[{"_1":2,"_84":-5,"_85":-5},"loaderData",{"_3":4,"_33":-5,"_34":35,"_70":71,"_82":-5,"_83":-5},"root",{"_5":-5,"_6":-5,"_7":8,"_20":-5,"_21":22,"_23":24,"_27":28},"user","shoppingCartId","shoppingCart",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":12},"count",0,"free",true,"updatedAt","2026-01-11T16:24:29.628Z","paymentGateway","STRIPE","cartItems",[],"loading","toast","locale","en","constants",{"_25":26},"paypalClientId","AX53Cwz8jR6rVVzzZiZNWWXl0dGagi-GZrjG-S3Ua14E5nrKMn7DxDQ730O4R8LusLPp49ALn6aRVaEy","publishers",{"_29":30,"_31":32},"companies",[],"universities",[],"routes/_store+/_readers+/read_/route","routes/_store+/_readers+/read_.$slug/route",{"_36":37,"_63":64,"_65":66,"_67":68,"_69":-7},"book",{"_38":39,"_40":41,"_42":43,"_44":45,"_48":49,"_51":52,"_61":62},"title","Hacking Portugal","slug","hacking-portugal","metaText","As technology and software become more and more important to Portuguese society, it is time for Portugal to take them more seriously.","coverFeatured",{"_46":47},"url","https://d2sofvawe08yqg.cloudfront.net/hacking-portugal/s_featured?1620553761&1620553761","coverFeatured2x",{"_46":50},"https://d2sofvawe08yqg.cloudfront.net/hacking-portugal/s_featured2x?1620553761&1620553761","authors",[53],{"_54":55,"_56":57,"_5":58},"id","Z2lkOi8vbGVhbnB1Yi9TdG9yZTo6UHJvZHVjdEF1dGhvci8yOTUwNQ","name","Dinis Cruz",{"_59":60},"username","diniscruz","showReadLinkString","full","parts",[],"toc",[],"isUnavailableOnline",false,"unavailableMessage","routes/_store+/_readers+/read_.$slug.$chapterId/route",{"_38":39,"_72":-5,"_36":73,"_79":-5,"_80":81},"content",{"_74":75,"_38":39,"_42":43,"_40":41,"_61":62,"_76":77,"_78":-5},"previewContent","

\n \n
- \n Introduction\n
  - \n Why I’m doing this\n
  - \n Summary of Chapters\n
  - \n Acknowledgements\n
  - \n Please give me your feedback\n
  \n
- \n Portugal should be hostile to insecure code\n
  - \n Attack vulnerable code\n
  - \n Next generation of internet users\n
  \n
- \n PHS - Portuguese Hacking Service\n
  - \n Portuguese hackathon league\n
  - \n Other sources of talent\n
  - \n Working together\n
  \n
- \n “Made in Portugal”\n
  - \n Best in world\n
  - \n Portugal as a leader in AppSec\n
  - \n “Code Made in Portugal” brand\n
  \n
- \n Past innovations\n
  - \n Drugs Decriminalization\n
  - \n Portuguese innovation for the 21st Century\n
  - \n Tesla in Portugal\n
  \n
- \n How Secure is Portugal?\n
  - \n Our security model is based on a lack of attackers\n
  - \n The Emperor’s new clothes\n
  - \n Think I’m wrong?\n
  - \n The financial markets hack\n
  - \n Cyber crime is the problem\n
  - \n Attackers’ ROI (return on investment)\n
  - \n Thank your attackers\n
  - \n Military\n
  - \n Why do we have F16s?\n
  - \n Hit by the crossfire\n
  \n
- \n Public health analogy\n
  - \n Red or blue pill?\n
  - \n Public health problem\n
  - \n Sane defense model\n
  - \n Where is the AppSec industry?\n
  - \n Be proactive\n
  \n
- \n Hack like football\n
  - \n Let’s do the same for hacking\n
  \n
- \n Hacking\n
  - \n Hacking created the Internet\n
  - \n Real world hacks\n
  - \n Hackers’ values\n
  - \n Creating Your future\n
  - \n Be different\n
  \n
- \n Open source\n
  - \n Openness is key\n
  - \n Open source is not Communism\n
  - \n FOSS Values\n
  - \n Open Source is expensive\n
  - \n Open source lingua franca\n
  - \n OpenSource.pt\n
  - \n Open the source of Portuguese code\n
  - \n The next level App Security Social Graph\n
  - \n The cathedral’s eyeballs\n
  - \n Use Git to version legislative development and ask for public consultation\n
  - \n Principle of Public Access in Sweden\n
  \n
- \n Privacy\n
  - \n Defend privacy\n
  - \n Cryptography\n
  - \n The Need for Disclosure\n
  - \n Whistleblowers have an important role\n
  - \n Protected by law\n
  - \n Limited privacy for state and companies\n
  - \n Learn from the music industry\n
  \n
- \n Government\n
  - \n Collaborative Commons\n
  - \n Government’s role\n
  - \n Code is Law\n
  - \n Who controls the world?\n
  - \n Governments can make a difference\n
  - \n Iterate exponentially\n
  - \n Ministry of Code\n
  - \n Clear Software Act\n
  - \n Software Testing Institute\n
  - \n ASAE for code\n
  - \n When regulation loses the plot\n
  - \n Portugal-wide bug bounty\n
  - \n Insurance\n
  - \n Solution is not to buy ‘security’\n
  - \n Code Nationalization\n
  - \n Review and beta test legislation\n
  - \n European Union\n
  - \n New currencies for Southern Europe\n
  \n
- \n Investment in infrastructure\n
  - \n Design companies\n
  - \n Example scenario\n
  - \n Internet-based model\n
  - \n Exponential growth\n
  - \n Open Source the project\n
  - \n Transportation investment fund\n
  \n
- \n Economics\n
  - \n Uber\n
  - \n Portuguese Emigrants\n
  \n
- \n Education\n
  - \n Skills\n
  - \n Git is a core skill\n
  - \n Education\n
  - \n University course\n
  - \n Threat Models as strategic activity\n
  - \n CV\n
  - \n For the developers\n
  - \n Real time unit test execution and Code Coverage\n
  - \n Sharing is a Very Emotional and Dangerous Practice\n
  - \n Creating a sharing culture by embracing Creative Commons\n
  \n
- \n Actions and recommendations\n
  - \n Actions\n
  - \n Recommendations\n
  - \n Other recommendations\n
  - \n Recommendations for education and training:\n
  \n
- \n Why Portugal?\n
  - \n Easier in a small country\n
  - \n Raise the bar of the discussion\n
  - \n Big questions\n
  - \n Best in ‘graduating high school’?\n
  - \n Protect the internet\n
  - \n Portugal needs to export engineers\n
  - \n What is the future of Portugal?\n
  - \n Sail the Code\n
  \n
\n

Introduction

\n\n

This book is based, and expands on, a presentation given at BSidesLisbon on 9 November 2016.

\n\n

If the word ‘hack’ means to solve problems, then ‘Hacking Portugal’ means to find innovative was to solve existing problems.

\n\n

The ideas I consider here look to the future, as some of the concepts are too radical until the AppSec problem becomes much bigger. They are ideas for a future when solutions are wanted.

\n\n

As technology and software become more and more important to Portuguese society, it is time for Portugal to take them more seriously, and become a real player in that world. This book discusses several ideas to make Portugal a place where programming, TDD, Open Source, learning how to code, hacking (aka bug-bounty style), and DevOps receive the consideration, investment and respect that they deserve. Application Security can act as an enabler for this transformation, due to its focus on how code and apps work, and its enormous advances in secure-coding, testing, dev-ops and quality.

\n\n

Why I’m doing this

\n\n

I have been studying this area, and its various challenges and possibilities, for some time, and for many reasons.

\n\n

The current economic model is not working for secure code and secure software development, and it is not working for many parts of the general population. In many cases, it doesn’t make business sense to spend the time and effort creating secure code, because the customer cannot measure it. I believe we must innovate our way out of this problem.

\n\n

I have considerable experience working in the AppSec industry, and this allows me to see the problems coming down the line. However, the same experience also allows me to see solutions to the problems, and I want to share and discuss my ideas for these solutions. Moreover, I want to create a safe future for our kids.

\n\n

Summary of Chapters

\n\n

In ‘Portuguese network to be hostile to insecure code’, I discuss the possibility of Portugal becoming a hostile place to create, publish or host insecure apps or IoT appliances. The creation of a safe internet in Portugal is possible, but it will need the support and input of Creative Commons, regulatory and market forces, and communities, for it to work. We need new ideas and different perspectives for this to succeed.

\n\n

‘Hackers’ considers the term ‘hackers’, as opposed to ‘attackers’, and discusses how hacking can help to create a secure internet for Portugal. The sound ethical values of the hacking community can inspire the next generation of internet users.

\n\n

‘How Secure is Portugal’ examines how Portugal, despite being a digital country with a great dependence on software, has many vulnerabilities and exploitable assets, which make it highly vulnerable to cyber-attack in the future. Implementing the correct measures, for example by utilizing and increasing the InfoSec and AppSec talent available in Portugal, will help to mitigate the risk of attack.

\n\n

‘Portuguese Hacking Service’ suggests that 15-20 year olds should undertake their ‘Hacking Service’, a new version of the former Portuguese Military Service. The chapter also looks at the Portuguese military budget, and argues that a percentage of it should be diverted into virtual battles against cyber-attacks on Portuguese assets. Everyone should learn to hack, including criminals and retired people, for the general benefit of Portuguese Government, business, and society. New structures like a ‘Portuguese Hackathon League’ would develop Portugal into a country as famous for hacking as it is for football.

\n\n

‘Portuguese Innovations’ looks to the glorious history of Portuguese innovation, from the Carrack ship to marmalade, to the more recent success of drugs decriminalization in Portugal, which has dramatically reduced the rate of drugs overdoses and drug-related deaths.

\n\n

‘Leader in cyber and application security’ looks to the future of Portuguese innovation, and notes that where Portugal led the way in maritime navigation and innovation in the past, it should now become a world leader in coding and AppSec. The chapter offers some pointers to developers. It also describes cyber security as a public health problem, and states that the techniques used to train cyber security specialists should resemble those used to train medical professionals.

