For Everyone

Introduction#

Welcome to the Security Training for Everyone section. This training will be painless, quick, and hopefully informative as well.

It's worth noting that this training is mandatory for all staff. Vidyard has obligations to staff, customers, and investors to uphold the standards set by our security program. One such obligation is ensuring that our staff are knowledgeable and equipped to deal with security issues that inevitably arise in the course of modern business.

Tracking Attendance#

In the past I have tracked your enthusiastic participation by sending out a quiz with silly questions that still made you look in our policy documents. This year instead you will receive a quiz with only a few multiple choice questions. Pay attention as you read through these slides, and the answers will be super simple and obvious to you in the end. Good luck!

To track your own progress as you go, you can click the slide to mark it as "Read", but this is optional.

Goal of this Training#

Why do you need to know about security threats? We have a security team, don't we?

In theory, I could design a system and network that would be very-nearly impenetrable by even the most Elite Criminal Underground Hacker Organization. It could have so many fences, armed guards, gated entrances, cameras, and drones equipped with tazers and lazers.

But it wouldn't be usable or useful. It would be a giant fortress of inconvenience. You'd hate it, I'd hate it, customers would hate it.

Those inconveniences need to be removed and managed so that we can operate and function. This is where you come in. When these inconvenient protections are removed, we open a door into our otherwise protected fortress. It's up to you to understand the risks of how to operate that door, what risks exist for that door, and how to report when that door isn't functioning as it should.

Since joining Vidyard, I have developed policies and processes from a place of TRUST. I trust you all to Do The Right Thing, and have not placed restrictions in place that prevent you from getting your job done, or placing unreasonable inconveniences on you in the name of security. In my 7 years here, I have yet to regret this decision. For that, I thank you all!

Security Is HARD#

Some security functions and concepts are challenging to understand and implement. This can create resource issues, skills gaps, or it can be downright scary. It might feel easier to simply skip that part and simply hope nothing bad happens.... (spoiler, something bad WILL happen)

Vidyard's Security Team is here to help provide guidance and direction on implementation for any software, hardware, or service, whether directly related to security or not.

Our job is to strike a good balance between security and convenience. We want to make sure that Vidyard as a product, and as an office environment, is both secure and usable. Our goal is not to add friction to your day-to-day jobs, but we can't sit entirely at the convenience end of the spectrum either. Certain security functions need to exist to provide us all with continued employment by protecting our brand, our systems, and our staff from harm and damages.

Know Your Enemy#

In the beginning the Internet was created. This has made a lot of people very angry and has been widely regarded as a bad move.

Many people saw the Internet and technology as a wonderfully innovative change that could connect people, transform the way we communicate and operate, and solve a lot of problems humanity faced. And they weren't entirely wrong.

However, since the beginning of human consciousness, there have been members of society who would rather cheat, deceive, destroy, and force their way into obtaining their desires. The Internet grants these societal members with the means to use these tactics while granting the oft-taken option of total or partial invisibility.

Sometimes these people are satisfied just from commenting horrible things on your posts under the cloak of anonymity. Other times, maybe they send you a few harassing messages, or post your information to a forum to let The Hordes do the work for them. Other times they run a few scripts (or their Low Orbit Ion Cannon for the more enterprising script kiddie) pointed at your business in hopes they can cause a bit of mayhem.

Unfortunately, there are worse threats than a disgruntled internet sociopath, and unfortunately they tend to be more sophisticated and with clear goals.

Low Orbit Ion Canon (LOIC)

Nation States#

Politics, land boundaries, commodities, and love.

Throughout history humans have battled over these, and now we have a new thing to fight over: information.

Nation states (countries, military, and political entities) have added Cyber-warfare to our global lexicon. This concept is not new, and evidence of informational coercion, deception, and interception have been popular attack vectors since WWII.

Luckily for Vidyard, we aren't really in a position where we're going to suddenly have a Nation State trying to hack into our database for poignant political reasons.

However, for our clients, this might be a much larger concern. Any organization operating near agriculture, finance, health, food, geographical, prospecting, etc., may be a target for the interest of foreign actors. Vidyard needs to honour the requirements that our customers may have in this area.

