1
00:00:00,000 --> 00:00:12,360
Welcome to Logically Speaking, where we discuss the latest trends in cybersecurity challenges
2
00:00:12,360 --> 00:00:14,320
with topic experts in their own field.
3
00:00:14,320 --> 00:00:18,600
Today, you're going to learn how to protect your data, how to keep your operation sound,
4
00:00:18,600 --> 00:00:21,160
and your business ready for whatever comes next.
5
00:00:21,160 --> 00:00:23,440
This is Logically Speaking.
6
00:00:23,440 --> 00:00:27,800
Today's guest is Craig Bowman, and I'm very excited about Craig joining us.
7
00:00:27,800 --> 00:00:32,160
Craig is a senior director at VMware's Federal Division, and previously Craig and I worked
8
00:00:32,160 --> 00:00:37,360
together at Verizon, where he was the vice president of advanced services, providing
9
00:00:37,360 --> 00:00:42,240
strategy, engineering support, secure cloud initiatives in the public sector.
10
00:00:42,240 --> 00:00:45,520
Craig speaks internationally about cybersecurity.
11
00:00:45,520 --> 00:00:51,440
He's briefed congressional officers, senators, Olympic committees, and international defense
12
00:00:51,440 --> 00:00:52,440
leaders.
13
00:00:52,440 --> 00:00:54,680
Craig, thank you very much for joining us.
14
00:00:54,680 --> 00:01:00,700
I'm hoping that you could share a little bit more about your history and experience in
15
00:01:00,700 --> 00:01:04,840
cybersecurity, because I know you've got an illustrious career.
16
00:01:04,840 --> 00:01:09,840
So you can start there and share a little bit about your experience.
17
00:01:09,840 --> 00:01:10,840
Sure.
18
00:01:10,840 --> 00:01:13,840
Steve's good to see you again.
19
00:01:13,840 --> 00:01:18,440
So I think people come to the industry differently, obviously.
20
00:01:18,440 --> 00:01:23,000
For me, it was a long time ago, so I'm much older probably than I look.
21
00:01:23,000 --> 00:01:27,800
When I got into the industry, I graduated back in the early 90s.
22
00:01:27,800 --> 00:01:29,560
Cyber was not really a big thing.
23
00:01:29,560 --> 00:01:33,920
The internet, where it didn't come about until 1996, that's when the Telecommunication
24
00:01:33,920 --> 00:01:40,560
Act was signed, and a little project called DARPA becomes the internet.
25
00:01:40,560 --> 00:01:44,040
And yes, Al Gore actually did have something to do with it, believe it or not.
26
00:01:44,040 --> 00:01:48,000
He was a young senator that introduced the bill.
27
00:01:48,000 --> 00:01:54,720
So I was actually talking to, I was actually talking to Vince Cerf, and Vince was the one
28
00:01:54,720 --> 00:02:01,080
who filled me in on the impact that Al Gore actually had by introducing the bill that
29
00:02:01,080 --> 00:02:02,680
made the internet possible.
30
00:02:02,680 --> 00:02:03,680
So I was a little surprised.
31
00:02:03,680 --> 00:02:06,960
I didn't realize that he had as much to do with it as I thought.
32
00:02:06,960 --> 00:02:09,720
Anyway, so I started off with the US government.
33
00:02:09,720 --> 00:02:16,200
So I was asked to join the Department of Defense in a very specific area that at the time it
34
00:02:16,200 --> 00:02:20,440
was all standalone computers and coaxial cables.
35
00:02:20,440 --> 00:02:25,440
Cybersecurity was really about securing printers and photocopiers.
36
00:02:25,440 --> 00:02:27,480
It sounds ridiculous, but that's that.
37
00:02:27,480 --> 00:02:28,480
I mean, that was it.
38
00:02:28,480 --> 00:02:32,600
And from an offensive perspective, it was very much how do you get into the physical
39
00:02:32,600 --> 00:02:33,600
building?
40
00:02:33,600 --> 00:02:36,200
How do you get into the physical building and have access?
41
00:02:36,200 --> 00:02:41,560
And that's, you know, Kevin Mitnick has written a whole book about how in the early days he
42
00:02:41,560 --> 00:02:44,560
used to get in by socially engineering people.
43
00:02:44,560 --> 00:02:45,960
So that was cyber.
44
00:02:45,960 --> 00:02:51,560
And then as many of us young people do as you're moving along in the IT field, you from
45
00:02:51,560 --> 00:02:57,040
networking to software development, and then suddenly cyber becomes a thing as we begin
46
00:02:57,040 --> 00:03:00,720
to realize that adversaries are coming after our computers.
47
00:03:00,720 --> 00:03:04,600
And so then you sort of get into cybersecurity and start learning about cyber as you go along.
48
00:03:04,600 --> 00:03:09,400
But there wasn't this sort of formal training that we have now in colleges that you go take
49
00:03:09,400 --> 00:03:11,800
a course and get a degree in that just didn't exist.
50
00:03:11,800 --> 00:03:18,120
So we all of mine was OJT directly working for folks and figuring it out as I went along.
51
00:03:18,120 --> 00:03:19,800
That's how I got into it.
52
00:03:19,800 --> 00:03:24,120
Yeah, I know you and I have similar kind of paths into cybersecurity.