\n\n

‘Privacy’ discusses the importance of privacy to the individual. It notes how cryptography can help the individual to control their data, in a world where some governments and businesses act to reduce, or remove, the technological privacy of the citizen.

\n\n

The chapter goes on to consider the need for disclosure in companies, and the role whistleblowers have to encourage disclosure and improve how markets work. We need legislation that protects whistleblowers and compels disclosure, to create an environment where there is maximum privacy for the individual, and maximum transparency for companies. The way the music industry resisted technological innovation is used as an example of the negative consequences of secrecy and non-disclosure.

\n\n

‘Open Source’ develops the ideas discussed in ‘Privacy’, and notes the importance of openness and transparency to the success of the arguments presented. Programs such as OWASP, Git, and FOSS can help to achieve the desired level of transparency. The chapter discusses the need for Open Source to become a lingua franca, and it suggests specific legislative changes to increase transparency at government and corporate level.

\n\n

‘Government’ acknowledges the role of government as a benign influence to effect change. The chapter recommends the establishment of a Ministry of Code and a Software Testing Institute, but warns that these must be matched by sensible regulation and governance. It also proposes a Clear Software Act, focused on code quality and security. Bug bounties are suggested, and the role of the insurance industry discussed. The European Union, and the creation of new currencies for weaker economies, are also treated.

\n\n

‘Why Portugal’ explains why, from its size to its culture and economy, Portugal is the best location to implement the ideas presented in this book. The chapter concludes with the options facing Portugal: to become a holiday destination, or a Powerhouse of Technology, ready to lead the world in code and security.

\n\n

‘Actions and Recommendations’ summarises the actions and recommendations suggested throughout the book.

\n\n

Acknowledgements

\n\n

Writing this book has been a liberating and empowering experience, allowing me to present my ideas for a country to which I have no business ties. As a Portuguese man who has lived in the UK for the last 20 years, I do have strong emotional ties to Portugal, and a great interest in her future prosperity.

\n\n

I would like to thank BSidesLisbon and C-Days for the opportunity to present these ideas, Ann-Marie Grace for amazing edits, Joyce Chepkorir Kirui for great audio transcriptions, Paulo Coimbra for all the late-night discussions, and many others who helped me to consolidate these ideas, and finally my family (Sarah, Sophia, Emily) for their amazing support and patience.

\n\n

Please give me your feedback

\n\n

This is the first version of this book and I’m planning in making frequent updates.

\n\n

All content is hosted at the Book_Hacking_Portugal GitHub site, where you also will find a location to enter issues and questions.

\n\n

You can also email me directly at dinis.cruz@owasp.org

\n\n

Feedback is highly appreciated, so let me know what you think of the ideas presented in this book :)

\n\n\n\n

Portugal should be hostile to insecure code

\n\n

Here is the key concept of this book:

\n\n

“Make Portugal’s internet a hostile place to create, publish, and host insecure applications and\nIoT appliances”

\n\n

I want the Portuguese internet to be safe. To achieve this, we will need strong Collaborative Commons and community support.\nWe will also need strong enforcement, regulation, and market pressure to make this happen.

\n\n

Portugal has sovereignty over its network, and can pass laws to protect it.

\n\n

I want bots that scan the Portuguese internet to attack, and destroy (in a nice way), insecure code and insecure applications running inside its cyber space.

\n\n

We need health-services for code, with home visits to software developers and other companies to help them improve how they handle their IT infrastructure.

\n\n

This is not about making everyone in Portugal into highly technical computer experts.

\n\n

We want to create an elite section of professionals that are ‘best in class’, who can make the internet, and coding, safe for everybody.

\n\n

Blaming the users for clicking on the wrong link, or blaming developers for using the ‘wrong library’, confuses the cause of the\nproblem with its side effects.

\n\n

A key objective is to make security and AppSec invisible.

\n\n

Security and AppSec are there to protect and ensure that insecure code is detected and mitigated. This is not achieved by using\ncommand and control, but rather with decentralization, transparency, ownership and trust.

\n\n

The cost of bugs and bad, or insecure, software is already significant, even for a country the size of Portugal.

\n\n

Attack vulnerable code

\n\n

I want vulnerable apps and appliances that are plugged into the Portuguese national network to be hacked within seconds.

\n\n

These apps and appliances should be hacked by ‘good guys’, who are trying to help by fixing, or by disabling, as necessary.

\n\n

Government should have a mandate to authorize hacking to vulnerable devices (computers, routes, IoT) and fix them. In a way, this mandate is also ‘given’ by the manufacturer once they push apps/code that contain vulnerabilities.

\n\n

Insurance companies should support this initiative, especially for cases where something goes wrong and a device is ‘bricked’.

\n\n

Next generation of internet users

\n\n

I don’t want the next generation of users to fear the internet, or to allow such a fear to govern their actions.

\n\n

I don’t want them to lose confidence in the internet because of repeated negative experiences, where their identity or credentials are stolen; a doll, a light bulb, a website, an email or other online account is maliciously hacked; a car or a phone malfunctions; or they experience ransomware attacks on files, doorknobs, domestic appliances, or even hospitals.

\n\n

This is not science fiction, and it is only going to get worse. The book Future Crimes: Inside the Digital Underground and the Battle for our Connected World (Goodman, 2016) looks at the issue of technological advances and their influence on crime and criminal behaviour.

\n\n\n

PHS - Portuguese Hacking Service

\n\n

In the past Portugal had a Military Service called ‘Servico Militar Obrigatorio’. We should update this service to the 21st Century and make it a Hacking Service for 15 to 21 year olds, with the following mission objectives:

\n\n

hack everything that is plugged-in to Portugal’s network
hack companies with public bug-bounties
code-review Open Source code developed in Portugal
code-review code marked as ‘strategic interest for Portugal’ (i.e. widely used by Portuguese companies and mission critical for them)
contribute to Open Source projects with patches and fixes
help SMEs with their digital security and DevOps

\n\n

Portuguese hackathon league

\n\n

In the same way that we have a national football league, Portugal should organize and host regular Hackathons, as part of a new, national, hackathon league.

\n\n

The Portuguese hacking teams should go to DefCon, and they should be sponsored by Portuguese government and business. These teams should be a source of national pride.

\n\n

The best way to learn is to solve a problem from a variety of angles, using a variety of technologies.

\n\n

Other sources of talent

\n\n

Everyone should learn to hack, including children, professionals who want to change their careers, and unemployed people. These great sources of talent should be utilized for the benefit of Portugal. Two groups that should also be taught to hack are convicted criminals and retired people.

\n\n

Convicted criminals

\n\n

Teaching convicted criminals to hack would make good use of their skills. It would give them an alternative career to crime, and it would show them a way to make money legally. They would learn a more ethical approach to work, and they would learn the value of collaborating.

\n\n

Most criminals who find themselves in prison do so from bad choices or unfortunate events, and many of them deserve a chance at a better life.

\n\n

Retired people

\n\n

We lose a lot by not using the expertise of retired people, and by not learning from them. In the past, older people were the wise ones, and respected for their knowledge and experience.\nThey are engineers, doctors, programmers, teachers, accountants, architects, parents, etc.\nPeople grow old, not because of age, but because they stop being mentally and physically active.

\n\n

Working together

\n\n

In the world of technology or hacking, it is okay to have teams made up of representatives from the following groups:

\n\n

16 year olds
graduates
retired people
convicted criminals
a dog\n
a professional

\n\n

If they are capable, can work together, respect each other, and deliver on their tasks, they will succeed.

\n\n\n

“Made in Portugal”

\n\n

Best in world

\n\n

Portugal has one of the best football teams in the world.

\n\n

Portugal is currently 8th in the Fifa world ranking

\n\n

Just as in football, Portugal needs to be one of the best in the world in Coding and Cyber/App Security.

\n\n

Portugal as a leader in AppSec

\n\n

Portugal could be a leader in AppSec. Portugal has a rich history of providing leading innovators and ground-breaking researchers in navigation, in maritime research, and exploration. Portugal must build on its history of innovation and achievement, and become a world leader in coding.

\n\n

Portuguese researchers are highly innovative. They are following this great history of leading important change and discovery.

\n\n

“Code Made in Portugal” brand

\n\n

Code that is “Made in Portugal” is the key for the Portuguese economy, and for Europe’s sustainability. It will have a huge influence, and it will be essential to create supply chains of quality and talent.

\n\n

Good software development teams (from developers to management) are one of the most important assets of a company and country. They are the ones who add value. They create reality, and ultimately, they control your lives.

\n\n

“Made in Portugal” will encourage and foment the Portuguese software industry, and this will in turn have a multiplier effect in other industries.

\n\n

The Age of Sustainability is upon us, and Portugal should be at its centre.

\n\n\n

Past innovations

\n\n

Portugal has a great history of inventions:

\n\n

Carrack (Nau) - the Oceanic Carrack (a new and different model, and the largest carrack of its time)
Galleon (the Oceanic Galleon)
Square-rigged caravel (Round caravel)
The Nonius
The Mariner’s astrolabe
The Passarola, the first known airship
The Pyreliophorus
Tempura

\n\n

Drugs Decriminalization

\n\n

The decriminalization of drugs in Portugal in 2001 is a great success story of what happens when bold decisions are made. In 14 years, Portugal went from a very high rate of consumption and overdose, to one of the lowest in Europe.

\n\n

In this case, the innovation was in the approach to drugs and drug addiction. With decriminalization, responsibility passed from the Ministry for Justice to the Ministry for Health: \n>Drug addiction was not to be considered a moral or legal problem but a health challenge . . . In the United States, 90% of the money spent on drug policy goes to policing and punishment, with 10% going to treatment and prevention. In Portugal, the ratio is the exact opposite (Aleem, 2015).

\n\n

Portuguese innovation for the 21st Century

\n\n

The investment and focus I propose in these pages are what 21st century infrastructure is all about.\nAt the moment, Portugal lacks the DataCenters, and the big data pipes that will attract companies to host their sites in Portugal. The development of Portugal as a safe, fast, and well-maintained data hub will make sure this investment and growth happens.

\n\n

Portugal is missing from the current AWS global infrastructure.