Hacking Groups#

Hacking Groups have existed for decades (Legion of Doom / Masters of Deception anyone ?), and their motives have evolved over time. In the 80s/90s these groups mostly focused on cracking software (piracy) or defacing websites (vandalism).

However, as banking institutions and commerce adopted more Internet-technology to their operations, these motives started to shift and these groups started collecting Payment Card data, personal information, and other financially driven assets.

Lone Hacker / APT#

A Lone Hacker is the archetype that you see in movies. Usually looks like they just stepped out of an industrial music concert sporting a KMFDM hoodie with a bottle of Jolt Cola in their knapsack. One day in the near future this person will be working for a big corporation where they reverse engineer malware and viruses, but right now their job sucks and they hate the world for it. Not only do they hate the world, but they hate the success of others.

This person usually spends their time on the Darknet, reading forums, writing Zero-Days, and posting (anonymously) about the companies they've hacked. This isn't about money; this is about notoriety.

These folks usually pick a target, and then that target becomes their obsession for several months until they're either in, or bored. Most of the time they're bored, but sometimes? Sometimes they're in.

Bored or Disgruntled (ex-)Employee#

Most threats to an organization are not government/military, hacker groups, or basement-dwelling sociopaths. Most of the time, it's Bob from accounting or Alice from marketing.

A terminated employee will on occasion be highly charged with a revenge motive, and it's not uncommon for a recently departed employee to phone a colleague to reinstate access in order to cause some mischief or chaos on their way out.

Fun fact: 2/3 of the people in this photo have privileged production access.

Read

Let's get on to the meat of the presentation. And to start, this stock photo which tickled Tyler Vincent absolutely pink.

For those who've not heard the term before, here's a quick definition of what social engineering is. Basically it's a type of confidence trickery. Convincing people to give up information either without them realizing it, or by making them believe you're someone else.

If you think that this is a hard thing to pull off, next time someone you know needs to change their utility bill, ask if you can call in for them. Armed with their birthdate, and name, you can call in once to gather more information on them, such as their last bill amount or previous addresses. Then call in again, get another agent, and use that information to get their current address or last 4 digits of their credit card. Then call back in and cut off their electricity as a harmless prank! #lol

Social engineering is about building trust, obtaining information, and ultimately building a believable persona and story.

This is hard to defend against, since human nature is to want to help others.

So if someone contacts you claiming to be an employee, and you've never heard of them before, verify they are who they say they are via another channel. If they email you, ping them on Slack to check (and vice versa). Zoom call to see their face, and if they refuse, maybe it's time to ring Vidyard Security!

Phishing#

Phishing is another tactic where an attacker will send out several hundreds or thousands of emails in the hopes that at least ONE will get a bite. Similar to fishing, where you drop your line in the water and wait for some game fish to be stupid enough to actually bite a device clearly meant to make its day miserable.

How many of you have received an email claiming to be from Michael Litt ( user348671234@hackedmail.ru ) asking you to wire money to him right away? Yeah, that's not actually Mike...

It's easy when you see these silly phishing attempts to dismiss them as "obvious" or "fake", but like our little fishy friend in the previous paragraph, someone out there is going to be distracted, uninformed, or impulsive enough to actually take the bait and have a miserable day.

Protecting Yourself#

Our mailing servers have spam protection, spoof protection, and various other detection mechanisms. That said, sometimes the odd little piece of EVIL gets through. Remember when we talked about convenience vs security? It's better to let a bit of EVIL in and deal with it, than it is to lose the chance at a connection with a prospect or customer!

If you suspect you've received a phishing attempt, send it on over to helpdesk@vidyard.com for archiving and trending. Our teams can also verify through some technical processes whether the email is valid or not.

Finally, remember to never click on any links in a mail you think may be phishing.

Passwords#

Passwords, passphrases, PINs, secret keys. These are all strings of characters, numbers, and symbols that are stored on a system or service that grant access to those who know it.

If kept secret and safe, the system or service will remain perfectly secure forever!

Or will it....?