53
00:03:24,120 --> 00:03:26,240
I kind of stumbled into it.
54
00:03:26,240 --> 00:03:34,160
And back in the same timeframe in the nineties, and I remember when it was MCI at the time,
55
00:03:34,160 --> 00:03:41,560
WorldCom talking about writing TCP of the TCP IP, and that was kind of his contribution.
56
00:03:41,560 --> 00:03:50,400
And I remember we sound like two old guys, but we do, you know, stepping into cybersecurity
57
00:03:50,400 --> 00:03:56,200
just kind of deploying firewalls, Raptor firewalls at the time that eventually Symantec ended
58
00:03:56,200 --> 00:03:57,200
up buying.
59
00:03:57,200 --> 00:04:03,200
Hey, Steve, I had to tell you we are old just to let you know.
60
00:04:03,200 --> 00:04:04,200
We are a bunch of old guys.
61
00:04:04,200 --> 00:04:07,400
You may not think about it, but we are.
62
00:04:07,400 --> 00:04:12,360
But it's so interesting because you then see evolution of an industry, right, and you
63
00:04:12,360 --> 00:04:15,400
look back and you start to see these changes.
64
00:04:15,400 --> 00:04:24,040
So I'm interested to know your opinion, especially in the sled space, how they're handling this
65
00:04:24,040 --> 00:04:27,720
kind of ever changing, ever evolving threat landscape.
66
00:04:27,720 --> 00:04:28,720
Right.
67
00:04:28,720 --> 00:04:33,600
This is an area that our listeners sometimes are challenged with.
68
00:04:33,600 --> 00:04:38,920
So with your experience, how do you see what's your opinion on how that sled market is addressing
69
00:04:38,920 --> 00:04:40,800
the ever changing landscape?
70
00:04:40,800 --> 00:04:43,000
State and local education.
71
00:04:43,000 --> 00:04:44,000
All right.
72
00:04:44,000 --> 00:04:45,920
So that's a really good one, actually.
73
00:04:45,920 --> 00:04:47,760
I didn't know you were going to go sleds.
74
00:04:47,760 --> 00:04:49,720
That's a good one.
75
00:04:49,720 --> 00:04:52,680
So it depends on the state.
76
00:04:52,680 --> 00:04:56,160
I was fortunate enough, as you know, at Verizon to cover all of state and local.
77
00:04:56,160 --> 00:04:58,840
And I am very much a hands on person.
78
00:04:58,840 --> 00:05:02,320
Steve, as you know, so I was traveling a lot, I was on an airplane a lot to all the different
79
00:05:02,320 --> 00:05:03,320
states.
80
00:05:03,320 --> 00:05:05,360
And the state has a very different set of problems.
81
00:05:05,360 --> 00:05:10,480
If you look at Mike Dent in Fairfax County, Virginia, for instance, and he was just on
82
00:05:10,480 --> 00:05:16,640
my podcast recently, you know, his challenge is that this area is becoming the next Silicon
83
00:05:16,640 --> 00:05:17,920
Valley.
84
00:05:17,920 --> 00:05:25,120
And so he has to create a cyber trust around the infrastructure that is at the same level
85
00:05:25,120 --> 00:05:28,280
as what you would expect from big tech companies.
86
00:05:28,280 --> 00:05:35,480
That is a very different challenge than if you go to California and you go to like Eli
87
00:05:35,480 --> 00:05:41,440
Owen, who's running the emergency response team for all of the forest fires and all that
88
00:05:41,440 --> 00:05:42,440
stuff.
89
00:05:42,440 --> 00:05:48,400
So, you know, we don't have the sort of natural disasters in Virginia that Eli has in California.
90
00:05:48,400 --> 00:05:52,080
And so how do you protect those two different environments is very different.
91
00:05:52,080 --> 00:05:56,520
You know, in the case of, you know, in the case of Mike Dent, it's about just sort of
92
00:05:56,520 --> 00:06:02,440
traditional endpoint detection, firewalls, all the things that we as a company do.
93
00:06:02,440 --> 00:06:07,680
But then when you get out into California, you know, it's very much edge devices, low
94
00:06:07,680 --> 00:06:13,640
bandwidth, unpredictable networks that they've got to account for and plan for.
95
00:06:13,640 --> 00:06:17,800
And that's not something that I think the average citizen kind of thinks about, you
96
00:06:17,800 --> 00:06:21,480
know, when you're in California, you know, if communications goes down and gets hacked
97
00:06:21,480 --> 00:06:27,000
during a natural disaster, people actually die or they could be left, you know, stranded
98
00:06:27,000 --> 00:06:29,080
to where they can't survive.
99
00:06:29,080 --> 00:06:32,440
And so they've got to think through all of that very differently than than like Mike Dent
100
00:06:32,440 --> 00:06:33,640
does.
101
00:06:33,640 --> 00:06:37,080
And then you go to university areas.
102
00:06:37,080 --> 00:06:41,080
And when you talk to the universities, you know, they have an interesting challenge in
103
00:06:41,080 --> 00:06:49,040
that their customers or their quote, quote, employees, the students are incredibly transient.
104
00:06:49,040 --> 00:06:52,280
So they come in, it has to be BYOD.