\n\n

Portugal is a great place to organize global conferences (Web Summit 2016, OWASP Summits 2011), since it is literally in the middle of the world. We need to make Portugal as attractive a location for writing, hosting and deploying code (i.e. applications).

\n\n

Tesla in Portugal

\n\n

A major objective for Portugal is to be so attractive to companies that they locate in Portugal. The Portuguese government and its agencies should aim to attract companies like Tesla to have factories and R&D facilities in Portugal. This shouldn’t be negotiated as a ‘favor’ or via ‘soft bribes’. It should happen because Portugal has the people, processes, and technology to fulfill Tesla’s vision.

\n\n

There are great synergies between Tesla’s ‘SolarCity’ and the current investment and capabilities of solar power in Portugal, which is a great success story, as Portugal is already producing quite a lot of its electricity using alternative energies.

\n\n

PT needs to develop the equivalent of the Tesla Gigafactories to be energy interdependent.

\n\n\n

How Secure is Portugal?

\n\n

How secure and safe are Portuguese companies and infrastructures?

\n\n

Portugal today is a very digital country, and most Portuguese companies are software companies. If you look at how they operate, they all use software and are controlled by software.

\n\n

The question is, how secure are they? How safe are they? By ‘secure’, I mean how well can they sustain an attack? How well can they detect and react to a possible attack on their digital infrastructure? What is the probability of an attack happening in the short term?

\n\n

Our security model is based on a lack of attackers

\n\n

If Portugal is safe, it is because there are not enough attackers targeting the current insecurities of the system. This will probably remain the case for the next couple of years. The problem is what happens after that, when the criminals improve their business models and start to focus on Portuguese assets.

\n\n

The bottom line is that the current ‘secure state’ of Portugal’s government, companies, & people, where the likelihood of an attack happening is low, depends on the following assumptions:

\n\n

A low number of attackers
A low level of skill among existing attackers
The existing attackers’ unsophisticated business model

\n\n

So, although these are contradictory concepts, my thesis is that Portugal is both highly insecure, and, for the moment, quite safe.

\n\n

The Emperor’s new clothes

\n\n

Portuguese government agencies and companies say they are secure. This is not true. They are NOT secure, and have many high-risk vulnerabilities and exploitable assets. It is very important that we accept this fact so that we can find the necessary political, economic, educational, and social solutions. For now, “The Emperor has no clothes”.

\n\n

There are no silver bullets or easy solutions, and anyone who says so is a snake-oil merchant.

\n\n

The ideas in this book are about making Portugal a player, rather than being played, and giving Portugal a chance to defend itself, and improve Portuguese society. The worst aspect of our status is that we are not prepared for what is coming next, in terms of cyber crime and Application Security.

\n\n

Our response to terrorist incidents in the past shows how badly we can respond as a society to security incidents for which we are not prepared.

\n\n

Think I’m wrong?

\n\n

If you don’t believe that Portugal is insecure, then prove me wrong in your answers to the following questions:\n* Where is the evidence of Security and AppSec practices?\n* How big is the Cyber/App Security market in Portugal?\n* How many threat models are created per week?\n* How many lines of code are reviewed for security per week (aka ‘security eyeballs’)? (Bear in mind that secure code reviews are very different from normal code reviews).

\n\n

The current Portuguese security model is based on “Security Fairies’ magic pixie dust”. However, the good news is that we have lots of great InfoSec and AppSec talent in Portugal.

\n\n

The financial markets hack

\n\n

I would argue that Portugal has already been a victim of certain kinds of financial manipulation.\nIf you look at what happened during the financial crisis, a substantial part of it was artificially created by the markets.

\n\n

The markets pushed the Portuguese economy hard and made a lot of money by betting that Portugal was going to struggle, and would continue to struggle, in the financial markets.

\n\n

Cyber crime is the problem

\n\n

The real danger is from criminals who use the internet and vulnerable code for financial gain. They run highly professional and well-staffed operations, they offer great customer service, and they have amazing technical skills, such as cryptography, peer-to-peer networks, PaaS, and marketplaces. Their business models are sophisticated and are constantly improving. Of course, this all means that cyber criminals are already making millions, even billions of euros in revenue every year.

\n\n

We need to make the Portuguese network hostile to this type of criminal activity. The police and hackers (i.e. civil society) have an important role to play in this campaign.

\n\n

Attackers’ ROI (return on investment)

\n\n

We must remember that it doesn’t take a lot of money to compromise a country or a company. \nThe table below shows the cost of a zero day, in the form of a worst-case scenario. \n $\"Cost$ \n(Source: Greenberg/Forbes)

\n\n

If I had $100,000 to invest, what would I do? I would buy a number of zero-days, some compromised machines inside the Portuguese networks, and I would buy botnets to attack Portuguese companies.

\n\n

How much money would I make? If I can make a million dollars, it makes business sense, because my only concern is money, and a $900,000 profit is an excellent return on investment.

\n\n

If there is a million dollars to be made from attacking a particular company, somebody will invest $100,000 in the exercise.

\n\n

The good news for us is that the attackers are making far more money doing other things, but they are growing, and the scenario I describe will happen.

\n\n

Who can survive this kind of compromise? My view is that very few companies, especially in Portugal, would survive.

\n\n

Thank your attackers

\n\n

“If the attacker tells you about the attack, they are your friends”. Although it may be painful if an attacker leaks your data, you should thank the attacker who lets you know of the attack, because they will make you improve your security. Because the criminals will not tell you. The criminal’s business model is based on you not knowing that they are there.

\n\n

Once you know about the attack, you will fix it, the security team will get a much bigger budget, and you will be able to protect all these other things that have been on your list, but nobody was interested until the attack happened. After an attack, security becomes a major priority.

\n\n

Ultimately, every time there is a public attack (data dumps, site defacing, DDoS), that is not criminal or malicious in intent, the outcome tends to be positive, with bigger budgets, board-level attention and demands for security, an increase in AppSec staff hires, and more collaboration between ‘companies on the defense side of things’.

\n\n

Your company should hire the kid who breaks into your network.

\n\n

Military

\n\n

It is probably fair to say that Portuguese cyber and code defenses are as good as Portugal’s current military status (see Portuguese Armed Forces and Portuguese Air Force).

\n\n

The problem is that the cyber attackers who will hit Portugal are as sophisticated as the best soldiers, and armies.

\n\n

Imagine the Portuguese army against the UK, France or Russia, not to mention the US or China.

\n\n

Note how even the best companies and security agencies in the world are not able to detect and mitigate most attacks, as evidenced by recent DDoS attacks and zero-days exploits. The following video gives a humorous idea of what a DDoS attack feels like.

\n\n

Why do we have F16s?

\n\n

Why does Portugal need an offensive air force? I understand the need to have a civil air-force, to combat fires or for border patrols, but an offensive air force, with F16s? What is the ‘war scenario’ where that makes sense?

\n\n

The way you fight an airborne battle in the 21st century is by hacking into the offensive planes/drones via their communication channels. The novel Ghost Fleet (Singer & Cole, 2015) imagines the next, virtual, world war.

\n\n

The military budget for Portugal in 2014 was just over 2.1 Billion Euros. I would argue that the government should allocate 10% of the current military budget to fund investment in cyber/app security, and the huge skills shortage in this area.

\n\n

Hit by the crossfire

\n\n

The important question is “Do we want to do something about this, or be hit by the cross-fire?” If we do not consider this question, and address the huge, worldwide, skills shortage in cyber/app security, we will pay a heavy price.

\n\n

As attackers become more sophisticated, they will gravitate to countries and companies with weaker defenses, since these take longer to ramp up their security when an attack occurs. Acting in a strategic way now will work as a as a kind of insurance policy against the attacks that will happen in the future. Strategic action also presents Portugal, and countries like Portugal, with tremendous opportunities.

\n\n\n

Public health analogy

\n\n

Red or blue pill?

\n\n

We need to choose whether the paradigm for cyber security is one based on the military (offensive, top-down) or on public health (defensive, distributed).

\n\n

There are two good reasons why the army is not supposed to be involved in civil activities such as crowd control or disaster support:

\n\n

The military is designed to defend us from our enemies
Police & other civil forces should focus on protecting the individual

\n\n

We need to focus on defense, not attack.

\n\n

The police could be a very positive force in protecting both citizens and companies, if they embrace change and modernize their approach and use of technology. For example, the police could allow civil society (people, companies, collaborative commons) to help and participate in aspects of their work.

\n\n

Public health problem

\n\n

Cyber Security is a public health problem.

\n\n

To address the problem, we should train cyber/AppSec specialists using similar techniques to the ones we use to train doctors, nurses, and other medical professionals.

\n\n

We have an epidemic at hand, and we need to gain immunity.

\n\n

The decisions that we make in the next couple of years will determine how well prepared we will be to deal with wider outbreaks, and how quickly we can learn.

\n\n\n

Sane defense model

\n\n

Our defense model should not be based on having no vulnerabilities, no insecure code, no malicious developers, no compromised APs/dependencies, no zero-days issues.

\n\n

Our defense model should be based on the attacker making mistakes, and our being ready to detect and mitigate their actions.

\n\n

Stuxnet was caught via a mistake that caused a crash in an obscure anti-virus product (see Zetter, K. (2015) Countdown to Zero Day).

\n\n

The Portuguese National Cyber Security Strategy is a good document with good ideas and action plans, but it does not mention secure coding or addressing the root causes of the problems. We tend to confuse the symptoms with the causes.

\n\n

Where is the AppSec industry?

\n\n

The AppSec industry in Portugal is comparatively small. There are very few Portuguese companies with public AppSec teams. The market for security companies is small, and while there are a couple of interesting pen testing companies, you don’t see a lot of activity in that space.

\n\n

The creation of an AppSec infrastructure is a direct consequence of being attacked. After an attack, companies create AppSec teams and hire security experts. If anything, Portugal exports its security experts. I know many great Portuguese AppSec and InfoSec specialists in the UK.

\n\n

The problem is, security experts aren’t being recruited to Portugal. At the moment, countries like the UK, that are more evolved in AppSec, are recruiting, but Portugal should also be hiring AppSec talent.

