A Different Uber Post-Mortem
Former Uber CSO Joe Sullivan provides an inside retrospective on the 2016 Uber data breach, executive liability, and the criminalization of incident response.
Summary
The Historic Prosecution of a Chief Security Officer
The federal criminal prosecution of former Uber Chief Security Officer Joe Sullivan (United States v. Sullivan) marked a watershed moment for executive liability in corporate incident response.
Inside the 2016 AWS Credential Intrusion
Joe Sullivan recounts the technical reality of the 2016 incident, where external researchers accessed Uber AWS infrastructure via exposed GitHub credentials and demanded payment.
Distinguishing Security Researchers from Criminal Extortionists
Sullivan details his team’s investigation and interactions with the young hackers, exploring the ambiguous legal boundary between aggressive bug bounty submissions and extortion.
Lessons for Corporate Governance and Legal Transparency
The talk examines critical lessons regarding executive accountability, transparent disclosure to regulatory bodies, and the unintended consequences of criminalizing CISO decision-making.
Related talks
War Stories·46 min
Renderman · Tom Dang
Renderman and Tom Dang share first-hand accounts of facing legal retaliation when reporting government vulnerabilities, urging reform in public disclosure policies.
Black Hat·50 min
Industry experts analyze emerging threats surrounding Legal Landmines: How Law and Policy are Rapidly Shaping Information Security.
nullcon·45 min
Engineers explore architecture and security mechanisms for Legal & Policy Session | Raman Jit Singh Chima | Access Now | nullcon Goa 2019.