105
00:06:52,280 --> 00:06:56,840
So they've got to account for for in all kinds of devices and configurations.
106
00:06:56,840 --> 00:06:58,440
They've got to protect those things.
107
00:06:58,440 --> 00:07:01,720
And then within four years, you know, every year, a whole new tranche comes in and every
108
00:07:01,720 --> 00:07:06,480
four years, the accounts that they started with are terminated are gone as the students
109
00:07:06,480 --> 00:07:08,000
graduate and move on.
110
00:07:08,000 --> 00:07:10,360
So state and locals got a very different footprint.
111
00:07:10,360 --> 00:07:13,720
And so when I look across it, I would say, am I seeing trends?
112
00:07:13,720 --> 00:07:17,400
Oh, and there's one other which is infrastructure.
113
00:07:17,400 --> 00:07:23,800
So globally, I think when we saw the infrastructure bill introduced, it gave the states an opportunity
114
00:07:23,800 --> 00:07:29,400
to really look at our critical infrastructure.
115
00:07:29,400 --> 00:07:38,160
Our critical infrastructure for years has been has been neglected by the country in general.
116
00:07:38,160 --> 00:07:42,200
We see it in our roads and our bridges and our water treatment facilities and all those
117
00:07:42,200 --> 00:07:44,920
things are power grids.
118
00:07:44,920 --> 00:07:51,360
And I think that from a nation state actor perspective, when we look at the sort of like
119
00:07:51,360 --> 00:07:56,880
the individual small hackers going after university or something, that's annoying to the university.
120
00:07:56,880 --> 00:08:03,200
But the big hits are going to be when, let's say, Russia decides that they want to retaliate
121
00:08:03,200 --> 00:08:06,640
for what's going on in Eastern Europe.
122
00:08:06,640 --> 00:08:10,240
Or you know, there are worse adversary, which is China.
123
00:08:10,240 --> 00:08:14,760
If they decide to come after us, they're going to be coming after us from a core infrastructure
124
00:08:14,760 --> 00:08:15,760
perspective.
125
00:08:15,760 --> 00:08:21,160
They want to take down our financial institutions, our critical infrastructure, our government
126
00:08:21,160 --> 00:08:23,080
and our defense.
127
00:08:23,080 --> 00:08:28,680
If they can destabilize the economy, that will have a bigger impact on the citizen's
128
00:08:28,680 --> 00:08:34,920
willingness to support our US government in any kind of in any kind of tit for tat thing
129
00:08:34,920 --> 00:08:35,920
going on overseas.
130
00:08:35,920 --> 00:08:39,400
So they're going to, they're going to come after us and our infrastructure is woefully
131
00:08:39,400 --> 00:08:40,800
neglected.
132
00:08:40,800 --> 00:08:46,280
So I'm hopeful that the infrastructure bill will be used to shore up some of those weaknesses.
133
00:08:46,280 --> 00:08:50,840
Yeah, you brought up a couple of really interesting points that I wanted to kind of hone in on
134
00:08:50,840 --> 00:08:53,480
universities first.
135
00:08:53,480 --> 00:09:00,920
So you know, the environments in universities oftentimes want to be more collaborative and
136
00:09:00,920 --> 00:09:03,320
less restrictive.
137
00:09:03,320 --> 00:09:08,680
In your opinion, how does that kind of play into this, you know, addressing the cybersecurity
138
00:09:08,680 --> 00:09:09,680
challenge?
139
00:09:09,680 --> 00:09:18,000
How do you recommend that they navigate that versus locking down systems and reducing collaboration,
140
00:09:18,000 --> 00:09:24,920
but universities traditionally want to be more open, be more, you know, sharing of information
141
00:09:24,920 --> 00:09:25,920
and data?
142
00:09:25,920 --> 00:09:29,320
How do you envision that kind of delicate balance?
143
00:09:29,320 --> 00:09:34,280
Yeah, I think the universities are doing a fairly decent job because they've got some
144
00:09:34,280 --> 00:09:39,200
new tools at their disposal, which make it makes it easier.
145
00:09:39,200 --> 00:09:42,000
They move most of their stuff to the cloud.
146
00:09:42,000 --> 00:09:49,040
And by jettisoning a lot of their infrastructure to cloud providers, it allows them to consolidate
147
00:09:49,040 --> 00:09:56,160
some of their initiatives and to, and to focus areas of attack from a cyber perspective.
148
00:09:56,160 --> 00:10:03,720
The challenge there is that the consumption cost is often higher than, than it could be
149
00:10:03,720 --> 00:10:09,440
traditionally if they have a high capacity student base and they were running it on prem.
150
00:10:09,440 --> 00:10:14,440
But the fortunate thing for universities is that they can pass that cost back to the student.
151
00:10:14,440 --> 00:10:16,640
And that's why we see our tuition so high, or part of it, right?
152
00:10:16,640 --> 00:10:19,320
And part of it is that some of that cost being passed back.
153
00:10:19,320 --> 00:10:26,840
And so students are basically paying, or parents of students are paying for their kids to be
154
00:10:26,840 --> 00:10:31,640
able to bring their own device to access things and not to have a bad experience in how they
155
00:10:31,640 --> 00:10:33,520
interact with the universities.