\n\n

Be proactive

\n\n

The reality is the Portuguese AppSec industry isn’t very mature. The question is, does Portugal want to be like the rest of Europe and get caught in the crossfire? Or does it want to be proactive, and create an industry which could become very powerful, very effective, and very profitable for Portugal, and could also help to secure Europe and help the world?

\n\n\n

Hack like football

\n\n

Why is Portugal so good at football?

\n\n

Portugal is good at football for many reasons. Almost everyone can play football, and our kids play it all the time. When they play, and give the game their full concentration, they are in “the zone”, which is the optimal place for them to learn. School sports activities also encourage and support football.

\n\n

Football offers good social rewards and helps to build communities. Local clubs provide a great support system in the way they find, select, and nurture talent.

\n\n

Finally, the prospect of good financial rewards for many players, and not just at national and international level, also encourages an interest in, and support for, the game.

\n\n

Let’s do the same for hacking

Everybody can learn to hack, from kids to the unemployed, to convicted criminals, to retired people. Our kids should be hacking all the time. Many of them will love learning to hack, so they will be “in the zone” when they do. Schools can support these activities, and individual schools’ prowess at hacking should become a source of pride. A support network can find, select, and nurture hacking talent, and there will be good financial rewards for hackers, as there is a chronic shortage of skills in this industry.

\n\n\n

Hacking

\n\n

Hacking created the Internet

\n\n

It is important to state that hackers are the good guys.

\n\n

To ‘hack’ means to solve problems, to find innovative solutions in a creative way.

\n\n

The press abuses the term ‘hacker’. Instead, they should qualify the word by saying ‘Malicious Hackers’ or ‘Cyber Attackers’ or ‘Cyber Criminals’.

\n\n

The internet and most of the technology we use today was dreamed of, and created by, hackers.

\n\n

Real world hacks

\n\n

There is a very interesting news clip that reports on the story of Abel Cruz, a Peruvian entrepreneur who worked out how to provide water, by means of fog nets, to poor people living off the grid in the hills outside Lima. Abel contacted fog net experts on the internet to make his idea a reality. Sixty fog nets now provide water to 250 families at a very low cost. This creative and innovative solution has transformed their lives.

\n\n

Hackers’ values

\n\n

The software, InfoSec and hacking community has a strong ethical foundation, based on the following qualities:

\n\n

sharing
respect
friendship
trust
non-discrimination
humanity and companionship

\n\n

When we had the Web Summit here in Portugal you had people from competing companies all working together to solve a common problem. What mattered is that everyone present shared the same passion to solve the problem. That is what we must nurture, and that is what hacking offers. The hacker community spirit needs to be applied to our country.

\n\n

We want to inspire the next generation with these values. To do this, we need to provide an alternative narrative to the current mainstream narrative of ‘lies’, ‘non-experts-welcome’ and ‘infotainment’. We need to move away from celebrity scandals, whose privacy should be respected. We need to financially sponsor serious investigative journalism and use it to push for transparency in Government agencies and commercial organisations. We should apply risk and common sense analysis to ‘big’ news stories, and insist on accountability where fake or exaggerated news is reported. We should promote positive news stories, and we should reward ethical journalism.

\n\n

Our alternative benefits from the following strong qualities:

\n\n

business/commercial understanding
money-generation capabilities (outside of the ‘proprietary and lock-in’ business models)
understanding that profit is good and healthy

\n\n

Creating Your future

\n\n

The hackers who grow up creating distributed bots to attack insecure apps/code/appliances in the Portuguese network (as part of the Portuguese Hacking Service) are the same ones who will find powerful solutions for Portugal’s future security. They will create a distributed peer-to-peer drone network, to combat fires in Portugal.

\n\n

This generation of hackers will create technology to sell PT products around the world, and they will make Portugal a leader in alternative energies. Perhaps they will develop innovative financial services or even currencies.

\n\n

The generation that was hacking Linux boxes while we were in university is the same generation that is solving fundamental problems today.

\n\n

We need to make sure that this new generation knows what a Raspberry Pi is, knows what is inside, and knows how to build one. Raspberry Pi has been a commercial success beyond the expectations of its founders. Ten million Raspberry Pis have been sold, which ironically is the population of Portugal. The Raspberry Pi team has made an effort to build them in UK, but there should be a factory in Portugal that can do this.

\n\n

In fact, there should be software and technology companies in every city and town in Portugal. Software development and application security lend themselves to remote work, with regular commutes to a central office for meetings.

\n\n

For example, see how many Portuguese security researchers participate in global/world wide bug bounties.

\n\n

Be different

\n\n

If 99.9% of the world doesn’t agree with your ideas, this doesn’t mean you shouldn’t pursue them.\nMost things you value (and do) today were once illegal and considered immoral.

\n\n

(Add image of barefoot running)

\n\n

I lost count long ago of how many times I was told I was the only one who wanted to do something, that my ideas would never work, but eventually things change. So, again it is important to do it.

\n\n

Remember that most of the things you value today were illegal and immoral at some point in the past. Remember that although many things may seem strange today, a lot of what we take for granted was problematic and controversial in the past.

\n\n\n

Open source

\n\n

Openness is key

\n\n

For most of the ideas defended here to work, and not back-fire, even if they create strong command-and-control systems/environments, we need a very high degree of transparency and openness. This is exactly what the Open source and Creative Commons worlds provide.

\n\n

OWASP is a good example of an organization that has a very strong open model it applies to everything, right through to its governance and fiscal transparency.

\n\n

Git is also a key part of this, since Git enables effective collaboration, allowing others to contribute, even if they are direct competitors in other products or services.

\n\n

Open source is not Communism

Open source is not Communism. It is a successful business model, used by all major companies and governments in the world. It has a proven community model with largely successful enterprise software developed by thousands of developers. Open source is more than just code; together with Creative Commons it provides an approach to how to communicate, live, and share. Embracing open source values makes markets more efficient and fair, and more profitable for a wider group of people.

\n\n

We should use open source to change the rules of the game, and we should bear in mind that the expansion of open source is a matter of ‘when’, and not ‘if’.

\n\n

FOSS Values

\n\n

FOSS (Free and Open Source) programs are a good model to use, as they allow users to share and collaborate programs. They can empower users, and could potentially create thousands of Portugal-based FOSS companies.

\n\n

Portugal should embrace organizations like OWASP, which has held two summits in Portugal (Add pics and logos).

\n\n

The positive values of open sourcing include the following:

\n\n

access to code
no lock in
no discrimination
liquid collaboration

\n\n

Of course, using open source code doesn’t mean that it will be perfect.

\n\n

Open Source is expensive

\n\n

We need companies to sell open source code. (point to many examples where this happens today (ELK, …)

\n\n

Open source software is not free. Any code has a cost and a side effect. Using open source code doesn’t mean that you don’t pay for it. It means that you pay in a different way than a direct financial transaction.

\n\n

Open source lingua franca\n

\n\n

It is very important that open source and Creative Commons are the lingua franca between all players. The take-up of open source will help us to remove the ‘proprietary lock’ of closed software, which creates perverse incentives and does not allow the peripheral countries (or players) to have a strong role in the quality and security of that code. Open source and Creative Commons allow the best teams and ideas to win, and they reward good behavior. A good system is one where ‘less ethical or benign’ actors behave well, even when it is against their natural instincts or values.

\n\n

Closeness and a lack of sharing are more valuable to the attacker than to the defender.

\n\n

We have a lot of evidence that demonstrates that the more we know about security and risk, the better we can protect and mitigate. It all comes down to how well we communicate, with both tests and TDD.

\n\n

OpenSource.pt

\n\n

To increase transparency, the government should ensure the following policies are adopted:

\n\n

all code written and paid for by Government agencies to be released under an open source license (by 2020)
all Government-created documents to be released under Creative Commons
all Portuguese companies to publish their code under open source license, and technical documentation under Creative Commons
pay for open source software (in license and per usage)

\n\n

The financial model that would allow implementation of these ideas needs careful consideration. The key is that the developers of whatever open source code is used, should have a revenue stream equivalent to that use, so that they can spend more time working on that software, and hire more developers to work on it.

\n\n

The government needs to trust their citizens and treat them with respect. This will empower the people, and create economic models that reward them. Don’t worry about the big companies, they have enough talent and skills to make money from this model and ideas. In most cases, they are the senior players at the table, and clever companies will adopt this model and thrive on it.

\n\n

Open the source of Portuguese code

\n\n

Government and private companies should create venture capital funds to buy existing software companies and open source their code. These companies should use part of that money to transform their business model into one based on the open source stack. As they wrote it, so they would have a huge competitive advantage. However, local companies would also be able to provide these services.

\n\n

The return on investment to the Portuguese economy would be much greater than the amount invested.

\n\n\n\n

My core belief is that openness and visibility will eventually create a model/environment where the ‘right thing’ tends to happen, since it is not sustainable (or acceptable) to do the ‘wrong thing’ (which, without visibility is usually not exposed or contested). See the first couple of minutes of the Git and Democracy presentation for a powerful example of this ‘popular/viral awareness’ in action.

\n\n

When I look at my country (Portugal, and now the UK), or my industry (WebAppSec), I see countless examples of scenarios where, if information was disclosed and presented in a consumable way, much of what happens would not be tolerated.

\n\n

For example, we in the WebAppSec industry know that bad software and applications are created every day. Both we, and the customers, have accepted that vulnerabilities are part of creating software, and that the best we can do is to improve the SDL, and reduce risk.

\n\n

If the real scale of the problem was known, would we, either as a society, or an industry, accept it? Would we accept that large parts of our society are built on applications whose workings very few people understand?

\n\n

The tech world is trying to find ways to connect data sets that makes ‘reality understandable/visible’, so that what is really going on is exposed in a way that is both easy to consume, and actionable.

