Breached by a Ten Foot Clown

Breached by a Ten Foot Clown

Speakers: Lozza, Auditor (Governance, Risk and Compliance)

Conference: Kawaiicon

YouTube: https://www.youtube.com/watch?v=AlaxAFaiisQ

Overview

In "Breached by a Ten Foot Clown," Lozza, a former circus performer turned Governance, Risk, and Compliance (GRC) professional, delivers a captivating and unconventional talk that challenges traditional security paradigms. Through a series of personal anecdotes from her past life as a stilt-walking clown, Lozza vividly illustrates how human factors, unexpected behavior, and a focus on known threats can create glaring vulnerabilities in seemingly robust security systems. The talk serves as a compelling argument for a fundamental shift in security strategy: moving away from an exception-based model to one that rigorously defines and enforces normal and acceptable behavior.

Lozza, now an auditor assessing risks within the government, leverages her unique background to highlight a critical blind spot in many security frameworks. Her stories, though humorous and seemingly innocuous, expose profound weaknesses in physical security, access control, and identity verification that stem from human nature, convenience, and a lack of preparedness for truly novel threat vectors—or in this case, a 9.5-foot clown. The presentation underscores the idea that even the most sophisticated technical controls can be rendered ineffective when confronted with human ingenuity, social engineering, and a failure to anticipate the truly unpredictable.

The core message resonates deeply within the cybersecurity community, urging practitioners to consider a more holistic and proactive approach to security. By framing security as a problem of defining "what should be" rather than merely reacting to "what shouldn't be," Lozza prompts a re-evaluation of how organizations design and implement their defenses. Her insights are particularly relevant for those grappling with the limitations of current security models in the face of ever-evolving threats, emphasizing that sometimes, the most dangerous "attackers" are simply those who operate outside the anticipated norm.

Background

▶ Watch: Clowns as hackers: understanding rules to break them (2:00)

Lozza's unique perspective on security is deeply rooted in her decade-long career as a circus performer, specifically as a stilt-walking clown. She posits that clowns, by their very nature, are expert rule-breakers, much like hackers. To safely and playfully subvert expectations and rules, a clown must first possess an intimate understanding of how things are supposed to work. This foundational knowledge allows them to identify and exploit the boundaries of established norms, transforming them into vulnerabilities for comedic or, in a security context, malicious ends. This analogy forms the philosophical bedrock of her talk, suggesting that understanding "normal" is key to understanding "abnormal" and, therefore, "breachable."

The specific anecdotes Lozza shares date back to 2009 and earlier, a period that, while not ancient history, predates many of the advanced security practices and widespread awareness of social engineering prevalent today. These stories provide a historical context, illustrating how common security oversights and human vulnerabilities have persisted. The problem, as Lozza articulates, arises because security strategies often prioritize defending against known threats, indicators of compromise (IOCs), and anticipated attack patterns. This exception-based security approach, while necessary, leaves organizations exposed to novel attacks, zero-days, and, critically, unforeseen human behaviors that exploit trust, convenience, or simple lack of imagination on the part of security planners.

Lozza's experiences highlight an enduring challenge: the inherent conflict between security protocols and human desire for efficiency, convenience, or even just politeness. When security measures become overly burdensome or inconvenient, individuals—even those with good intentions—are often compelled to find workarounds. This tendency to bypass controls for practical reasons creates critical gaps, transforming well-intentioned employees or even security personnel into unwitting enablers of potential breaches. Her talk serves as a powerful reminder that security is not solely a technical problem but a complex interplay of technology, human psychology, and organizational culture.

Key Findings

▶ Watch: Bank security guard gives clown his access card (13:15)

Lozza's talk presents three distinct, yet interconnected, case studies from her past as a clown, each illuminating a different facet of security vulnerability stemming from human factors and inadequate defensive strategies. These anecdotes collectively form the "key findings" of her presentation:

1. Physical Perimeter Breach via Social Engineering (Cadbury Jaffa Race, 2009):

• The Scenario: During the annual Cadbury Jaffa Race down Dunedin's Baldwin Street (the world's steepest street with a 35° gradient), a security perimeter was established to prevent public access to the race path, particularly given that Jaffas could reach speeds of over 100 km/h. Lozza, a stilt-walking Victorian lady, wished to traverse the cordoned-off street.
• The Finding: Despite clear physical barriers and the inherent danger, Lozza successfully bypassed the security perimeter merely by asking politely. A security guard, failing to anticipate the implications of an unusual request from a seemingly harmless (albeit 9.5-foot tall) individual, assisted her over the barrier. This act delayed the race by approximately 20 minutes and put Lozza in a highly unsafe situation.
• Implication: This demonstrates that physical security measures are only as strong as the human element enforcing them. A polite, unexpected request, particularly from someone operating outside the perceived "threat model," can easily circumvent established physical controls. It highlights a critical failure in threat anticipation and ad-hoc decision-making by frontline personnel.