156
00:10:33,520 --> 00:10:38,520
The universities can rely on cloud infrastructure and pass that cost back to the students.
157
00:10:38,520 --> 00:10:45,000
I think that the weaknesses, the weakness areas are going to be when there is a sort of complacency
158
00:10:45,000 --> 00:10:48,600
to believe that because you've moved to the cloud, you are therefore secure, which is
159
00:10:48,600 --> 00:10:49,600
not the case.
160
00:10:49,600 --> 00:10:52,120
It's through application development.
161
00:10:52,120 --> 00:10:57,120
Those weaknesses in the way the apps are being developed and being deployed and being consumed,
162
00:10:57,120 --> 00:10:59,920
that's going to be the weak area for the universities.
163
00:10:59,920 --> 00:11:01,120
If they're not focused on that.
164
00:11:01,120 --> 00:11:05,120
If they think that, hey, we're running in Microsoft and so therefore we're secure, we're
165
00:11:05,120 --> 00:11:06,960
using all the Microsoft apps.
166
00:11:06,960 --> 00:11:10,960
It's the moment that they leave those Microsoft apps and they're interfacing with those apps,
167
00:11:10,960 --> 00:11:16,120
with apps they've developed, that API security and vulnerabilities are going to be introduced
168
00:11:16,120 --> 00:11:17,600
to the entire ecosystem.
169
00:11:17,600 --> 00:11:25,840
A lot of CISOs and CIOs know that, but a lot of application developers don't think it.
170
00:11:25,840 --> 00:11:29,240
I know how it is today because I don't write code.
171
00:11:29,240 --> 00:11:34,160
I don't throw code around like I used to, but when I was developing, I was never measured
172
00:11:34,160 --> 00:11:38,360
on the success of my security posture of my application.
173
00:11:38,360 --> 00:11:45,240
I was measured and rewarded on how quickly I could deliver the features of my software.
174
00:11:45,240 --> 00:11:50,480
Then it would go through some kind of a process that somebody would check for vulnerabilities,
175
00:11:50,480 --> 00:11:54,880
but nobody rewarded me for developing good security.
176
00:11:54,880 --> 00:11:57,680
So application developers, it's not the key thing to think about.
177
00:11:57,680 --> 00:12:03,520
Yeah, no, it's a really good point because when I started as a database programmer and
178
00:12:03,520 --> 00:12:10,680
I worked for a major pharmaceutical, we were doing clinical trials over the internet pretty
179
00:12:10,680 --> 00:12:15,120
much without any encryption.
180
00:12:15,120 --> 00:12:18,640
And now that would be unheard of, but yeah, you're right.
181
00:12:18,640 --> 00:12:24,640
We were more concerned about accessibility, ease of use, the user interface and security
182
00:12:24,640 --> 00:12:27,280
wasn't even an afterthought.
183
00:12:27,280 --> 00:12:34,400
You also mentioned critical infrastructure, how that's often neglected.
184
00:12:34,400 --> 00:12:37,960
So some of our listeners are in that space, right?
185
00:12:37,960 --> 00:12:46,240
Critical infrastructure, utilities, municipalities that are providing those services.
186
00:12:46,240 --> 00:12:50,800
What recommendations would you give just as a baseline?
187
00:12:50,800 --> 00:12:55,880
Is there something that you've seen to help them begin that crawl, walk, run in terms
188
00:12:55,880 --> 00:12:57,680
of cybersecurity?
189
00:12:57,680 --> 00:12:59,160
First of all, look at the infrastructure bill.
190
00:12:59,160 --> 00:13:01,040
I mentioned it before.
191
00:13:01,040 --> 00:13:03,080
We have to get funding.
192
00:13:03,080 --> 00:13:07,560
Right now the biggest challenge that people running water treatment facilities, power
193
00:13:07,560 --> 00:13:14,800
facilities, dams, all of those things, they just lack funding.
194
00:13:14,800 --> 00:13:16,040
It's not like they don't want to do it.
195
00:13:16,040 --> 00:13:17,680
It's just that they don't have the money to do it.
196
00:13:17,680 --> 00:13:25,360
A lot of the systems that these critical infrastructure systems were built on run on really old versions
197
00:13:25,360 --> 00:13:27,800
of windows, for instance.
198
00:13:27,800 --> 00:13:30,560
And they can't run on the new version in some cases.
199
00:13:30,560 --> 00:13:32,000
They simply won't run.
200
00:13:32,000 --> 00:13:35,240
And so they're stuck with, we can't get off.
201
00:13:35,240 --> 00:13:39,240
We're on unsupported versions of operating systems.
202
00:13:39,240 --> 00:13:42,880
And the cost to change that is very high.
203
00:13:42,880 --> 00:13:43,880
And that's not the majority.
204
00:13:43,880 --> 00:13:48,080
A lot of them are using standard software that's from big companies that modernize and
205
00:13:48,080 --> 00:13:49,080
all that jazz and stuff.
206
00:13:49,080 --> 00:13:55,280
But the other thing is that just the people that run the actual facilities are not cyber
207
00:13:55,280 --> 00:13:56,840
security experts.
208
00:13:56,840 --> 00:14:01,080
A lot of times they're required to do IT, but they're not really IT professionals.
