As delivered at DevSecCon London 2017

1. Join the conversation #DevSecCon
BY DINIS CRUZ, CISO, PHOTOBOX GROUP
Creating a Graph-based
Security Organisation

2. This is a presentation about Graphs

3. Why Graphs?

4. Graphs are a better framework to look at
the problem

5. Refactor the problem until the
solution is easy

6. What is a graph?

7. What is a graph?

8. What is a graph?

9. What is a graph?

10. What is a graph?

11. What is a graph?

12. Graphs in Security

13. Graphs in Security

14. Graphs in Security

15. Threat Models are Graphs

16. Threat Models are Graphs

17. Threat Models are Graphs

18. Some of biggest tech companies are
graph companies

19. Some of biggest tech companies are
graph companies

20. Some of biggest tech companies are
graph companies

21. Ideas are Graphs

22. Ideas are Graphs

23. Ideas are Graphs

24. Jira Workflows are Graphs

25. Jira Workflows are Graphs

26. Jira Workflows are Graphs

27. Source code

28. Source code

29. Source code

30. …are graphs too

31. …are graphs too

32. …are graphs too

33. Git is a graph

34. Git is a graph

35. Git is a graph

36. Tensor Flow

37. Tensor Flow

38. Tensor Flow

39. Hyperlinks are Graphs (i.e. the web)

40. Hyperlinks are Graphs (i.e. the web)

41. Hyperlinks are Graphs (i.e. the web)

42. Neo4J

43. Neo4J

44. Neo4J

45. Neo4J

46. Neo4J

47. Cypher (Neo4j query language)

48. Cypher (Neo4j query language)

49. Cypher (Neo4j query language)

50. Graph Books & Thinking in graphs

51. Graph Books & Thinking in graphs

52. Graph Books & Thinking in graphs

53. Vectors

54. Vectors (by Elon Musk)
https://thinkgrowth.org/what-elon-musk-taught-me-about-growing-a-business-c2c173f5bff3

55. Vectors (by Elon Musk)
https://thinkgrowth.org/what-elon-musk-taught-me-about-growing-a-business-c2c173f5bff3
“Every person in your
company is a vector. Your
progress is determined by
the sum of all vectors.” —
Elon Musk

56. Align Vectors

57. Align Vectors

58. Align Vectors

59. TeamMentor Graph

60. TeamMentor example

61. TeamMentor example

62. TeamMentor Graphs

63. TeamMentor Graphs

64. TeamMentor Graphs

65. Filter Graph to understand/design it

66. Filter Graph to understand/design it

67. Filter Graph to understand/design it

68. LevelGraph (based on LevelDB)

69. LevelGraph (based on LevelDB)

70. LevelGraph (based on LevelDB)

71. LevelGraph (based on LevelDB)

72. Viz.js
http://visjs.org/examples/network/exampleApplications/worldCupPerformance.html

73. Viz.js
http://visjs.org/examples/network/exampleApplications/worldCupPerformance.html

74. Viz.js
http://visjs.org/examples/network/exampleApplications/worldCupPerformance.html

75. Jira and Confluence

76. We use Jira as a Graph Database

77. We use Jira as a Graph Database
Global Key

78. We use Jira as a Graph Database
Labels
Global Key

79. We use Jira as a Graph Database
Labels
Extra
Attributes
Global Key

80. We use Jira as a Graph Database
Labels
Extra
Attributes
Global Key
Workflows

81. We use Jira as a Graph Database
Labels
Extra
Attributes
Global Key
Workflows
Assignments

82. We use Jira as a Graph Database
Labels
Extra
Attributes
Global Key
Workflows
Assignments
TimeStamps

83. We use Jira as a Graph Database
Labels
Extra
Attributes
Global Key
Workflows
Assignments
TimeStamps
Linked to Epic

84. Epic captures all risks and tasks

85. Epic captures all risks and tasks

86. Confluence page captures facts

87. Confluence page captures facts

88. Hyperlinked risks

89. We use Confluence to view the data

90. How we handle incidents/events

93. Task Response is used to capture result

94. Security organisation as an graph

95. Security organisation as an graph
Each Pillar is mapped to
a Capability

96. Security organisation as an graph
Each Pillar is mapped to
a Capability
Each Capability is mapped to
an Programme

97. Security organisation as an graph
Each Pillar is mapped to
a Capability
Each Capability is mapped to
an Programme

98. Security organisation as an graph
Each Pillar is mapped to
a Capability
Each Capability is mapped to
an Programme
Each Programme is mapped
to a Project