Cracking Passwords 101#

I'm not usually the type of person to cry doom and despair, or instill fear into those within earshot of my soapbox. But when it comes to passwords, I most certainly do.

Why? Because everyone reuses their passwords. And when you reuse a password at Vidyard that you also used on good-doggo-forums.com, our security now relies on good-doggo-forums.com to keep their information secure.

To illustrate this, some technical background must be explored. (Don't worry, I'm not going to delve this deep on every technical topic in this training. I'm just using this one for illustrative purposes)

Hashing#

We'll start with something called "Hashing".

This magic process takes the password you entered when you create an account, and turns it into a garbled-looking string. This new string is irreversable (you can't figure out what password created it), but it's repeatable (if you enter the same password again, you get the same string).

Matches?#

This is really handy because your actual password never needs to be stored. If you enter the same password to login that you created when you made your account, those two garbled-looking strings will be identical and that's all the security system needs to know in order to consider you authenticated.

They're good dogs, Bront.#

Let's pretend we just social-engineered Good-Doggo-Forums.com and we were able to get the password from one of their developers by promising to send them 40 Bitcoins if they logged in to our phishing page with their admin password. Now that we have that password, we logged into their database and exported the users table.

Sweet! Now we have a huge list of every username and hashed password! But, didn't I say those passwords were irreversible? I did! So, aren't these password hashes, useless? They are! But, with some clever work, watch what we can do.

First, let's take a look at that list and look for duplicates. It looks like arup and pumpkin22 both have the same hash. Remember, hashing is a repeatable process, so these two passwords must be the same. Now look at the password hint column. Scary movie? Fave holiday (for username pumpkin22?). 100% this password is "halloween".

Next, james and rich both have the same password. Their hints are "fav person", and "Freddie Mercury's Band". Well, my guess is that rich likes the british monarchy, and both of these passwords are "queen".

You might think these examples are far-fetched, but most people don't ever think anyone would ever look or see their password hints, and they make these really, really easy. In some cases, people put their PASSWORDS into this field. I kid you not.

(You might also be thinking about how rare it would be to have two pairs of duplicate passwords in a list with only 7 items, but again this is illustrative and in a password list with several million lines you can rest assured you'll have duplicates)

Let's get brutal#

So we've exhausted all the hints, and we're left with a bunch of hashed passwords. Either we give up now and use the passwords we've obtained, or.. in the spirit of 1337 hax, we're going to get that admin password, and the rest of them while we're at it.

We're going to use Rainbow Tables. These are massive pre-computed lists of passwords that have been run through the hashing process already, and now we just take those strings in the password field and search for them in the rainbow tables.

On modern computers with a modest graphics card, we can whip through several trillion hashes per second in our search through the rainbow tables. This is called BRUTE FORCING a password. Sort of like banging a padlock with a sledgehammer until it opens, but not quite as loud.

Cracked#

And we've done it. The passwords left over in this password list were quickly found using rainbow tables. Sarah's password? Well that one was hard and it took an extra week and a few more TBs of Rainbow Files, but we got it.

Now that this password file has been cracked wide open, what do we do with it? Well, a common thing to do is to sell this file for a few BTC or XMR on the DarkWeb, where someone can anonymously purchase and download it for their own uses. Or, if we just want to watch the world burn, we would just post it to pastebin.com and let folks on Reddit have at it.

Let's say that this database has an email address field. Let's say further that you, as an employee of Vidyard, use your work email to sign up to good-doggo-forums.com. Let's further suppose that you re-use passwords.

See where I'm going here?

What happens when passwords are leaked?#

Read 078 Reference.

These breaches happen all the time, and email/password combinations get released publicly all the time. Ever wonder why passwords expire, or have complexity requirements? Now you know.

Best Practices#

I'm going to skip a lot of password policy suggestions here and share a comic that I'm sure many of you have seen before. The longer your password is, the harder it will be for a pre-hashed rainbow table to have it. Every added character, and every additional requirement (number, uppercase, symbol) adds on an immense amount of complexity to the challenge of pre-hashing it.