209
00:14:01,080 --> 00:14:02,400
It's not a knock on them.
210
00:14:02,400 --> 00:14:06,880
It's just that just like you and I grew up changing printer cartridges, a lot of them
211
00:14:06,880 --> 00:14:08,680
don't have to do it every day.
212
00:14:08,680 --> 00:14:13,520
And so as a result, they do things to make their lives easier that unfortunately introduce
213
00:14:13,520 --> 00:14:16,080
risk into the environment.
214
00:14:16,080 --> 00:14:21,960
I was on a case not too long ago with critical infrastructure where somebody had stood up
215
00:14:21,960 --> 00:14:27,880
a relay so that they could access it from home because a lot of times they're called
216
00:14:27,880 --> 00:14:33,000
in at night to do things with the infrastructure and they just simply found it burdensome
217
00:14:33,000 --> 00:14:35,240
to get in their car and drive to the office and have to log in.
218
00:14:35,240 --> 00:14:39,480
And so they set up a relay and a closet that allowed them to get into the system.
219
00:14:39,480 --> 00:14:46,640
And those kinds of things, there are other ways of doing it now that can be used once
220
00:14:46,640 --> 00:14:48,520
the infrastructure has been modernized.
221
00:14:48,520 --> 00:14:52,560
But that was the only way they could have the ease of use.
222
00:14:52,560 --> 00:14:56,200
And in the moment they did that, it introduced unbelievable vulnerability where somebody remotely
223
00:14:56,200 --> 00:14:59,280
could come in and control our critical infrastructure.
224
00:14:59,280 --> 00:15:04,480
So I guess in the old Verizon days of the data breach investigation report, we would call
225
00:15:04,480 --> 00:15:05,960
that human error.
226
00:15:05,960 --> 00:15:06,960
Right.
227
00:15:06,960 --> 00:15:07,960
Right.
228
00:15:07,960 --> 00:15:08,960
Miscellaneous, I think is where they put it.
229
00:15:08,960 --> 00:15:12,600
You can't fix stupid is what we used to say.
230
00:15:12,600 --> 00:15:15,520
Oh, man.
231
00:15:15,520 --> 00:15:16,520
That's great.
232
00:15:16,520 --> 00:15:17,520
No, you're absolutely right.
233
00:15:17,520 --> 00:15:22,720
Hey, let's shift a little bit and think about looking back on your career.
234
00:15:22,720 --> 00:15:27,720
What's the biggest cybersecurity risk that you've seen?
235
00:15:27,720 --> 00:15:34,240
You just talked about one that seemed rather egregious, but look back on your career.
236
00:15:34,240 --> 00:15:39,920
What's the biggest one that you've had to address or you've seen over your career?
237
00:15:39,920 --> 00:15:41,720
I'm going to flip the question on you.
238
00:15:41,720 --> 00:15:44,320
How about the biggest risk I see today?
239
00:15:44,320 --> 00:15:50,320
As fast as for me is almost like who cares because the new risk is more significant.
240
00:15:50,320 --> 00:15:54,840
I think that question, by the way, Craig, but okay.
241
00:15:54,840 --> 00:15:55,840
All right.
242
00:15:55,840 --> 00:15:57,440
Well, maybe a couple of books.
243
00:15:57,440 --> 00:15:59,760
So I think yeah, we'll do, we'll do sort of past to present.
244
00:15:59,760 --> 00:16:03,960
I think that endpoint detection was always the biggest one.
245
00:16:03,960 --> 00:16:07,680
We, you know, the moment that all of us got these devices, that was the biggest like,
246
00:16:07,680 --> 00:16:11,520
yeah, we just didn't account for it properly.
247
00:16:11,520 --> 00:16:13,920
The mindset of people, so this is the past, right?
248
00:16:13,920 --> 00:16:17,920
The mindset of people that by downloading McPhee or Symantec, that that was somehow
249
00:16:17,920 --> 00:16:20,360
going to protect everything.
250
00:16:20,360 --> 00:16:21,360
Great companies, by the way.
251
00:16:21,360 --> 00:16:27,280
I mean, both of them are fantastic, you know, fantastic companies, but the reality is that,
252
00:16:27,280 --> 00:16:31,480
you know, they, all those companies were scrambling to kind of fill the gaps of the device.
253
00:16:31,480 --> 00:16:37,000
The devices came out long before we could adapt to the new threats that were going to
254
00:16:37,000 --> 00:16:38,000
be coming after them.
255
00:16:38,000 --> 00:16:41,240
That was the biggest risk I saw, endpoint detection.
256
00:16:41,240 --> 00:16:45,200
And with that comes the combined two-factor authentication, right?
257
00:16:45,200 --> 00:16:50,320
We did not adapt to factor authentication or multi-factor authentication quickly enough,
258
00:16:50,320 --> 00:16:52,200
let alone two factor.
259
00:16:52,200 --> 00:16:55,440
So many people, you know, multi-factor is not even a question.
260
00:16:55,440 --> 00:16:59,680
So anyway, that's what I saw what that was the biggest risk is how do we adapt quickly
261
00:16:59,680 --> 00:17:03,200
to an expanding footprint.