\n\n

For example, look at the Next Level Doctor Social Graph for an attempt to drive change in a commercially viable way (See their ‘“Open Source Eventually” idea)

\n\n

From that page, here is their description of the problem:

\n\n

“It is very difficult to fairly evaluate the quality of doctors in this country. Our State Medical Boards only go after the most outrageous doctors. The doctor review websites are generally popularity contests. Doctors with a good bedside manner do well. Doctors without strong social skills can do poorly, even if they are good doctors. It is difficult to evaluate doctors fairly. Using this data set, it should be possible to build software that evaluates doctors by viewing referrals as “votes” for each other.” (see related reddit thread here)

\n\n

This is what they call the Next Level Doctor Social Graph , and when I read it I thought of doing the same for software/apps under the title: The next level App Security Social Graph

\n\n

Here is the same text with some minor changes (in bold) on what the The next level App Security Social Graph could be:

\n\n

“It is very difficult to fairly evaluate the quality of software/application security in this country. Our regulators only go after the most outrageous incidents/data-breaches. The product/services websites are generally popularity contests. Applications with good marketing do well. Applications without strong presentation skills can do poorly, even if they are secure applications. It is difficult to evaluate security fairly. Using this data set, it should be possible to build software that evaluates application security by viewing ….. (to be defined)”

\n\n

It would be great if the current debate was on what is ….. (to be defined) , ideally with several active experiments figuring out the best metrics, but we are still a long way from that stage of development.

\n\n

Meanwhile, another 8763 vulnerabilities (change this value to a quantity you think is right) have just been created since you started reading this. These ‘freshly baked’ vulnerabilities are now in some code repository and will be coming soon to an app that you use. Your best defence is to hope that you are not caught by its side-effects.

\n\n

The cathedral’s eyeballs

\n\n

In the cathedral and the bazaar presentation and book, Eric S. Raymond proposes the Linus law “given enough eyeballs, all bugs are shallow” , which is usually also applied to Security.

\n\n

The problem is that we need those eyeballs.

\n\n

This could be Portugal’s contribution to the world: ‘AppSec eyeballs’ and ‘fix Open Source Software’.

\n\n

It is imperative that a company or country has core contributors (i.e. strong relationships) with strategic open source projects. This is not only essential to retain talent, it should also be done from self-interest.

\n\n

Use Git to version legislative development and ask for public consultation

\n\n

Developers in France, Germany, and the US have put national legislation on GitHub. The similarities between software code and legislation, taken with the superior advantages of tracking and versioning legal documents in Git, allow increased transparency of the legislative process, as the public can question and suggest amendments, and identify authors, all in the public domain. ‘GitLaw’ can also have a wider application, at local, individual, and international levels. The Portuguese government should adopt a similar approach, and use Git to track the development of legislation, and allow the public to have a greater say in, and a greater understanding of, the legislative process in Portugal.

\n\n

More information is available in the following articles:

\n\n

https://blog.abevoelker.com/gitlaw-github-for-laws-and-legal-documents-a-tourniquet-for-american-liberty/
http://okfnlabs.org/blog/2012/12/13/bundesgit-german-laws-on-github.html
http://qz.com/373326/the-entire-french-legal-code-dating-back-to-napoleon-is-now-on-github/

\n\n

Principle of Public Access in Sweden

\n\n

The Swedish government allows a high level of public access to government activities. In the Swedish Freedom of the Press Act, passed in 1766, Chapter 2, On the public nature of official documents, Article 1 states that “Every Swedish citizen shall be entitled to have free access to official documents, in order to encourage the free exchange of opinion and the availability of comprehensive information.” The Act goes on to detail that any restrictions to access must be scrupulously specified.

\n\n\n

Privacy

\n\n

Defend privacy

\n\n

Edward Snowden said, “Arguing that you don’t care about the right to privacy because you have nothing to hide is no different than saying you don’t care about free speech because you have nothing to say.”(add reference)

\n\n

The right to privacy is a human right, and it is essential for human dignity.

\n\n

Everyone should be innocent until proven guilty.

\n\n

The US and the NSA redefined the notion of surveillance to be ‘looking at data’, rather than ‘capturing data’.

\n\n

Large tech companies’ business models are often based on their users having no, or reduced, privacy.

\n\n

Many world governments view technology as a way to exert more control over their citizens, and they actively make the internet less secure so they can continue to easily access users’ data.

\n\n

There must be space for new global players who play by different rules, namely the rules that defend individuals and civil society.

\n\n

Cryptography

\n\n

Cryptography is a public service and capability, as it enables the end-user to control their data. It is crucial to protect user data. Cryptography also has an excellent tradition of not relying on security by obscurity, or expecting the attacker to have all the code and encrypted data (the only private data are the encryption keys).\nStrong crypto is a good thing, especially if it enables the end-user to control their data.

\n\n

We need a healthy level of civil disobedience in society, or new ideas will not get the space to flourish and gain wider acceptance by society.

\n\n

Our parents fought against racism, and for pensions, human rights, and rock & roll. It is our turn to realign society and shift the balance of power. This is about removing control from central organizations (governments, big companies) and give them to individuals and collaborative commons. Currently power is in the hands of whoever controls the networks.

\n\n

The Need for Disclosure

\n\n

We need disclosure of what is going on with technology in companies. Companies today, even Open Source ones, don’t have to offer full disclosure. The market doesn’t work reward good, ethical players. To change this system, we need to use the power of markets to make the Government and companies play fairly and correctly. The Portuguese Government could use its purchasing power to define the rules of engagement, and if the EU doesn’t like it, then Portugal could sue the EU. It is time we pushed some of our rules and ideas onto the table.

\n\n

We need to use the concepts of new software workflows like DevOps and release-often-feedback loops in wider society.

\n\n

Whistleblowers have an important role

\n\n

Whistleblowers are important because they can make the markets more efficient. Whistleblowers are not needed when public actions, and statements, match the real, private actions.

\n\n

Of course, there will still be secrets, but in smaller numbers, and they will be very well protected, as they are today. “When everything is a secret, nothing is a secret”.

\n\n

Integrity and availability are much harder and dangerous than confidentiality. Compare this idea with the current focus on data privacy or credit card leaks.

\n\n

Protected by law

\n\n

We need strong technological legislation that will prevent companies from playing the game of ‘Security by obscurity’, and will protect whistleblowers. It is only when you lose control by sharing code and ideas that others really embrace and adopt the concepts of sharing and openness.

\n\n

A rule of thumb should be that “if the law is broken, or crimes are committed to disclose materials, it is okay if the benefits from disclosure are worth it”. It is important that companies and individuals know that they will not get away with it.

\n\n

The new EU General Data Protection Regulation and Directive, adopted by the European Parliament in April 2016, strengthens citizens’ fundamental rights in the digital age and facilitates business by simplifying rules for companies in the Digital Single Market. Under the terms of the regulation and directive, there will be increased responsibility and accountability for those processing personal data – through data protection risk assessments, data protection officers, and the principles of ‘data protection by design’ and ‘data protection by default’.

\n\n

Limited privacy for state and companies

\n\n

We want the opposite of privacy for companies; instead we want maximum visibility, transparency, and disclosure from them so we can see what is really happening. This would be better for all involved, and will allow for much fairer competition and better profits in the long run.

\n\n

Technology can be used in a positive way to enable this openness. Many companies will not like any shift toward increased transparency, just as they didn’t like when annual reports became mandatory in the last century.

\n\n

Ideally, law enforcement and financial regulators should lead the way in ensuring greater levels of transparency.

\n\n

Learn from the music industry

\n\n

For an example of how to use technology in a perverse and negative way, look at what happened with the music industry. The music companies viewed their customers who used new digital and sharing technologies as criminals, and passed draconian laws designed to protect their own interests, rather than innovating and learning to succeed in the new technological world. A decade was lost, at great cost to artists and the public.

\n\n\n

Government

\n\n

Collaborative Commons

\n\n

Collaborative Commons provide a great vision for the future and how it could work. It provides a model of an organization where citizens and entities collaborate for common goals.

\n\n

”…Commons is a third model that breaks with the binomial market-state notion, formed -allegedly- by the only two organizational models able to meet the needs of the population. Although it is not new, new technologies have greatly promoted its expansion and thus the emergence of an economy of collaborative commons (Procumuns, [online], available: http://procomuns.net/wp-content/uploads/2016/03/CommonsDeclarationPolicies_eng_v01.odt.pdf)

\n\n

Collaborative Commons is greatly empowered by the move towards a Zero Marginal Cost society.

\n\n

http://commonstransition.org/commons-collaborative-economy-explodes-barcelona/
http://wiki.commonstransition.org/wiki/Procomuns_statement_and_policies_for_Commons_Collaborative_Economies_at_European_level
http://bigthink.com/think-tank/the-collaborative-commons-economy

\n\n

Government’s role

\n\n

Historically, Government was a very powerful force for innovation in Portugal, and the Government has a big role to play in this transformation, not as a ‘Command and Control’ entity, but as a benign influence to level the playing field.

\n\n

It is essential to recognise and act on what works well at Government and industry levels. Government investment in research or infrastructural activities will yield positive results, and amplification and optimisation will work well for industry.

\n\n

In his book Common Innovation: How We Create the Wealth of Nations (2016), Swann argues that innovation and wealth creation are not the monopoly of business, but the contribution of ordinary people.

\n\n

Code is Law

\n\n

Software is made of code. Code is law and grows in importance all the time. Code controls Portugal, and so software controls Portugal. The problem is, Portugal controls very little of the software it uses. It is time for Portugal to take control of the software. This should be a strategic objective of both Portuguese companies and the Portuguese government.

\n\n

Who controls the world?

The world is dominated by entities and companies who control the following areas:

\n\n

finance
technology
networks (made of technology)
intellectual property

\n\n

Unfortunately for Portugal, its strength does not lie in these areas, so Portugal must challenge the rules of the game, and work to align them with its strategy, and sovereign interests, if it wants to become a player.

\n\n

Moving to Open Source values and activities, and embracing secure coding and hacking will change how this game is played.

\n\n

Governments can make a difference

\n\n

Some people have said to me, “If your ideas depend on the Portuguese Government taking action, you should give up now!” This is the wrong attitude. Governments exist to serve their citizens, and as a citizen with ideas for my Government, I have a duty to share them.\nWe, as a tech community, should request the Government to adopt ideas like those discussed here, especially when the benefits are not for a small group of companies, but for a large section of the tech and IT user population.

\n\n

Iterate exponentially

\n\n

All ideas presented should NOT be implemented as a Big Policy or a Big Vision! Anyone who tries to sell you a big, expensive solution, that only major companies can implement, is selling a scam. The small changes, and the marginal gains, are the right way to implement DevOps and government policies (see http://m.bbc.co.uk/sport/olympics/19174302).

