Firewalls & Fire Alarms: When Defenses Go Up in Smoke - Dr. Catherine J. Ullman | CypherCon 8.0

### Overview In this presentation at CypherCon 8.0, Dr. Catherine J. Ullman draws on her dual background of over 25 years working in IT at the University at Buffalo and nearly 30 years as a volunteer firefighter. She presents a comparative analysis between physical fire disasters and cybersecurity failures, focusing on the 1903 Iroquois Theater fire in Chicago and the 2021 Conti ransomware attack on the Irish Health Service Executive (HSE). Her core thesis is that security professionals must assume controls will inevitably fail, treating controls as safeguards designed to delay disasters rather than absolute preventions.

### Key Topics - **The Fallacy of 'Fireproof' and 'Secure':** Ullman deconstructs the misconception of absolute protection, explaining that physical materials burn indirectly and safes are merely time-rated to delay fire. Similarly, cybersecurity controls cannot guarantee total immunity; they are layers meant to buy time for intervention. - **Case Study: The Iroquois Theater Fire (1903):** Advertised as 'absolutely fireproof' following the deadly Brooklyn Theater fire of the 1870s, the venue featured theoretical controls including concrete construction, an asbestos stage curtain, roof ventilators/skylights, standpipes, sprinklers, over 30 emergency exits, and an on-site house fireman. Rushed construction to open the theater season led to unfinished sprinklers, unconnected standpipes, ventilators nailed shut to keep out cold air, and an ineffective wood-pulp curtain without its brass frame. When an arc light ignited gauze curtains and oil-painted scenery, the fire killed 602 people (mostly women and children attending the matinee of 'Mr. Bluebird') and injured 250, compounded by locked gates, bizarre door latches, covered exit signs, and lack of alarm pull boxes or phones. - **Case Study: The Irish Health Service Executive (HSE) Ransomware Attack:** Classified as critical infrastructure with 4,000 locations, 54 acute hospitals, 130,000 staff, and over 70,000 devices, the HSE suffered an attack where Conti ransomware executed on six hospitals. Despite only six hospitals being directly encrypted, 31 had to cancel services, shifting completely to pen and paper for patient care, diagnostics, and prescriptions. Although HSE had firewalls, antivirus, and incident response retainers, systemic issues such as flat network architecture, antivirus operating in monitor-only mode, unpatched end-of-life systems, and absence of central security governance/CISO hindered effective defense.

### Technical Details & Control Failures - **Prevention Failures:** Both incidents suffered from unverified controls and false senses of security. In Chicago, inspectors accepted free tickets, ignoring non-fireproofed scenery and absent equipment. In HSE, systems lacked consistent patch maintenance, and endpoint tools ran in monitor mode rather than active blocking. - **Detection Failures:** The theater lacked fire alarm systems, pull boxes, and functional sprinklers. In the cyber realm, organizations often assume an alert (e.g., stopping a single Mimikatz execution) means safety, ignoring secondary persistence methods. HSE also lacked centralized 24/7 continuous log monitoring by analysts. - **Containment Failures:** The theater's fireman was given only six 'kilfyre' dry-powder tubes—wholly ineffective against high ceiling fires. For HSE, flat network topology allowed unrestricted spread, while the lack of central leadership led to fragmented responses (such as local admins being told merely to reboot an actively compromised server). - **Response & Communication Delays:** The theater lacked phones, requiring someone to run down the street to a firehouse, while locked exit gates trapped patrons. HSE lacked an out-of-band communication channel and formal incident response playbooks.

### Takeaways - **Audit and Verify Controls:** Never rely on the mere presence of a control; actively test and maintain tools to verify they operate as expected and are not bypassed or misconfigured. - **Structural Changes Emerge from Failure:** The Iroquois disaster led to modern building codes, crash bars on exit doors, separate electrical circuits for exit signs, Underwriters Laboratories (UL), and capacity limits. Post-attack, HSE introduced 24/7 monitoring, temporary CISO/CTO roles, network segmentation for legacy assets, playbooks, SIEM, SOAR, UEBA, and vulnerability scanning. - **Prepare for Failure and Practice Alternatives:** Organizations should conduct tabletop exercises (TTXs) such as 'catch me if you can' scenarios, maintain out-of-band communication plans, and drill incident responses without relying entirely on automated primary tools.