262
00:17:03,200 --> 00:17:11,080
I think as I look forward, the biggest challenges and worries that keep me up at night and I
263
00:17:11,080 --> 00:17:16,040
still work with the U.S. government is in two areas.
264
00:17:16,040 --> 00:17:23,760
One is that we must, by function of how we have to operate to make our government safe
265
00:17:23,760 --> 00:17:29,680
and to do more work, we're going to be pushing data further and further out to the edge.
266
00:17:29,680 --> 00:17:34,840
So we see words like sassy and edge computing and things like that.
267
00:17:34,840 --> 00:17:41,560
What that means is that, you know, the old methodology of our castle and moat firewalls
268
00:17:41,560 --> 00:17:49,360
protection, endpoint detection and those kinds of things are simply going away as we begin
269
00:17:49,360 --> 00:17:56,040
to move our trusted assets out of that castle wall and store them all over the place.
270
00:17:56,040 --> 00:18:01,480
That is going to be a huge threat to us because most of the scorecards and the evaluations
271
00:18:01,480 --> 00:18:07,120
that we've been doing have been under the understanding that we can create this cocoon
272
00:18:07,120 --> 00:18:11,480
and put all of our protected stuff in there and create ways of monitoring behavior within
273
00:18:11,480 --> 00:18:13,240
that environment.
274
00:18:13,240 --> 00:18:16,320
And then suddenly we start putting things in the cloud and then we go, okay, now we can
275
00:18:16,320 --> 00:18:20,880
do a CASB and now we can do, you know, let's just do the same thing there with a CASB in
276
00:18:20,880 --> 00:18:22,840
between and okay, we got that.
277
00:18:22,840 --> 00:18:25,040
But that's not the future of IT.
278
00:18:25,040 --> 00:18:29,800
The future of IT is literally the data is moving closest to who's consuming it almost
279
00:18:29,800 --> 00:18:30,800
on demand.
280
00:18:30,800 --> 00:18:35,960
That is a very heterogeneous and amorphous sort of environment.
281
00:18:35,960 --> 00:18:41,120
And so that is going to be something that most IT and security professionals simply
282
00:18:41,120 --> 00:18:42,120
are not prepared for.
283
00:18:42,120 --> 00:18:43,200
They're not trained for.
284
00:18:43,200 --> 00:18:47,480
They're old guys like us that, you know, we've got to go back to school.
285
00:18:47,480 --> 00:18:50,480
Young people will get it because they'll be coming out of school and that's what they'll
286
00:18:50,480 --> 00:18:53,020
be learning, but they have no experience.
287
00:18:53,020 --> 00:18:57,440
So they'll lack the historical knowledge with all this great new knowledge.
288
00:18:57,440 --> 00:19:00,320
And so somehow we've got to kind of merge those together.
289
00:19:00,320 --> 00:19:03,920
And our adversaries are going to take advantage of it for sure.
290
00:19:03,920 --> 00:19:10,920
The number two, I think, and this is going to be critical is computing.
291
00:19:10,920 --> 00:19:15,480
And I think that when people hear about quantum computing security risk, they don't quite
292
00:19:15,480 --> 00:19:18,040
understand what the problem is.
293
00:19:18,040 --> 00:19:26,240
AES-256 encryption is not something that can be easily broken even with quantum computers.
294
00:19:26,240 --> 00:19:28,640
So people say quantum is going to break encryption.
295
00:19:28,640 --> 00:19:35,040
It's not really going to break AES-256 in any meaningful way within my lifetime.
296
00:19:35,040 --> 00:19:41,440
What it is going to do in a few years is going to be able to break the keys that we use to
297
00:19:41,440 --> 00:19:44,920
open AES-256.
298
00:19:44,920 --> 00:19:46,120
Now why does that matter?
299
00:19:46,120 --> 00:19:52,440
Well, it matters because we know that our adversaries are beginning to harvest our encrypted data
300
00:19:52,440 --> 00:19:53,440
today.
301
00:19:53,440 --> 00:19:57,960
So the documents that we're sending over the public internet that we are encrypting that
302
00:19:57,960 --> 00:20:03,280
we believe are secure, our adversaries are literally taking it off the wire and storing
303
00:20:03,280 --> 00:20:07,960
it because they know in a few short years they're going to be able to open all of those
304
00:20:07,960 --> 00:20:09,800
documents.
305
00:20:09,800 --> 00:20:13,760
And so the big threat there is not only the documents that we're storing today and transferring
306
00:20:13,760 --> 00:20:22,000
over the public internet, but also we've developed our entire ecosystem with keys that we believe
307
00:20:22,000 --> 00:20:24,360
are secure than a few years or not.
308
00:20:24,360 --> 00:20:29,320
The moment that they break or we discover they have the ability to open those documents,
309
00:20:29,320 --> 00:20:33,920
Steve, we're going to have to retrofit all of our software, all of it.
310
00:20:33,920 --> 00:20:37,600
And that is going to be a very, very long process.
311
00:20:37,600 --> 00:20:44,280
And so how do we build new software capabilities today that allow us to move the form of encryption
312
00:20:44,280 --> 00:20:48,240
that we're using to a new form quickly?