\n\n

Iterate exponentially along the following lines:

\n\n

start small
deploy
learn from deployment
make changes
return to step 2, and repeat

\n\n

These are the solutions for SMEs, individuals, and small teams who work on the ground, understand reality, and are accountable to their local communities.

\n\n

Ministry of Code

\n\n

Everything is code, including all DevOps scripts and even things like Firewall rules. These should be managed at a high level within Government, in a type of “Ministry of Code”.

\n\n

This ministry should appoint a CTO and CISO for Portugal, and should implement the following proposals:

\n\n

create a Code for Portugal initiative using a collaborative commons model, similar to the USA’s @codeforamerica.
manage the PHS (Portuguese Hacking Service)
manage bug-bounty and hacking championships
commit to only buy, commission, and use applications and websites that\n
- release their code under Open Source licenses
- release their data and schemas under non-restrictive Creative Commons licenses
\n

\n\n

Clear Software Act

\n\n

A Clear Software Act, like the ‘Clean Air Act’, but focused on code quality and security, would go some way to changing the game and how it is played.

\n\n

Large numbers of our community are resistant to any kind of regulation, and there are many companies that profit from this resistance.

\n\n

As Upton Sinclair said, “It is difficult to get a man to understand something, when his salary depends upon his not understanding it”.\nThe problem however is not regulation and standards, but bad regulation and standards.\nGood regulation, in areas like health and environment, has made major improvements, and we need to do the same for software and code.

\n\n

Software Testing Institute

\n\n

We need to measure and visualize the side effects of code, and we need to measure the ‘pollution’ created by insecure code and apps.\nWe need a focus on quality and services, where we want to encourage innovation and make it easy and cheap to create secure code in Portugal. Portugal could adopt, and use testing to leapfrog more advanced nations.

\n\n

http://blog.diniscruz.com/2016/03/when-talking-about-application-security.html

\n\n

A Software Testing Institute would allow us to measure and capture this information. The work of such an institute should focus on testing code and apps and creating labels for them. It could also embrace DevOps and container movements.

\n\n

ASAE for code

\n\n

ASAE (Autoridade de Segurança Alimentar e Económica)\nAuthority for Economic and Food Security

\n\n

See Software Facts

\n\n

When regulation loses the plot

\n\n

We need to learn from what worked and what didn’t work with ASAE. There was a chronic lack of common sense and the ASAE seemed to embrace everything negative that is associated with “security regulation”.

\n\n

An ASAE for code mustn’t kill innovation and become a ‘TAX’. It needs to empower and reward good behavior, and have a common-sense approach to its operations.

\n\n

As cyber security gets worse, if we don’t have good, positive alternatives, an ASAE is exactly what we will get. This is not a good prospect.

\n\n

Portugal-wide bug bounty

\n\n

A Portuguese Software Testing Institute could also include bug-bounties as a core activity. Today, there are bug bounties everywhere, and they are a sign of good InfoAppSec. Even the Pentagon has a bug-bounty program, and recently announced a further “Hack the Pentagon” bug-bounty initiative. Where are the Portuguese bug-bounties? They should be a core activity of both business and government, and they should receive appropriate investment. Crowdsourcing solutions could also be used. Portuguese bug-bounties would sit perfectly in our Software Testing Institute.

\n\n

These institutions will lead the creation of standards and metrics for the insurance industry.

\n\n

Insurance

\n\n

The insurance industry is key to making this work. It will push for good metrics to measure secure coding and secure deployments (i.e. how code/apps/software are used in the real world). It will provide a way to compare companies and technologies, and this will make the market more efficient.

\n\n

Many companies will decide to insure insecure code, and teams that create insecure code/apps. That is fine, as long as that information is disclosed. The insurance companies will increase premiums depending on how secure a company, or an app, is. The benefit of this approach will be the reduction of risk. Of course, if we get it wrong, we will have quite a mess to deal with.

\n\n

Of course, Portuguese companies should be leaders in Software Insurance.

\n\n

Solution is not to buy ‘security’

\n\n

Most Security vendors have inadequate security, and they sell insecure apps, which can have a negative security impact on the purchasing company’s entire ecosystem. The solution is to push Open Source code with a secure ecosystem around it.

\n\n

Code Nationalization

\n\n

Nationalizing code is a nuclear option for cases where companies refuse to share their code. It is essential to move to a world where good regulation will allow every line of code that is running and touches our data to be

\n\n

public
peer-reviewable by independent parties
compile-able by independent parties
signed

\n\n

This not only includes websites and ‘traditional software’, but also operating systems, device drivers, IoT devices, network devices, microchips, etc.: in short, anything that can access or manipulate data.

\n\n

The market, through the power of big customers, can make a difference by ‘nudging’ code to be Open Sourced.

\n\n

The Portuguese Government should, at the very least, consider the following policies:\n* Adopt Git for all official documentation\n* Teach users (i.e. government employees) the paradigm of version control\n* Develop a Portuguese version of Docker and Git\n Where is the Portuguese Raspberry PI (which has sold more than 10 million)?

\n\n

Review and beta test legislation

\n\n

The Government should review existing Computer Crime laws, to ensure their effectiveness, check for unintended side effects (for example impact on security researchers), and ensure that the scope of current legislation in this area is not so wide that normal users or developers are criminals in their day-to-day use of technology. We shouldn’t have to depend on having technologically savvy judges who can interpret these laws with common sense.

\n\n

Beta testing legislation would ensure that draft legislation will have the desired effect when passed into law. The DevOps and CD (Continuous Deployment) models could be used to develop draft legislation, and draft legislation could be tested in controlled environments. A/B testing would also work well for legislation as it would give the legislative process a transparent QA standard.

\n\n

European Union

\n\n

I am a strong European and I believe in Europe. But Europe needs to change and refocus on country sustainability.

\n\n

Portugal should not have to ‘beg’ the EU for funds to support these ideas.

\n\n

The EU, and other global organizations and companies, should choose to invest in Portugal because they want to benefit from the perfect storm of talent, energy, regulation, focus and activities that will exist here.

\n\n

They should invest and participate here because it is in their best interests, and it is where they will get the best return on investment. They shouldn’t benefit because of some back-room deal that gave them a special tax break or some other financial inducement, which is a kind of soft corruption. The only benefits they should get are the benefits that are available to any company based in Portugal:

\n\n

talent (people, students)
infrastructure (networks, roads, data centers)
logistics (the Portuguese version of Amazon, provided as a service to the country)

\n\n

This kind of collaboration and investment is what the EU should be all about:

\n\n

a Collaborative Commons
a global village
shared care and respect for each other (and their contributions)
wisdom of the crowd

\n\n

New currencies for Southern Europe

\n\n

A good solution for the Euro problem, for weaker economies like Portugal’s at least, is to create alternative currencies. We know how to do this now, with blockchain technology. Multiple FinTech companies are exploring all kinds of business models and workflows.

\n\n

These alternative currencies should be 100% compatible with the Euro, so they can work side-by-side. They could be created by the next generation of Portuguese hackers, who would also enjoy the challenge of hacking a currency.

\n\n\n

Investment in infrastructure

\n\n

There was a time when low-cost airlines were thought to be commercially unviable, until somebody made the concept a successful reality and now low-cost airlines are major players in the aviation industry. The same can happen with the distribution of Portuguese craft goods around the world, and in Portugal.

\n\n

One of the roles of government is to invest in infrastructure. In the 21st century, digital logistics are the new roads.\nWe need a model where the Portuguese producer (be they craftspeople or winemakers, olive oil producers, shoemakers, or butchers) is not required to create the infrastructure to sell those products abroad.\nAll these producers should be able to supply the products to a local Portuguese contact, who is in turn connected to a distribution network, that can finally deliver to the consumer.

\n\n

Design companies

\n\n

If the producer does not have a good design for their product, there should be a network of design companies to take on this job, with agreed rules of engagement and price scales. The payment for such design work (such as for oranges from the Algarve) should be seen as an investment and not a cost. That investment is a direct injection of money into the Portuguese economy, through the design company or individual who did the job, the company that organized the workflow, and the producer who sold more products.

\n\n

They could use the Upwork model to distribute this work.

\n\n

This system needs to be as simple as those of Uber and Amazon.

\n\n

The Elon Musk model for producing high-value cars needs to be applied to high-value Portuguese products, such as wine.\nThe focus must be on Portuguese emigrants, and their close networks abroad.

\n\n

Example scenario

\n\n

Here is an example of this workflow in action.

\n\n

Two friends are having dinner together.

\n\n

Friend A: “This wine is amazing, what is it?”
Friend B: “It is XYZ, from this local producer in ABC village, you should get some.”
Friend A: “Great idea”. He/she then grabs their phone, goes to the ‘Buy.pt’ app, takes a screenshot of the wine bottle (which is recognized by the App), chooses the quantity to buy, checks the price and delivery date, and, finally, clicks the ‘Buy’ button
Friend B: “Did it work?”
Friend A: “Yes, a very smooth process, it will be delivered to my house (in a different country) in 3 days.”
Behind the scenes (after the Buy button is pressed)\n
- Purchase order is sent to the wine maker
- Next day the winemaker packages the wine (printing the label from an app), and scans the label to indicate that it is ready to be picked up
- A local transportation company (or individual) gets a job (via an Uber-style workflow) and collects the package
- The package is delivered to the Hop of the transportation chain (this would be another local transportation company or an individual)
- That transportation entity (eventually) delivers the package to the next Hop
- Many hops later (5, 10, 20) the package arrives at the house of the buyer (‘Friend A’)
\n

\n\n

Similar Per-to-per transportation workflow already exists in the UK and other countries.\nEvery entity in the delivery chain (each hop), receives a payment for their journey, based on the time and distance they travel, the ability to deliver faster, the size of the package, etc.

\n\n

In many cases the drivers would already be going to the delivery location, so it would be (just about) pure profit for them.

\n\n

It is possible to gamify this process, by providing a scorecard to the more active drivers and sellers. Drivers should be aware that the goods they transport help the local and national economy; this work could appeal to their national pride.