99. Group Security Projects as Jira Issues

100. Group Security Projects as Jira Issues

101. Group Security Projects as Jira Issues

103. Using OpenSourced API to filter JIRA data
(please contribute)

104. A Company as a graph
• Everybody is connected to
everybody

105. A Company as a graph
• Everybody is connected to
everybody
• Interconnections are
fundamental for effectiveness
and scalability

106. A Company as a graph
• Everybody is connected to
everybody
• Interconnections are
fundamental for effectiveness
and scalability
• The Group Security (GS) team is
one of the nodes in the
interconnected entities

107. JIRA for Ops Teams
• How do you know your team is working?

108. JIRA for Ops Teams
• How do you know your team is working?
• When you see initiative being taken

109. JIRA for Ops Teams
• How do you know your team is working?
• When you see initiative being taken
• Without your direct involvement

110. JIRA for Ops Teams
• How do you know your team is working?
• When you see initiative being taken
• Without your direct involvement
• When tasks are visible to everyone on the
team – such as in JIRA

111. JIRA for Ops Teams
• How do you know your team is working?
• When you see initiative being taken
• Without your direct involvement
• When tasks are visible to everyone on the
team – such as in JIRA
• Do you use JIRA?

112. JIRA for Ops Teams
• How do you know your team is working?
• When you see initiative being taken
• Without your direct involvement
• When tasks are visible to everyone on the
team – such as in JIRA
• Do you use JIRA?
• For those who don’t, how do you keep
track of tasks?

113. JIRA for Ops Teams
• How do you know your team is working?
• When you see initiative being taken
• Without your direct involvement
• When tasks are visible to everyone on the
team – such as in JIRA
• Do you use JIRA?
• For those who don’t, how do you keep
track of tasks?
• A task is a fresh idea

114. JIRA for Ops Teams
• How do you know your team is working?
• When you see initiative being taken
• Without your direct involvement
• When tasks are visible to everyone on the
team – such as in JIRA
• Do you use JIRA?
• For those who don’t, how do you keep
track of tasks?
• A task is a fresh idea
• If you don’t capture or hyperlink it, you
will lose it

115. Graphs require human maintenance (JIRA for Ops Teams)
• How many team members do you have to
monitor and drive Jira task boards?

116. Graphs require human maintenance (JIRA for Ops Teams)
• How many team members do you have to
monitor and drive Jira task boards?
• A lean operations team is

117. Graphs require human maintenance (JIRA for Ops Teams)
• How many team members do you have to
monitor and drive Jira task boards?
• A lean operations team is
• Focussed on maintaining the JIRA graph

118. Graphs require human maintenance (JIRA for Ops Teams)
• How many team members do you have to
monitor and drive Jira task boards?
• A lean operations team is
• Focussed on maintaining the JIRA graph
• Ensures the graph functions, and grows

119. Graphs require human maintenance (JIRA for Ops Teams)
• How many team members do you have to
monitor and drive Jira task boards?
• A lean operations team is
• Focussed on maintaining the JIRA graph
• Ensures the graph functions, and grows
• Contributes to the achievement of business
goals

120. Graphs require human maintenance (JIRA for Ops Teams)
• How many team members do you have to
monitor and drive Jira task boards?
• A lean operations team is
• Focussed on maintaining the JIRA graph
• Ensures the graph functions, and grows
• Contributes to the achievement of business
goals
• Your Ops team should have a budget to
spend on resources to ensure they learn,
grow in, master, and ultimately redefine
their roles

121. Graphs require human maintenance (JIRA for Ops Teams)
• How many team members do you have to
monitor and drive Jira task boards?
• A lean operations team is
• Focussed on maintaining the JIRA graph
• Ensures the graph functions, and grows
• Contributes to the achievement of business
goals
• Your Ops team should have a budget to
spend on resources to ensure they learn,
grow in, master, and ultimately redefine
their roles
• This requires trust, but if you can’t trust
your team, you have problems

122. Graphs require human maintenance (JIRA for Ops Teams)
• How many team members do you have to
monitor and drive Jira task boards?
• A lean operations team is
• Focussed on maintaining the JIRA graph
• Ensures the graph functions, and grows
• Contributes to the achievement of business
goals
• Your Ops team should have a budget to
spend on resources to ensure they learn,
grow in, master, and ultimately redefine
their roles
• This requires trust, but if you can’t trust
your team, you have problems
• Question: ‘Who is empowered to spend
up to £1000 (now)?’