313
00:20:48,240 --> 00:20:51,680
And we've got to get our software developers to start building that into the software now
314
00:20:51,680 --> 00:20:58,280
so that when quantum becomes reality, they can push a button and instantly change all
315
00:20:58,280 --> 00:21:03,280
of the software that they've built to enable that new encryption and all of our networks
316
00:21:03,280 --> 00:21:05,640
have to be able to respect it as well.
317
00:21:05,640 --> 00:21:10,520
And so if we don't start making that change now, they're going to break the holy grail
318
00:21:10,520 --> 00:21:14,720
and then we're going to be reactive and we're going to be behind the eight ball trying to
319
00:21:14,720 --> 00:21:17,400
meet that new threat.
320
00:21:17,400 --> 00:21:21,920
That's kind of my biggest sort of like, oh, shit moment.
321
00:21:21,920 --> 00:21:30,280
Yeah, no, it's pretty frightening to hear that they're harvesting encrypted data knowing
322
00:21:30,280 --> 00:21:34,000
that they're going to be able to break that encryption.
323
00:21:34,000 --> 00:21:42,720
So that in and of itself is, like you said, kind of like, wow, that's actually happening.
324
00:21:42,720 --> 00:21:49,520
That's the reality though of developers being able to retrofit in a timely fashion.
325
00:21:49,520 --> 00:21:54,400
It almost senses, I'm going to date myself, but it almost sense like why to K, right?
326
00:21:54,400 --> 00:22:01,400
This whole kind of fear of something breaking that will have a cascading effect that will
327
00:22:01,400 --> 00:22:04,440
break other things downstream.
328
00:22:04,440 --> 00:22:11,960
So our folks, our software providers prepared for this, are they preparing for it or is this
329
00:22:11,960 --> 00:22:14,200
something yet to take room?
330
00:22:14,200 --> 00:22:16,480
No, it's a good question.
331
00:22:16,480 --> 00:22:23,200
Yeah, I mean, so internal at VMware, we have a project that a young guy from Australia,
332
00:22:23,200 --> 00:22:27,360
Hayden, if he listens to the podcast, I called you out.
333
00:22:27,360 --> 00:22:28,560
So he's phenomenal.
334
00:22:28,560 --> 00:22:31,480
He's working on that project now.
335
00:22:31,480 --> 00:22:37,960
And so it's basically for him, he's built like a sidecar kind of encryption key service
336
00:22:37,960 --> 00:22:42,920
that our software can call into and instantly replace so that you don't have to go through
337
00:22:42,920 --> 00:22:43,920
and write all the code.
338
00:22:43,920 --> 00:22:45,720
And it's more than just concept.
339
00:22:45,720 --> 00:22:48,520
He has a working pro and we've been demonstrating it and all that.
340
00:22:48,520 --> 00:22:53,520
It's not really a product we sell, but it's a technique and a methodology that we are
341
00:22:53,520 --> 00:22:57,120
working towards in anticipation of this.
342
00:22:57,120 --> 00:23:03,560
We've been told that out of all of the demonstrations, like when we demonstrate this to the government,
343
00:23:03,560 --> 00:23:07,920
because again, we're not trying to sell it to them, but they're interested in how we're
344
00:23:07,920 --> 00:23:09,440
doing it.
345
00:23:09,440 --> 00:23:14,120
They always tell us that we appear to be much further along in our maturity level of making
346
00:23:14,120 --> 00:23:17,280
it a reality than what they've seen elsewhere.
347
00:23:17,280 --> 00:23:21,280
So this young, I say young kid, he's not a kid, but a young man, he's much younger than
348
00:23:21,280 --> 00:23:24,480
me that's working on this is truly talented.
349
00:23:24,480 --> 00:23:28,640
And when you see him open up a whole bunch of code and hit a button and instantly can
350
00:23:28,640 --> 00:23:33,000
see all of the encryption change out across the software, it's a pretty impressive demonstration.
351
00:23:33,000 --> 00:23:35,040
So yeah, I think people are doing it.
352
00:23:35,040 --> 00:23:39,120
I think that when you have the funding to do it, it's easy.
353
00:23:39,120 --> 00:23:44,360
But when you don't, how does CIOs decide that they're going to allocate funds to this?
354
00:23:44,360 --> 00:23:47,160
Maybe they just wait for companies to come out with products and then they buy the product
355
00:23:47,160 --> 00:23:52,360
and then they tell the software companies to, or their software developers to implement
356
00:23:52,360 --> 00:23:53,360
it.
357
00:23:53,360 --> 00:23:54,360
I don't know.
358
00:23:54,360 --> 00:23:57,000
Right now it's more on the R&D stage than anything else.
359
00:23:57,000 --> 00:23:58,000
Got it.
360
00:23:58,000 --> 00:24:03,200
You know, you touched on nation state actors and I wanted to ask you about your, how you
361
00:24:03,200 --> 00:24:07,560
think the concept of cyber warfare is going to evolve over the next couple of years.
362
00:24:07,560 --> 00:24:13,640
I know that, you know, you've got some experience in offensive and defensive capabilities, but
363
00:24:13,640 --> 00:24:19,280
how do you think that's going to have an impact on international relations, global stability,
364
00:24:19,280 --> 00:24:23,240
kind of moving forward in this idea of cyber warfare?
365
00:24:23,240 --> 00:24:27,040
Do you have any thoughts around that?
