Scot-Secure Summit 2023 Edinburgh

### Overview This session from the Scot-Secure Summit 2023 in Edinburgh features three focused presentations followed by a panel Q&A session moderated by Mark Stephen. The presentations address three distinct aspects of information security: democratizing security through internal training workshops, architecting privacy-enhancing technologies under regulatory pressure, and communicating effectively with executive board members. The session concludes with audience discussions exploring legal implications of privacy, retention of cybersecurity talent, and improving gender diversity in tech.

### Key Topics - **Engaging Non-Security Teams with Workshops:** Gwen Diagram, Head of Engineering at Glean, shares strategies for running engaging internal security workshops. Drawing from her background as a tester and engineering leader, she demonstrates how to use tools like OWASP Juice Shop, incident response war games, the Elevation of Privilege card game, OWASP ZAP, threat modeling with STRIDE and personas, and intentionally vulnerable application builds to cultivate security awareness across engineering and IT. - **Application Security via Anonymization (Anonymous Mode):** Leo Cunningham (CISO) and Caius Shashtokush (Application Security Engineer) from Flo Health discuss developing "Anonymous Mode" for their health and period-tracking app. Spurred by the overturning of Roe v. Wade in the US and geopolitical events affecting their workforce, Flo partnered with Cloudflare to implement Oblivious HTTP (OHTTP) and binary HTTP to decouple reproductive health data from personally identifiable information (PII). - **Board-Level Security Communication:** Lena Smart, CISO at MongoDB, provides guidance on briefing corporate boards of directors. She highlights the importance of understanding the board’s core concerns, preparing five-sentence elevator pitches, adopting structured briefing formats (such as the AWS memo format), avoiding technical jargon, and never fabricating answers under pressure. - **Panel Discussion and Q&A:** The speakers address audience inquiries regarding potential legal challenges against anonymized data, maintaining private bug bounty programs, scaling training programs, retaining security talent through continuous learning and internal security champions programs, and addressing gender disparities in cybersecurity.

### Technical Details - **Workshop Tooling and Frameworks:** Juice Shop serves as a self-contained, self-healing capture-the-flag (CTF) and training platform covering the OWASP Top 10. Threat modeling implementations leverage the STRIDE model (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege) expanded with Privacy (gdpr considerations) and Adam Shostack's attacker personas. The Elevation of Privilege card game (played like Hearts) requires agile threat record cards for structured scoring. - **Oblivious HTTP (OHTTP) Architecture:** Flo Health's Anonymous Mode encrypts requests from the client device using public keys and routes traffic through a Cloudflare relay service. Cloudflare strips client IP addresses before forwarding binary HTTP requests to Flo’s application gateway, preventing Flo from correlating incoming health data with user network identifiers. Device-side security measures include segregating client storage and storing access codes in the iOS Keychain. - **Continuous Security and AppSec Testing:** During rapid development, internal AppSec collaborated in real time via dedicated chat channels with external penetration testers. Post-launch security relies on a private bug bounty program, threat modeling for bot mitigation (transitioning from IP-based blocking to web application firewalls and API structure analysis), and plans to open-source client-side encryption logic. - **Executive Reporting Mechanisms:** MongoDb utilizes a dedicated one-hour quarterly board session focused purely on security. Presentations rely on pre-circulated 10–15 page AWS-style memos featuring an executive statement of intent, an agenda, and detailed technical addenda rather than cluttered slide decks.

### Takeaways - **Engage Broadly Across the Organization:** Developers, IT staff, and compliance personnel are eager to learn security when offered gamified, hands-on, and relevant training rather than passive lectures. - **Decouple Data to Enforce Privacy:** When regulatory or external threats risk user data exposure, architectural solutions like Oblivious HTTP can mathematically and operationally ensure sensitive user records cannot be linked to individual identities. - **Communicate as an Authentic Expert:** Interacting with corporate boards requires brevity, rigorous preparation, calm transparency when information is unavailable, and framing technical risk around core business assets.