123. How to Break a Graph
• Hyperlinking makes and maintains
connections

124. How to Break a Graph
• Hyperlinking makes and maintains
connections
• Always OpenSource information

125. How to Break a Graph
• Hyperlinking makes and maintains
connections
• Always OpenSource information
• Expand the network, let others develop
your information or ideas in new ways

126. How to Break a Graph
• Hyperlinking makes and maintains
connections
• Always OpenSource information
• Expand the network, let others develop
your information or ideas in new ways
• Unbroken graphs, can expand
independently and dynamically

127. How to Break a Graph
• Hyperlinking makes and maintains
connections
• Always OpenSource information
• Expand the network, let others develop
your information or ideas in new ways
• Unbroken graphs, can expand
independently and dynamically
• Avatao Open Source case study

128. How to Break a Graph
• Hyperlinking makes and maintains
connections
• Always OpenSource information
• Expand the network, let others develop
your information or ideas in new ways
• Unbroken graphs, can expand
independently and dynamically
• Avatao Open Source case study
• Hackathons for developers

129. How to Break a Graph
• Hyperlinking makes and maintains
connections
• Always OpenSource information
• Expand the network, let others develop
your information or ideas in new ways
• Unbroken graphs, can expand
independently and dynamically
• Avatao Open Source case study
• Hackathons for developers
• Open source engine:

130. How to Break a Graph
• Hyperlinking makes and maintains
connections
• Always OpenSource information
• Expand the network, let others develop
your information or ideas in new ways
• Unbroken graphs, can expand
independently and dynamically
• Avatao Open Source case study
• Hackathons for developers
• Open source engine:
• https://github.com/avatao-content/
challenge-toolbox

131. Graphs and DevOps
• Continuous Integration (CI) produces graphs, however we don’t test CI

132. Graphs and DevOps
• Continuous Integration (CI) produces graphs, however we don’t test CI
• In DevOps, the production pipeline is pushed faster and faster, creating
problems further along the way

133. Graphs and DevOps
• Continuous Integration (CI) produces graphs, however we don’t test CI
• In DevOps, the production pipeline is pushed faster and faster, creating
problems further along the way
• We need to think of the CI pipeline as a graph

134. Graphs and DevOps
• Continuous Integration (CI) produces graphs, however we don’t test CI
• In DevOps, the production pipeline is pushed faster and faster, creating
problems further along the way
• We need to think of the CI pipeline as a graph
• Write rules (i.e. tests) to validate our expectations

135. Graphs and DevOps
• Continuous Integration (CI) produces graphs, however we don’t test CI
• In DevOps, the production pipeline is pushed faster and faster, creating
problems further along the way
• We need to think of the CI pipeline as a graph
• Write rules (i.e. tests) to validate our expectations
• We need Static analysis technology !!!!!! (SAST for CI)

136. Graphs and DevOps
• Continuous Integration (CI) produces graphs, however we don’t test CI
• In DevOps, the production pipeline is pushed faster and faster, creating
problems further along the way
• We need to think of the CI pipeline as a graph
• Write rules (i.e. tests) to validate our expectations
• We need Static analysis technology !!!!!! (SAST for CI)
• This will allow us to understand how the pipeline behaves and
interconnects

137. Recruiting as a graph (for recruiters and candidates)
• You need to find matches (roles to candidates) by
mapping their skills, talent, and experience in a graph

138. Recruiting as a graph (for recruiters and candidates)
• You need to find matches (roles to candidates) by
mapping their skills, talent, and experience in a graph
• What we want to see from candidates is their:

139. Recruiting as a graph (for recruiters and candidates)
• You need to find matches (roles to candidates) by
mapping their skills, talent, and experience in a graph
• What we want to see from candidates is their:
• GitHub, Twitter, and blogging activities,

140. Recruiting as a graph (for recruiters and candidates)
• You need to find matches (roles to candidates) by
mapping their skills, talent, and experience in a graph
• What we want to see from candidates is their:
• GitHub, Twitter, and blogging activities,
• Contributions at conferences

