TROOPERS13 - Keynote Day 2 by Chris Nickerson

## Overview Chris Nickerson's TROOPERS 13 keynote challenges conventional cybersecurity thinking by drawing parallels between historical military defeats of superpowers and modern security failures. Delivered in an informal, conversational style, the talk argues that defenders repeatedly lose not due to lack of resources or technology, but because they misunderstand the nature of the conflict and fail to secure their fundamental advantages.

## Key Historical Parallels Nickerson uses historical examples to frame security strategy: the Scythians defeating the Persian Empire, Britons against Romans, the Tanguts resisting Mongol domination, and Spanish guerrilla fighter Juan Martín Díez Porlier leading a seven-person force against French military might. The common thread: smaller, motivated forces that understand their environment defeat larger, better-equipped adversaries through tactical knowledge and will rather than raw resources. The talk directly applies this to modern cybersecurity: defenders possess more resources but systematically lose strategic advantages.

## Core Problems Identified 1. **Misplaced Focus**: Organizations prioritize installing technology and achieving compliance checkboxes rather than understanding their business operations and actual adversaries. 2. **False Security**: Compliance standards provide arbitrary metrics unrelated to actual business protection. Sophisticated controls increase attack surface complexity while often remaining vulnerable to simple, decades-old techniques. 3. **User Blame**: Security professionals blame users for being "stupid" rather than recognizing unrealistic expectations placed on non-security staff. 4. **Lack of Testing**: Organizations rarely verify that installed controls actually function as intended, creating false confidence in their security posture. 5. **Disconnection from Business**: Security teams don't understand how their companies generate revenue or operate, making their defensive strategies ineffective.

## Technical and Strategic Insights - **Defense Formula**: Defense = Capability + Experience (not technology quantity) - **Home Field Advantage**: Defenders give away their inherent advantage by not understanding their environment - **Attack Surface**: Every control added increases complexity and attack surface; security professionals must evaluate trade-offs - **Physical Security**: Social engineering and physical attacks often bypass technical defenses - **Vendor Solutions**: Security vendors profit by selling solutions to compliance-driven security postures rather than solving actual problems

## Methodology and Solutions Nickerson advocates for attack modeling based on specific adversaries rather than generic penetration testing. Organizations should: - Interview executives to understand business objectives and operations - Profile actual adversaries rather than conducting theoretical assessments - Test all defensive implementations to confirm effectiveness - Frame security through disaster-recovery economics (quantifying downtime costs) - Create achievable goals that make companies "addicted to progress" - Practice basic security fundamentals flawlessly rather than implementing advanced but untested controls - Understand company mission statements and align security around business protection, not compliance

## Key Takeaways - **Security is not about technology accumulation** but about understanding your business and environment - **Education matters more than controls**: Training people through realistic adversarial experiences prevents panic during actual attacks (referencing Mike Tyson's quote: "everybody has a plan until they get punched in the face") - **Stop blaming users**: Unrealistic security expectations placed on non-security staff reflect poor security design - **All organizations have been compromised**: This should motivate progress, not despair - **Measure security by business survival**: If the company operates profitably and hasn't been materially compromised, defensive objectives were met - **Adopt home field advantage**: Defenders who understand their terrain defeat better-resourced attackers