1. Access Control Compromise through Convenience (Big Bank End-of-Year Party):

• The Scenario: Hired to entertain at a multi-floor bank Christmas party, Lozza (on stilts) needed to move between five different floors, each requiring an electronic access card. To facilitate visitor movement, a security guard was assigned to escort non-cardholders.
• The Finding: After repeatedly escorting Lozza between floors every five minutes, the security guard grew tired of the inconvenience and handed her his universal access card. This card granted her unfettered access to all floors of the bank. While Lozza claims she "didn't abuse it" beyond exploring dark, unlit floors with unlocked computer screens, the potential for a severe data breach or physical compromise was immense.
• Implication: This is a classic example of insider threat (even if unintentional) and the subversion of granular access control for the sake of convenience. It underscores that overly burdensome security policies can lead users (including security personnel) to find workarounds, thereby creating significant vulnerabilities. The presence of unlocked computer screens further highlights a lack of basic endpoint security hygiene.

1. Identity Verification and Social Engineering Exploitation (Winz Office Appointment):

• The Scenario: Lozza, dressed in full "corpo clown" attire (including stilts and heavy makeup) for a job seeker appointment at a government welfare office (Winz), was required to present ID for positive identification.
• The Finding: Despite the receptionist acknowledging that Lozza's heavy makeup prevented proper ID verification, she had already "identified" Lozza based on prior dealings and her unique appearance. Subsequently, Lozza used her clown persona to create a spectacle, distracting staff and even receiving a guided tour of the office, including back offices and printing rooms, from an enthralled caseworker. This exposed private information on screens and potentially sensitive areas. The manager's strong reaction ("What are you doing? You can't take this clown around the office... privacy. She could be stealing things.") confirmed the severe security and privacy breaches that occurred.
• Implication: This demonstrates the failure of identity verification protocols when confronted with social influence and prior (flawed) recognition. It powerfully illustrates how social engineering, exploiting human curiosity, the desire for entertainment, and a breakdown of professional boundaries, can lead to unauthorized access to sensitive areas and potential data exposure, bypassing both physical and procedural controls. The incident highlights the critical importance of strict adherence to privacy regulations and the dangers of allowing unexpected events to disrupt standard operating procedures.

The overarching key finding from all these tales is the critical flaw in exception-based security strategies. Such strategies, focused on blocking known bads, are inherently vulnerable to anything that falls outside the anticipated "normal"—including novel attacks, zero-days, and "clowns" who simply operate differently. Lozza argues that a more robust approach is to define and enforce normal, expected, and acceptable behavior, and then block anything that deviates from that defined norm.

Technical Deep Dive

▶ Watch: Disembodied clown head appears over privacy screen at WINZ (18:00)

Lozza's talk, while presented anecdotally, delves into fundamental security concepts and technical vulnerabilities. The "breaches" she describes, though facilitated by her unique persona, expose systemic weaknesses that are highly relevant to modern cybersecurity.

At the heart of the bank and Winz scenarios lies Access Control. The bank had implemented electronic access cards and granular access control, designed to restrict movement between departments and floors. However, the system's technical robustness was undermined by human factors. The security guard's universal access card, a critical component, represented a single point of failure. Its transfer to Lozza effectively bypassed all technical access controls, granting her privileges far exceeding what any visitor should possess. This highlights a common vulnerability: even sophisticated Identity and Access Management (IAM) systems are only as secure as the human processes and policies governing credential issuance and use. The mention of unlocked computer screens on dark floors further points to a basic lapse in endpoint security hygiene, where individual workstations, potentially containing sensitive data, were left vulnerable to physical access.

Physical Security measures were also repeatedly tested. The Cadbury Jaffa Race relied on a cordoned-off perimeter, a common physical control. However, the lack of a robust protocol for handling highly unusual, non-threatening requests allowed this perimeter to be breached. Similarly, the Winz office utilized a privacy screen, an architectural control designed to prevent casual observation, but its 8-foot height was insufficient against a 9.5-foot stilt-walker, rendering it ineffective. These examples demonstrate that physical controls must be designed with a comprehensive understanding of potential bypasses, including those that might seem outlandish. They also underscore the need for layered security, where physical barriers are complemented by vigilant human oversight and clear, enforced procedures.