But you still shouldn't reuse it between sites. There are other ways to get passwords such as keylogging, phishing attempts, and social engineering and an attacker just needs to get your "correct horse battery staple" one time to hash it and check the available password files for duplicates.

So, if re-using passwords is bad, the solution is to have a BUNCH of different passwords... How will you remember all of those different passwords?

Use a Password Manager#

You need to use a tool called a "Password Manager". There are lots out there, and you've probably heard of a lot of them. "LastPass", "1Password", "KeePass", etc. They each have their own pros and cons depending on how you prefer to operate. Most have browser plugins to automatically enter your passwords for you (although there have been some security issues there in the past).

But they're all designed to do pretty much one thing. Store a lookup of all your usernames and passwords, protected by a single "master password", which is the one password (hey, that's the name of one of the tools) you need to remember. The idea is that it'll be the last password (hey, that's the name of another one!) you need to remember.

Multi-Factor In Plain English#

Read 102 Reference

In the field of authentication, there are three main types of evidence (or "factors") you can provide. These are called "Knowledge", "Possession", and "Inherence".

In plain English, that's Something you know, Something you have, and Something you are.

So, something you know would be a password. Something you have would be your phone, or a physical object (token fob, etc). And something you are would be a fingerprint, your face, or some other form of biometrics.

The idea here is that an attacker is unlikely to obtain two or more of these. If they stole your password from one of those password lists, it's super unlikely they don't have your phone to get the second token required to log in.

What is physical security?#

It's important to keep our office environment secure, we don't want random folks wandering around stealing information or equipment. If you see someone you don't recognize acting suspicious, just ask questions. Introduce yourself and make a new friend, since 99% of the time it's going to be a new employee or a guest of another Vidyardian.

If their answers don't satisfy you, and you think they're sketchy, alert the security team and we'll take care of it. Don't put yourself in danger, and leave if you feel uncomfortable. We are trained in various forms of martial arts and have weapons stored in the server room for dealing with advanced threats such as extra-terrestrial militias. Just kidding, we'll call the cops.

Lock Your Computers!#

I can't stress this enough. If you're not at your computer, lock it. It only takes someone with basic knowledge under a minute to cause some serious destruction. It's likely you're already logged in to all of your services, which means anyone at that keyboard now has that same level of access.

It also only takes a minute to pop in a USB drive, install malware, or copy files.

If you see a laptop at work left unlocked, resist the urge to troll that user in the form of goating, or emailing team@vidyard.com with an invitation to buy everyone lunch. Just sanitize your hands, lock their computer for them, and send them a Slack DM to let them know that they forgot to lock their computer.

Don't ignore this at home either. Threats at home exist in the form of cats and kids.

This happened just recently, where someone left their laptop unlocked at home and their kid typed gibberish into the US Strategic Command's Twitter account. For context, the US Strategic Command (USSTRATCOM) is responsible for strategic deterrence, global strike, and operating the Defense Department's Global Information Grid. Nukes. Okay? NUKES. (okay, well, TWEETS about nukes...)

Office Building Keycards / FOBs#

Your access to the Vidyard office is granted by use of a security FOB or keycard. This FOB ties your identity to the person who opened that door. All of these access attempts (granted or failed) are logged on our backend system and tied to a camera system.

This FOB needs to be kept secure at ALL TIMES. Don't lose it! And well, if you DO lose it, let us know AS SOON AS POSSIBLE! We can disable access to the office and get you a new one quite quickly.

Please don't keep Vidyard related symbols or logos on your keychain with your FOB too. If you drop your keys in the parking lot and someone picks them up, they'll know exactly which doors that FOB will unlock. And it won't take someone long to clear out a few laptops or purses.

Building Security#

Once you've used your keycard to unlock a door, please don't prop it open. The doors are locked for a reason, and propping them open kind of defeats that. Listen for the sound of the door closing behind you.

Make sure all your visitors sign in at the front desk, and have a name badge. Not only is this good security practice, but it's required for fire safety too, so we know how many people are in the building should we need to evacuate.

