comes from asking questions. If we can add basic security knowledge, we can ask questions earlier and at a time where it is most valuable. If we can execute basic security tests, we can save the company time and money, allowing the experts to concentrate where they can add most value.   

Be the tester that walks into a security conference and adds to your value.