Identity Verification was a significant point of failure in the Winz scenario. The requirement to present ID for positive identification is a standard security protocol against fraud. However, the receptionist's prior, informal recognition of Lozza, coupled with the visual obfuscation of heavy makeup, led to a breakdown in this critical process. This illustrates how informal trust and a failure to strictly adhere to protocols can compromise the integrity of identity verification, opening doors for unauthorized access or fraudulent activity.

The most pervasive "technical" vector in Lozza's stories is Social Engineering. Her clown persona served as an exceptionally effective social engineering tool, exploiting various human traits:

• Politeness and Deference: The security guard at the Jaffa race responded to a polite request, overriding his duty to maintain the perimeter.
• Annoyance and Convenience: The bank security guard's frustration with repeated escorts led him to delegate his access, prioritizing convenience over security policy.
• Curiosity and Entertainment: The Winz staff were captivated by the clown, leading a caseworker to offer a guided tour, completely disregarding privacy concerns and data confidentiality.
• Exploitation of Authority/Uncertainty: The manager at Winz, attempting to assert authority, was outmaneuvered by Lozza's "clown logic" ("I can't stoop that low"), demonstrating how an unexpected response can disarm and confuse those attempting to enforce rules.

These instances highlight how social engineering attacks bypass technical controls by manipulating human psychology. Lozza's talk implicitly advocates for a shift in security strategy paradigms. She critiques exception-based security, which focuses on known indicators of compromise (IOCs) and expected attack patterns. This approach is inherently reactive and vulnerable to anything truly novel or "out of left field"—such as a 10-foot clown. Instead, she proposes a behavior-based security model, akin to principles found in Zero Trust Architecture. This model defines and enforces "normal," "expected," and "acceptable" behavior for all users, systems, and network activities. By establishing a baseline of legitimate operations, anything that deviates from this baseline can be flagged and blocked, thereby protecting against zero-days, novel attacks, and the unpredictable actions of "clowns" (i.e., highly unusual threat vectors). This proactive stance aims to "ring-fence" acceptable conduct, making the environment more resilient against unforeseen threats.

Demo / Proof of Concept

▶ Watch: Benefit approved on the spot after confronting the boss (30:00)

While "Breached by a Ten Foot Clown" did not feature a live, technical demonstration in the traditional sense, Lozza's entire presentation served as an extended and highly effective anecdotal proof of concept. Each of her three stories functioned as a detailed case study, illustrating how security controls—both physical and procedural—were bypassed through human interaction and social engineering.

The "demonstrations" within the talk were the vivid recounts of her actions:

• The Cadbury Jaffa Race: Lozza's description of walking up the steepest street in the world, aided by a security guard, visually demonstrated the ease with which a physical perimeter could be breached by a simple, polite request from an unexpected entity. This acted as a proof of concept for how human politeness can override security protocols.
• The Bank Party: Her narrative of receiving and using a security guard's universal access card to freely roam five floors of a bank served as a powerful proof of concept for how convenience and human fatigue can undermine even granular electronic access control systems. The subsequent exploration of unlit floors with unlocked computer screens further demonstrated potential endpoint security vulnerabilities.
• The Winz Office: Lozza's detailed account of bypassing identity verification with heavy makeup, subsequently receiving a guided tour of sensitive office areas, and creating a general distraction through her clown persona, provided a compelling proof of concept for the efficacy of social engineering in compromising both physical and informational security. The subsequent dressing down of the caseworker by the manager further validated the severe security breaches that occurred.

Each story, meticulously recounted with specific details (e.g., the 35° gradient, the 100 km/h Jaffas, the 20-minute race delay), offered tangible evidence of how unconventional approaches can exploit human vulnerabilities and systemic weaknesses. Lozza's performance itself—her towering presence on stilts, her playful demeanor, and her engaging storytelling—reinforced the power of an unexpected "clown" to command attention and subtly influence behavior, mirroring the very mechanisms she described in her past "breaches." Thus, the talk, though not a technical hack, was a masterful demonstration of human-centric security vulnerabilities.

Defensive Implications

▶ Watch: Security takeaway: define normal behavior, block everything else (31:00)

Lozza's talk offers profound defensive implications, urging security professionals to re-evaluate their strategies beyond conventional threat models. The primary takeaway for defenders is the urgent need to shift from a reactive, exception-based security approach to a more proactive, behavior-based security model.

1. Define and Enforce "Normal" Behavior: Organizations must explicitly define what constitutes normal, expected, and acceptable behavior for all users, systems, and network activities. This involves establishing clear baselines for access patterns, data usage, application execution, and physical movement. By "ring-fencing" acceptable conduct, any deviation can be automatically flagged as suspicious, allowing for detection and blocking of novel attacks, zero-days, and unexpected social engineering attempts that fall outside traditional threat intelligence. This is a foundational principle of Zero Trust Architecture, where trust is never assumed, and all actions are continuously verified against established norms.

