OopsSec - The Day I Made the DMV Even Slower

The talk opens with the speaker's move from police detective work into an entry-level security role at a state agency, with a fresh certification and little hands-on tool experience. It then covers email authentication basics: SPF checks whether a sending server is authorized for a domain, DKIM verifies a signature showing the message was not altered, and DMARC sets the policy for failures. Common social-engineering warning signs follow, including unfamiliar senders, odd send times, unexpected attachments, awkward wording and suspicious links.

The core story compares two DocuSign-style messages. One had a generic greeting, a mismatched domain and a shortened link, while the other named the recipient and came from a recognizable sender. Late on a Thursday, the analyst and an intern judged the message to be credential harvesting and blocked DocuSign organization-wide without checking past traffic or getting a second review. The next morning the state DMV could not reach DocuSign, a legitimate workflow, and the cause was traced back to the block.

The speaker took ownership instead of blaming the intern, and the SOC manager explained the cause and fix to the agency. Follow-up work included reviewing the escalation path, writing a standard procedure for phishing investigations and retraining staff on the analysis platform. The takeaways are to verify before blocking, check headers and sender history against normal business flow, and build skills through free labs and community resources.