If you're coming in through a door, and someone quickly comes up to catch that door, make sure you recognize them. This is a tactic known as shadowing or piggy-backing. It's fine for someone you know belongs there to skip through, but if you don't recognize them make sure to engage with them and show their FOB to you, or even better have them place it against the reader. I know it's going to be awkward when it works, but it's less awkward than your FOB being tied to a half dozen missing laptops and purses.

This is going to be even more important in a collaboration center where you will OFTEN run into staff that you've never met. So go easy on anyone who asks you to prove who you are too!

Laptop or phone Stolen?!#

If you notice that your laptop or phone was stolen, notify helpdesk@vidyard.com and security@vidyard.com IMMEDIATELY. We have the means to block, lock, and wipe some devices and services quickly in order to minimize the impact of data loss or compromise.

Don't be ashamed or embarrassed, you're not the one who did something wrong.

What is PII?#

Next we're going to cover one of the biggest things we have to protect as an organization : Personally Identifiable Information, or PII for short.

PII is any information that can be used to identify an individual by way of direct identification, or cross referencing with other data or contexts. As you know, we collect, process, and store a LOT of this data for our customers. It's sort of what we do as a business.

Data we collect for our customers includes names, emails, IP addresses, video view data, etc.

Vidyard as an organization is held to various standards to protect this data from being compromised through unauthorized release, tampering, or destruction.

Data Classification#

Read 123 At Vidyard, data is classified as per our Information Security Policy into 3 classifications.

Red - Top secret and highly confidential, mission critical
- Non-public finance related (bank statements, payroll)
- Critical intellectual property (source code) and strategy documents
- Platform management access related information (credentials, passwords)
- Employee related HR documentation
- Client information and stored customer data
- Not to be shared unless authorized by Legal
Orange - Private and confidential, business critical
- Customer wiki and support documents
- Internal employee email messages (subject to further classification depending on content)
- Infrastructure related documentation and diagrams
- Marketing documents
- Requires NDA for sharing
Green - Publically available resources and documents
- Online social media feeds
- Knowledge base articles
- Public marketing documents
- Public financial statements

RED#

Example: Customer Data

As I said earlier, customer data is the most secured and protected data class that we have. It is stored in restricted access areas, never shared with third parties, and should never be copied without explicit approval from senior management, legal, security, and ultimately the customer.

Example: Privileged Credentials

Passwords or private keys to critical infrastructure, data stores, or third party services that store sensitive data. These need to be kept secure absolutely.

Under NO circumstances is any data classified as RED to be shared, copied, altered, or accessed without authorization. Failure to comply with this directive may result in termination or even legal consequences.

ORANGE#

Example: Audit Reports, Vidyard policy documents

Documents such as our SOC 2, quarterly pen-test, and our internal policy documents are regularly requested by clients, prospects, vendors, and contractors. These documents are not quite as critical as their RED counterparts, but ORANGE documents still hold a variety of important secrets. These secrets are not to be disclosed indiscriminately. Ensure that an NDA (Non-Disclosure Agreement) exists between Vidyard and the receiving party before sharing. If in doubt, ask Security or Legal!

Example: Emails, Slack messages/posts, internal notices

It might seem funny to post a screenshot of a Slack post from #dev to Twitter, or to share an internal email with a friend. In most cases this could be completely safe. In others, it can be disastrous.

I've personally received an email from someone where they forwarded an email to me without checking the historical content. In the history was a username and password with access to our payroll system as an admin. Luckily, I'm an upstanding employee and not a basement dwelling sociopath.

GREEN#

Example: Our website, our customer knowledge base, public promotional materials

There are a lot of documents and assets that are completely public. These have very little in the way of security around them, and can be freely copied and shared.

Data Protections#

As Vidyard mostly stores documents in Google Drive, our data is protected from destruction and accidental edits by their back up system. However, this does not prevent accidentally sharing or copying files to the wrong place. While most sharing functionality is subject to our audit logging, there's nothing that can be done when someone prints a document and accidentally drops it in the parking lot. (Technically, we CAN prevent printing of all documents, but here's where that whole security vs convenience thing comes in)

Be mindful of what you're sending, how you're sending, and who you're sending to.

Read 155 155. What about sharing data?