1. Strengthen the Human Element in Security:

• Advanced Security Awareness Training: Move beyond generic phishing tests. Train employees on sophisticated social engineering tactics, emphasizing the psychological triggers Lozza exploited (politeness, convenience, curiosity). Educate staff on the importance of strict adherence to access control policies and identity verification protocols, regardless of who is making the request or how "harmless" they seem.
• Empower and Reward Vigilance: Foster a culture where employees feel empowered to question unusual requests, verify identities, and report suspicious activities without fear of reprisal, even if it means inconveniencing someone or challenging a perceived authority.
• Usable Security Policies: Review and refine security policies to ensure they are practical and don't create undue burdens that encourage circumvention. If a policy is too inconvenient (e.g., constant escorts), users will find workarounds, so design policies with human factors in mind while maintaining security integrity.

1. Rethink Access Control and Least Privilege:

• Eliminate Universal Access: Scrutinize and minimize the existence of universal access cards or credentials that grant broad privileges across an organization. Implement the principle of least privilege rigorously, ensuring individuals and systems only have the minimum access necessary for their function.
• Robust Credential Management: Implement strong Multi-Factor Authentication (MFA) for all access, especially for privileged accounts. Regularly audit access logs to detect unusual patterns, such as a security guard's card being used in multiple disparate locations or at odd hours.
• Visitor Management Systems: Implement strict and clearly defined protocols for all visitors, including temporary badges with limited access, mandatory escorts, and thorough logging.

1. Reinforce Physical Security with Procedural Controls:

• Layered Physical Defenses: Physical barriers (like cordons or privacy screens) are insufficient on their own. They must be complemented by clear procedures for staff to follow when encountering unusual situations or requests.
• Unattended Workstation Policies: Enforce policies requiring all workstations to be locked when unattended, regardless of location or perceived security level, to prevent opportunistic data exposure. This addresses the "unlocked computer screens" vulnerability.
• Regular Security Audits and Penetration Testing: Conduct both technical and social engineering-focused penetration tests to identify weaknesses in physical, procedural, and human defenses. These should include scenarios that challenge conventional assumptions about threat actors.

1. Expand Risk Assessment and Incident Response:

• Broaden Threat Modeling: Incorporate "clown scenarios"—highly unusual, low-probability but high-impact events—into threat modeling and risk assessments. This forces organizations to think beyond typical adversaries and attack vectors.
• Prepare for Novel Incidents: Develop incident response plans that can adapt to unforeseen circumstances, rather than rigid playbooks designed only for known attack types. This includes protocols for managing public relations and internal communications during highly unusual security incidents.

By adopting these defensive strategies, organizations can build more resilient security postures that account for the unpredictable nature of human behavior and the limitations of solely relying on reactive defenses.

Key Takeaways

• Human Factors are Critical Vulnerabilities: Even robust technical security controls can be easily bypassed when human trust, convenience, or curiosity are exploited.
• Exception-Based Security is Insufficient: Relying solely on blocking known threats and indicators of compromise leaves organizations highly vulnerable to novel attacks, zero-days, and unexpected social engineering.
• Define "Normal" for Stronger Security: A more effective security strategy involves explicitly defining and enforcing "normal," "expected," and "acceptable" behavior for all users and systems, and then blocking anything that deviates.
• Social Engineering Remains a Potent Threat: Attackers can leverage seemingly innocuous personas and polite requests to compromise physical access, identity verification, and sensitive data.
• Convenience Often Undermines Security: Overly burdensome security policies or repeated inconveniences can lead even trusted personnel to find workarounds, creating significant vulnerabilities.
• Rigorous Identity Verification and Least Privilege are Paramount: Strict adherence to identity verification protocols and the principle of least privilege are essential to prevent unauthorized access and mitigate the impact of compromised credentials.

About the Speaker(s)

Lozza is an Auditor specializing in Governance, Risk, and Compliance (GRC), currently working within the government sector where she assesses various organizational risks. Before transitioning into the world of cybersecurity and risk management, Lozza spent a decade as a circus performer, primarily as a stilt walker and clown. This unique background has provided her with an unconventional yet insightful perspective on rule-breaking, human behavior, and the often-unforeseen ways in which systems and protocols can be challenged. Her experiences as a "clown," understanding how to subvert expectations and rules, directly inform her analytical approach to identifying and mitigating security vulnerabilities in complex environments.