\n\n

The process should also be as personal and as human as possible, using the names of the producers, drivers, clients, countries, and hops travelled.

\n\n

Of course, this process could also sell products to buyers inside Portugal, and Portugal might be a good place to start the project. However, external customers (from UK, France, Germany, USA, China) will have more purchasing power, and they don’t have a local supermarket where they can buy similar Portuguese goods.

\n\n

Internet-based model

\n\n

This model is based on how the internet works and how packages are sent from A to B.

\n\n

On peer-to-peer delivery hops/nodes, the timing of delivery is less important than knowing that ‘eventually it gets there’.\nIt is acceptable to lose a couple of packages along the way, as they will be resent through the delivery chain.\nCentral entities (aka routers) manage the flow between nodes/hops.

\n\n

This system should be used to figure out how to apply social safety nets (pension, overtime, holidays, sick leave, maternity leave) to this, more fluid, type of work practice.

\n\n

This kind of system needs some Government funding. It qualifies as government investment, as it generates more sales for Portuguese manufacturers and it creates local jobs.

\n\n

Data should demonstrate that for every euro invested in this distribution network, x euros are created in the Portuguese economy. Since some percentage of those x euros will be paid in taxes, which ideally will be higher than the original investment.\nThere will be some cases where Government will need to artificially create (or pay) for transportation between two hops that lack local players, or, for example, between long distances that can only be covered by train or plane.

\n\n

Exponential growth

\n\n

This is a system that must grow organically and exponentially, until it reaches critical mass.\nIn the beginning, it will be very inefficient and expensive, which is why it requires government support. But by using expensive products, the idea is that the cost of the whole service will be enough to cover the cost of the original product and transportation.

\n\n

Eventually, as more products flow between hops/nodes, it will be possible to optimize them and reduce transportation costs. In such cases the extra money should go to the producer.

\n\n

Given the fact that with normal supply chains the producer only gets a small percentage of the final sale price, it would be very interesting if the sales performed though this per-to-per channel would generate a higher price for the producer.

\n\n

An interesting variation would be to apply the Leanpub model, where the buyer can see how much the producer is getting from the purchase price, and can choose to pay more for the product. Leanpub can demonstrate that this model works.

\n\n

We must find ways to create connections between buyers and sellers, in a similar way to the Kickstarter model.

\n\n

Open Source the project

\n\n

All steps should be tracked in real time using mobile apps. All software and data created for this system should be released under an Open Source and Creative Commons license.
\nAny patents generated by the development of this initiative should be released openly, as Elon Musk did for Tesla.

\n\n

Transportation investment fund

\n\n

For the locations where there is a recurring transportation gap, an investment fund should be created, which would:

\n\n

create a local company using local entrepreneurs (based on car, truck, train, cycle, air transportation modes)
make it work locally (capturing workflows to be used by the next generation of these companies)
make it profitable (using the flow of packages delivered)
spin it off as an independent company (with 15% shares owned by the investment fund and 85% owned by the employees)
when that 15% is sold, use that money to top up the investment fund

\n\n

This fund could be topped up by philanthropic contributions, crowdfunding initiatives, and conventional investors. In cases where the 15% of sales generates a good profit, the investment fund would benefit.

\n\n\n

Economics

\n\n

Software can be the source of further inequality in our society, or it can provide a solution to close the pay gaps.\nSoftware can control, or provide freedom and liberty. It can erase the rest of our privacy, or it can enhance it and protect our right to privacy. How it behaves depends on who uses it and to what purpose.

\n\n

Uber

\n\n

Why should companies like Uber take 20% of a cab fare for a journey taken in Lisbon, when that 20% is removed from the Portuguese economy?

\n\n

I like Uber, and I often use it, but we must understand its wider implications to society. We need to help existing industry/workers to modernize and compete with new Uber-type industries, or they will face the same fate as ‘Encyclopedia Britannica’. The new generation of internet companies are not just making things faster or cheaper, such as communications or music; they are introducing new, and very disruptive business models which are changing society. Companies like Uber ignore many hard-won workers’ rights.

\n\n

The solution is not to ban these kinds of companies or business methods; the solution is to out-innovate them and, if necessary, change the rules of the game they play. For example, they could be required to have open data, and they could be forbidden to hold any lock-in on drivers or user-data.

\n\n

We must always ask, “Who guards the guardians?”.

\n\n

Portuguese Emigrants

\n\n

We should use software to create distribution networks to send PT Products to PT emigrants

\n\n

Oranges from Algarve
‘Bom Petisco’ tuna
Bolachas Maria

\n\n\n

Education

\n\n

Skills

\n\n

Coding & IT skills are critical for large number of industries, including the following:

\n\n

cars
research
medicine
finance
marketing

\n\n

Git is a core skill

\n\n

Version control is a fundamental skill that needs to be mastered by everybody who creates a document or data, which is just about every IT user.\nGit is a great step in the right direction, but it is still too difficult to use for normal users, and it is not seen as a strategic skill set.\nNonetheless, productivity and collaboration increase when Version Control is used effectively.

\n\n

Education

\n\n

Businesses should work with Universities to teach the following skills:

\n\n

app and network testing (unit, integration, end-to-end)
how to hack into networks and applications (using vulnerable-by-design apps and companies/countries with public bug-bounties)
modern languages and frameworks (coding in at least ten languages is an excellent advantage to have)

\n\n

University course

\n\n

University students and graduates are another great source of talent, and for them the projects are a great source of ‘real world’ skills. Here is an idea for a three-year curriculum at third level.

\n\n

year 1 - Hacking & learn new coding languages
year 2 - Testing and TDD
year 3 - Fixing code and DevOps

\n\n

Students of this course should receive cloud accounts and learn to use state-of-the-art software and services (GitHub, JIRA, Travis, Jenkins, SAST, VisualStudio, IntelliJ, Eclipse, etc.)

\n\n

Some of the proposed activities in this book (Hacking networks/apps, transportation apps and logistics) could be completed as semester projects, and graded based on the quality of their execution.

\n\n

Threat Models as strategic activity

\n\n

Universities should also teach threat modeling, to create professionals who are proficient in threat modeling when they take up employment. Threat modeling professionals must know how to code, and they must have software development (and DevOps) knowledge and experience.

\n\n

The benefits of this skill are numerous, both to the student or professional who possess the skill, and to industry. Threat modeling can drive change, and it can map out how things work, as it provides a ‘single source of truth’.\nThis is not a theoretical activity.

\n\n

The Portuguese Government, and companies, should be leaders in threat modeling.

\n\n

CV

\n\n

The CV as a document is dead (at least for technology); what matters is your public digital footprint in

\n\n

GitHub repo
StackOverflow score
Quality of Twitter feed
Personal blog contents

\n\n

For the developers

\n\n

If you are developing code today, you should be thinking along the following lines:

\n\n

CI automation
everything is code (including CI scripts, firewall rules, apps authentication models)
graphs
containers (aka Docker)
version control for data storage (aka Git)
AI and machine learning
cloud (aka AWS, Azure, Rackspace)
serverless code (aka AWS lambda)
liquid code, message queues, self-defending applications, big data etc.

\n\n

If you are not thinking in this way, you are already legacy (in terms of code), because all these represent the future of code.

\n\n

Real time unit test execution and Code Coverage

\n\n

If you code in JavaScript and are not using Wallaby JS, you are living in the Dark Ages, and you will not be able to code in TDD.

\n\n\n\n\n

As someone who likes to share a lot of information, I have a very personal experience of what it feels like when you share data, especially in environments that don’t promote, or reward, the sharing of information, be it a screen shot, a document, or an idea.

\n\n

Many companies don’t promote sharing, and as a result knowledge doesn’t get transmitted. This is a highly inefficient way to work.

\n\n

When I publish something online, I usually use a kind of ‘shitometer’ scale to measure reaction to my post. The scale ranges from a couple of hours, to a day, to a week. If there is no allergic reaction to what I’ve published within three hours, that means my content can’t be that bad.

\n\n

If no one complains within the first 24 hours, it means that the other side has lost the moral authority to complain, and after a week without complaints I consider the cat to be out of the bag. Anyone who objects after a week can’t argue that I shouldn’t have shared, because they had enough time to complain, but they didn’t.

\n\n

My problem is, why is sharing even a problem? Ideally, you should be able to share without thinking. When you think about the possible consequences of sharing, you may consider the possibility of not being rewarded for sharing. You are more likely to be rewarded for maintaining the status quo.

\n\n

This can be quite difficult, because by sharing certain information, you can jeopardize a friendship or a business relationship. Nobody wants to alienate a company or a business partner. You may have more important things to worry about in your life, or in your work, than fighting that particular fight.

\n\n

I believe that one of the jobs of management is not only to promote sharing, and reward the people that share, but also to share themselves. I always find that when I am in a team the more I share, the more other members share because they think, “Well, if that guy can get away with sharing that information, then I can get away with sharing too”. My sharing gives cover to others, and it creates a positive cycle as sharing creates more sharing.

\n\n

Of course, you can also have a negative cycle where nobody shares, or if somebody shares something and gets punished for it, nobody will ever share anything again.

\n\n

Ultimately, what we want is a situation where the sharing of information is promoted, so we can all learn from each other. The lack of agenda is one of the main advantages of the open model. In an open and creative world, you know things can be shared, and there is already an implicit license to share.

\n\n

A license gives you the ability to do something, so you don’t have to ask permission and that has a profound effect. That is why collaboration happens a lot more even within a company when you have open licenses.

\n\n\n\n

Sharing is difficult, but I believe that Portugal, and other countries, should adopt an open-source culture. They should adopt Creative Commons as a core, strategic value that promotes sharing, and sets an agenda where the default approach is to share and collaborate. If you don’t share, the quality of your work will be adversely effected.

\n\n

A culture of sharing should permeate both business and government. However, a reluctance to share important information is the cultural norm, both in Portugal and elsewhere. The idea that if I know, or learn, something valuable, I keep that information to myself so I am the only person who will benefit from it. Even if I am not secretive by nature, but my community does not embrace sharing, then it is very challenging to overcome this attitude and change the culture.

\n\n

But the culture should change, to one that embraces collaboration and sharing knowledge. In a way, it is an anti-patent concept. In fact, Portugal could invest in, and then game, the patent system, by obtaining and releasing patents to promote the sharing of information, rather than locking the ideas away.