So how do you share data? If you're sending a password internally, try using a Password manager's sharing feature.

Please do not email passwords, and please do not write passwords down. This is important in the office, but it's equally important when working from home. Screenshots have been shared where a person left their notebook open on their desk with a password list while on a Zoom call.

If you're sending data to an external party, check the data classification list above, or in our Vidyard Information Security Policy.

If it's classified RED, don't share it.

If it's Orange, make sure there's an NDA before you send. Sending ORANGE documents can be sent via email, although if you're concerned about the content, send it via Digify or another secure sharing document system (Dropbox works too).

CAVEAT: If the documents are related to a legal or security process, please check with the legal or security team before sending.

Restrict Access#

When sharing a document internally with Google Docs, share only to those that require access. This concept (the concept of Least Privilege Access) also can apply to user and role privileges, service access, and more.

It's much easier to add access when someone requests it explicitly, than it is to audit 2,000 documents to remove those that shouldn't. Trust me on this one ;)

Confirm the Account You're Using and Sending#

In the old world, an entire family would share an email address given by their ISP. We would all gather round the family PC on a Friday night, connect to our dial-up, and wait while our mail client downloaded the week's 3 emails.

In the new world, we all have multiple email addresses. At the time of writing, I have 14 of my own that I use for different purposes and mindsets.

It's easy to get confused and accidentally send something from the wrong account.

One way to avoid this is to change the theme on your email clients. Maybe make your work email a bright DANGER RED, and make your personal account a nice relaxing lavender colour.

When sending, double check that you're sending to a Vidyard.com address (Gmail WILL warn you now about this), so that you don't accidentally send a sensitive file to a Vidyard employee's personal email. Once it's in their personal inbox, it's not longer in control and should be considered impossible to delete or track.

Summary - Data Handling#

If ever in doubt about the sensitivity of a document, please reach out to Security or Legal.

Sometimes the sensitivity can be subjective, and we're always here to help.

Compliance#

Read

Now for my favourite topic... COMPLIANCE.

Vidyard is in a lucky spot because most of the data that our customers store with us is not top secret in nature. We don't need to comply to financial or health regulations, and we don't process state secrets.

However, we DO collect, process, and store consumer data. And these days, consumer data is a hot topic.

Read 131 Reference

GDPR went into effect on 25th May 2018, and has very strict rules for how personal information should be handled, with big fines for those who don't follow the rules. We are subject to GDPR, as we handle data for users who are EU citizens.

Vidyard has included extra steps in our development processes to include data protection from the onset of designing our systems, rather than something that's added on later.

Data portability is the right for a data subject (i.e. our users) to receive the personal data we have stored which concerns them. We need to provide this in a "commonly used and machine readable format". The user also has the right to transmit that data to another controller.

Another thing GDPR requires is the "Right to be Forgotten", also known as Data Erasure, this entitles the data subject to have the data controller erase his/her personal data, cease further dissemination of the data, and potentially have third parties halt processing of the data. We already allow customers to purge their information from Vidyard on request, so again, we already satisfy this constraint.

One very important part is that we have to specify the intended purpose of all personal data we will process, and cannot use that data for any other purpose. For example, if we specify the intended purpose of collecting email addresses is to send notifications, we cannot then use that email address to send the user marketing material (and vice-versa).

There are very hefty penalties for any breach of GDPR. 4% of annual global turnover, or €20 Million, whichever is greater.

SOC2 Type II#

SOC 2, or Service Organization Controls 2, is an industry standard audit for businesses that tests and reports on the security, availability, integrity, confidentiality, and privacy controls implemented by a business entity. We obtain this audit report annually, and address any exceptions or gaps in a timely manner.

Many of our customers require that we obtain this audit, and in some cases they require that we only engage with third parties that also have a SOC 2 report if processing or storing their data on our behalf. This would include third parties such as AWS, Edgecast, and Salesforce.

Our SOC report should be considered under data classification ORANGE, and can only be shared under NDA.

Llama#

Now for the second thing for you to remember about this presentation:

The animal is a Llama. His name is Larry, if you're wondering.