141. Recruiting as a graph (for recruiters and candidates)
• You need to find matches (roles to candidates) by
mapping their skills, talent, and experience in a graph
• What we want to see from candidates is their:
• GitHub, Twitter, and blogging activities,
• Contributions at conferences
• Open Source collaborations

142. Recruiting as a graph (for recruiters and candidates)
• You need to find matches (roles to candidates) by
mapping their skills, talent, and experience in a graph
• What we want to see from candidates is their:
• GitHub, Twitter, and blogging activities,
• Contributions at conferences
• Open Source collaborations
• The good candidates will behave as if they are
already working for the company

143. Recruiting as a graph (for recruiters and candidates)
• You need to find matches (roles to candidates) by
mapping their skills, talent, and experience in a graph
• What we want to see from candidates is their:
• GitHub, Twitter, and blogging activities,
• Contributions at conferences
• Open Source collaborations
• The good candidates will behave as if they are
already working for the company
• hack it (i.e. find vulns and report them)

144. Recruiting as a graph (for recruiters and candidates)
• You need to find matches (roles to candidates) by
mapping their skills, talent, and experience in a graph
• What we want to see from candidates is their:
• GitHub, Twitter, and blogging activities,
• Contributions at conferences
• Open Source collaborations
• The good candidates will behave as if they are
already working for the company
• hack it (i.e. find vulns and report them)
• collaborate with company’s teams

145. Recruiting as a graph (for recruiters and candidates)
• You need to find matches (roles to candidates) by
mapping their skills, talent, and experience in a graph
• What we want to see from candidates is their:
• GitHub, Twitter, and blogging activities,
• Contributions at conferences
• Open Source collaborations
• The good candidates will behave as if they are
already working for the company
• hack it (i.e. find vulns and report them)
• collaborate with company’s teams
• Add value (somewhere)

146. Recruiting as a graph (for recruiters and candidates)
• You need to find matches (roles to candidates) by
mapping their skills, talent, and experience in a graph
• What we want to see from candidates is their:
• GitHub, Twitter, and blogging activities,
• Contributions at conferences
• Open Source collaborations
• The good candidates will behave as if they are
already working for the company
• hack it (i.e. find vulns and report them)
• collaborate with company’s teams
• Add value (somewhere)
• We want to see if they can “think in graphs”

147. Turning the problem into the Solution

148. Turning the problem into the Solution

149. Turning the problem into the Solution

150. Each square represents a time period

151. Chiswick Timeline

156. https://www.youtube.com/watch?v=RlyPSY0KS2k

157. We (in this room) are the crazy ones

158. We (in this room) are the crazy ones
We are the ones that believe we can
change the world

159. Next Summit
2018, June
Will you be there?

160. Final Thoughts
• The security industry/community needs to work collaboratively to
keep up with all that is required to protect our industry

161. Final Thoughts
• The security industry/community needs to work collaboratively to
keep up with all that is required to protect our industry
• As cyber-criminals refine their business model and act more like
corporate entities

162. Final Thoughts
• The security industry/community needs to work collaboratively to
keep up with all that is required to protect our industry
• As cyber-criminals refine their business model and act more like
corporate entities
• This is not going to get easier

163. Final Thoughts
• The security industry/community needs to work collaboratively to
keep up with all that is required to protect our industry
• As cyber-criminals refine their business model and act more like
corporate entities
• This is not going to get easier
• Everyone has a role to play

164. Final Thoughts
• The security industry/community needs to work collaboratively to
keep up with all that is required to protect our industry
• As cyber-criminals refine their business model and act more like
corporate entities
• This is not going to get easier
• Everyone has a role to play
• Sec industry needs to think of itself as a graph

165. Final Thoughts
• The security industry/community needs to work collaboratively to
keep up with all that is required to protect our industry
• As cyber-criminals refine their business model and act more like
corporate entities
• This is not going to get easier
• Everyone has a role to play
• Sec industry needs to think of itself as a graph
• We need to leverage connections, data, knowledge, and experience

166. Final Thoughts
• The security industry/community needs to work collaboratively to
keep up with all that is required to protect our industry
• As cyber-criminals refine their business model and act more like
corporate entities
• This is not going to get easier
• Everyone has a role to play
• Sec industry needs to think of itself as a graph
• We need to leverage connections, data, knowledge, and experience
• Owasp CDC (Collective Defence Cluster) is a good example of this

167. Join the conversation #DevSecCon
Thanks for listening
@DinisCruz