\n\n

Both governments and business can decide to adopt a more collaborative, sharing approach. In fact, I would argue that the point of government is to share information and knowledge for the greater good of society. For myself, I am working on a solution for sharing my work, regardless of whether others follow suit. If you want to take the lead, or if you want to see who leads the sharing culture at the moment, look at Tesla.

\n\n

Elon Musk is an amazing individual. When he reached the peak of success, instead of locking his research away as other companies do, he open-sourced, and continues to open-source, a huge number of patents from space exploration, car research, and battery research. This has a levelling effect, and it improves the quality of what everybody else is doing. It also encourages, if not compels, other companies to follow suit, because they start to look bad if they don’t open-source and they will have difficulty hiring talent if they don’t take a similar approach.

\n\n

If you can create this amazing ecosystem where people share and collaborate, productivity levels will go through the roof. In short, a culture of sharing and open-sourcing should be a strategic decision because it benefits everyone.

\n\n\n

Actions and recommendations

\n\n

Here is a summary of all the actions and recommendations mentioned and discussed in this book.

\n\n

Actions

\n\n

Develop Open Source code in Portugal by implementing the following policies:
Release all code written and paid for by Government agencies under an Open Source license (by 2020)
Release all Government-created documents under Creative Commons
All Portuguese companies to publish their code under Open Source license, and publish technical documentation under Creative Commons
Create Portuguese clones of successful apps, services, and products (all based on Open Source technology)
Hire devs/companies to work on FOSS projects (add ref to ‘Open Source is not Free’ chapter in book)
Legalize hacking (of everything inside the Portuguese network)
Demand secure code, apps, and networks
Create a ‘software commons’
Take lead in privacy and encryption
Compel companies ToS that relate to security and privacy to have a maximum of 1024 chars

\n\n

Recommendations

\n\n

Create a venture capital fund to buy existing Portuguese software companies and Open Source their code
Create a ‘Ministry of Code’, a ‘Junior Minister of DevOps’, and national-level positions of CTO and CISO (like the US has)
Copy US initiative Code for America (@codeforamerica), using a collaborative commons model
Allocate 10% of the current military budget to fund investment in cyber/app security, digital infrastructure, and the huge skills shortage in these areas
Introduce strong technological legislation that will prevent companies from playing the game of ‘security by obscurity’, and will protect whistleblowers
Commit, with participating companies, to only buy, commission and use applications/websites that\n
- a) have released their code under Open Source licenses
- b) have released all their info and schemas under non-restrictive Creative Commons licenses
\n
Adopt Git for all official documentation
Use Git to version draft legislation and beta test draft legislation
Teach users (i.e. government employees) the paradigm of version control
Develop a Portuguese version of Docker and Git
Attract Tesla to build factories and R&D facilities in Portugal

\n\n

Other recommendations

Export to CPLP, Europe and the world, thousands of cyber/AppSec specialists who will have been trained in Portugal
Create technical content in Portuguese
Digital identities and e-Residency solution, just like Estonia

\n\n

Recommendations for education and training:

Businesses should work with Universities to teach the following skills:

\n\n

App and Network Testing (unit, integration, end-to-end)
How to hack into networks and applications (using vulnerable-by-design apps and companies/countries with public bug-bounties)
Modern Languages and Frameworks (coding in at least ten languages is an excellent advantage to have)
Threat modelling

\n\n

Teach everyone to hack:

Introduce ‘Hacking Service’ where everyone needs to learn how to code and use technology (like the old Portuguese military service)
Organize and host regular Hackathons and bug-bounty championships, as part of a new, national, hackathon league.
Train cyber/AppSec specialists using similar techniques to the ones we use to train doctors, nurses, and other medical professionals

\n\n\n

Why Portugal?

\n\n

Easier in a small country

\n\n

It is easier to implement these ideas in a smaller country, which is more likely to have fewer agendas and fewer lobby groups wielding influence. We already have the power to make these changes. Being able to make them is an important aspect of Portugal’s sovereignty and independence.

\n\n

Of course, you can replace Portugal with any other country in the world, especially any European country. But I am Portuguese, so I have a soft spot for Portugal, and I know that Portugal has exceptional talent, exceptional AppSec people who could make this happen. What we need is focus and determination.

\n\n

The following aspects of Portuguese life, culture, history, education, and economic environment make it an ideal location to implement these ideas:

\n\n

good pool of InfoSec and AppSec talent
a supply of engineers
strong sense of ethics and community
good engineering and math education
good problem solving ability

\n\n

Portugal has hit rock-bottom with multiple financial crises and a European bailout. The only way is up. Portugal has learned the hard way what it feels like to be the junior player (i.e. The financial markets’ speculation on Portugal’s economy helped to create the situation that lead to the EU bailouts).

\n\n

Raise the bar of the discussion

\n\n

We live in an era where ideas are not debated, experts are ignored, science is not respected, and lies are accepted. This is very dangerous for us, for our children and for Portugal. Eleanor Roosevelt is credited with saying “Great minds discuss ideas; average minds discuss events; small minds discuss people”. I want to discuss and act on ideas, not events or people. We need a better, more informed, more knowledgeable, and more empowered media, to keep the system accountable.

\n\n

Big questions

\n\n

We are currently faced with big questions and changes on privacy, liberty, humanity, freedom, work, all of which are centred on technology and secure code, and these questions need to be discussed, understood and addressed. There are no perfect solutions.

\n\n

We need to achieve a workable compromise and make sure we take the best course of action.

\n\n

I don’t claim that all my ideas are good, that they will work or are even all realistic, especially in the current political and economic ecosystem, but I know that big changes occur when we head in the right direction and can experiment, adapt, refactor and improve.

\n\n

Best in ‘graduating high school’?

\n\n

What is Portugal best at is a world map that shows what every country leads the world in (2014).

\n\n

According to this map, Portugal has the best rate for ‘graduating high school’. We can do better than that. We should be world leaders in software, craftsmanship, cyber security, secure coding, DevOps, and food, and we should expand the market of those products. Portugal should not compete on cheap labor, but on the following resources:

\n\n

advanced technology
people
skills
infrastructure
ability to deliver

\n\n

Not the ‘sweat-house’, but the ‘power-house’.

\n\n

Protect the internet

\n\n

The internet is one of the biggest gifts given to humanity. Its founders made it open and free (in terms of both cost and freedom). The success of the internet is a testament to those decisions and their values.

\n\n

Now, the time has come for our generation to continue in their footsteps and keep the internet open and free for the next generation. It is our turn to realign society and shift the balance of power. This is about removing control from central organizations (governments, big companies) and giving control to individuals and collaborative commons.

\n\n

Portugal needs to export engineers

\n\n

Everyone who leaves Portugal brings Portugal with them. They become an ambassador for Portugal, and they become a consumer of Portuguese products (assuming they are easy to buy from abroad). Many of them have connections with Portuguese companies, and could bring jobs back to Portugal in the future. Everyone who leaves Portugal will learn new skills, and eventually return with those skills, experience, and references, which are, of course, a net gain for Portugal.

\n\n

Portugal and Europe need diversity and indigenous activities and industry, to ensure their futures.\nIn Europe, sometimes it seems that we have forgotten “Why XYZ was done and what was its objective”.

\n\n

The next generation of manufacturing is going to be local (to a country, city, company, even a house). This is the Age of Sustainability. Portugal needs to be technologically independent and sustainable.

\n\n

Amazon is a great model for Portugal (Shopping, AWS, logistics). How many senior and experienced Amazon ex-employees work in Portuguese Government and technology initiatives?

\n\n

What is the future of Portugal?

\n\n

Is it to be a garden for Europe, a holiday destination? A small pawn in the global forces that control the world?

\n\n

Or could Portugal work together with the CPLP (Community of Portuguese Speaking Countries) in a united partnership that provides significant opportunities? Portugal could become a Powerhouse of Technology that inspires and leads the world in secure coding

\n\n

Sail the Code

\n\n

Let’s use code to create a generation with a strong work ethic and values.

\n\n

Let’s create a new reality for Portugal.

\n\n

In the same way that Portuguese navigators once looked at the unknown sea and conquered it, our new digital navigators must do the same with code.

\n\n

\n\n","tocStructure",[],"publicChapterContent","nextChapter","sections",[],"routes/_store+/_layout","routes/_store+/_readers+/_layout","actionData","errors"]

Table of Contents

Introduction

Why I’m doing this

Summary of Chapters

Acknowledgements

Please give me your feedback

Portugal should be hostile to insecure code

Attack vulnerable code

Next generation of internet users

PHS - Portuguese Hacking Service

Portuguese hackathon league

Other sources of talent

Convicted criminals

Retired people

Working together

“Made in Portugal”

Best in world

Portugal as a leader in AppSec

“Code Made in Portugal” brand

Past innovations

Drugs Decriminalization

Portuguese innovation for the 21st Century

Tesla in Portugal

How Secure is Portugal?

Our security model is based on a lack of attackers

The Emperor’s new clothes

Think I’m wrong?

The financial markets hack

Cyber crime is the problem

Attackers’ ROI (return on investment)

Thank your attackers

Military

Why do we have F16s?

Hit by the crossfire

Public health analogy

Red or blue pill?

Public health problem

Sane defense model

Where is the AppSec industry?

Be proactive

Hack like football

Let’s do the same for hacking

Hacking

Hacking created the Internet

Real world hacks

Hackers’ values

Creating Your future

Be different

Open source

Openness is key

Open source is not Communism

FOSS Values

Open Source is expensive

Open source lingua franca\n

OpenSource.pt

Open the source of Portuguese code

The next level App Security Social Graph

The cathedral’s eyeballs

Use Git to version legislative development and ask for public consultation

Principle of Public Access in Sweden

Privacy

Defend privacy

Cryptography

The Need for Disclosure

Whistleblowers have an important role

Protected by law

Limited privacy for state and companies

Learn from the music industry

Government

Collaborative Commons

Government’s role

Code is Law

Who controls the world?

Governments can make a difference

Iterate exponentially

Ministry of Code

Clear Software Act

Software Testing Institute

ASAE for code

When regulation loses the plot