366
00:24:27,040 --> 00:24:28,520
It's a whole different podcast.
367
00:24:28,520 --> 00:24:31,240
Do I have thoughts on it?
368
00:24:31,240 --> 00:24:32,240
Yeah, I do.
369
00:24:32,240 --> 00:24:35,320
You know, this is going to be a politically charged, I guess, response.
370
00:24:35,320 --> 00:24:41,040
So to be clear, this is not a political statement in any way, shape, or form.
371
00:24:41,040 --> 00:24:43,600
Anybody that knows me knows I'm right up the middle on politics.
372
00:24:43,600 --> 00:24:49,720
The reality is that we have to treat cyber as we do the Department of Defense.
373
00:24:49,720 --> 00:24:56,120
And every American, regardless of your political position, should be thinking that way.
374
00:24:56,120 --> 00:25:01,560
If you like, you know, knowing that your financial institution is going to be there to give you
375
00:25:01,560 --> 00:25:06,640
funds when you need it, then you need to be more understanding of a more offensive and
376
00:25:06,640 --> 00:25:09,800
aggressive government in the area of cyber.
377
00:25:09,800 --> 00:25:15,000
Because remember, there are adversaries do not have any rules about coming against us.
378
00:25:15,000 --> 00:25:21,440
But we have a huge amount of rules about what we're allowed to do because of our free country.
379
00:25:21,440 --> 00:25:22,440
And that's a good thing.
380
00:25:22,440 --> 00:25:27,040
And I think it keeps government in check, and I am a big supporter of that.
381
00:25:27,040 --> 00:25:33,840
But at the same time, a lot of our citizens, I think, you know, resist any interaction
382
00:25:33,840 --> 00:25:37,920
between commercial industry and government where it comes to national security.
383
00:25:37,920 --> 00:25:45,080
And I think that that is hindering our ability to protect citizens from nation state actors.
384
00:25:45,080 --> 00:25:46,440
And I'll give you a perfect example.
385
00:25:46,440 --> 00:25:51,640
When Edward Snowden walked out with all of those documents, many of the relationships,
386
00:25:51,640 --> 00:25:54,800
you know, that that were made very public.
387
00:25:54,800 --> 00:25:58,440
And you know, there were companies that said, we're not going to do business with the government.
388
00:25:58,440 --> 00:26:01,320
Employees went on protest and, you know, all these things.
389
00:26:01,320 --> 00:26:08,600
It severed a very critical need and relationship between commercial industry and the U.S. government,
390
00:26:08,600 --> 00:26:15,040
where there was collaboration and cooperation to make sure that the government could respond
391
00:26:15,040 --> 00:26:21,120
and protect our critical infrastructure, our financial institutions, all of those things.
392
00:26:21,120 --> 00:26:26,360
And we lost a lot of that because of this, you know, you know, enemy of the state came
393
00:26:26,360 --> 00:26:27,360
out, right?
394
00:26:27,360 --> 00:26:31,560
And we watched the movie of Will Smith and the big evil brother and all that.
395
00:26:31,560 --> 00:26:34,600
And all those things came together at about the same time.
396
00:26:34,600 --> 00:26:38,280
And so we've lost some of that public-private cooperation.
397
00:26:38,280 --> 00:26:40,160
And that is what we've got to get back.
398
00:26:40,160 --> 00:26:44,640
If we, you know, if we don't start having more cooperation between the commercial industry
399
00:26:44,640 --> 00:26:49,880
and government, then government can't be effective, 100% effective at defending.
400
00:26:49,880 --> 00:26:53,200
And the commercial industry is then going to have to take the responsibility of putting
401
00:26:53,200 --> 00:26:59,520
more and more money into protecting the assets as almost like their own independent country,
402
00:26:59,520 --> 00:27:03,360
because they've sort of put their arms up and said, government, you know, go away, we'll
403
00:27:03,360 --> 00:27:04,360
take care of this.
404
00:27:04,360 --> 00:27:08,960
Well, with all due respect, there is no company that can take on nation-state actors.
405
00:27:08,960 --> 00:27:09,960
There isn't.
406
00:27:09,960 --> 00:27:14,920
It's only through the cooperation of commercial companies and the U.S. government that we have
407
00:27:14,920 --> 00:27:20,360
any chance of taking on a nation, the funding of a nation like China, where they don't have
408
00:27:20,360 --> 00:27:23,920
rules to come against the United States, United States best interests.
409
00:27:23,920 --> 00:27:24,920
That's my opinion.
410
00:27:24,920 --> 00:27:25,920
Yeah, no, that's great.
411
00:27:25,920 --> 00:27:33,400
Because you talk about nation-states that don't adhere to the same kind of, dare I say,
412
00:27:33,400 --> 00:27:38,480
moral code that we have here in the United States in terms of privacy, in terms of the
413
00:27:38,480 --> 00:27:40,320
way that we treat our citizens.
414
00:27:40,320 --> 00:27:50,560
And yet we're trying to compete on a battlefield with different kind of moral codes.
415
00:27:50,560 --> 00:27:57,400
And it seems to me that it's pretty obvious that we will restrict ourselves from acting
416
00:27:57,400 --> 00:28:01,760
in certain ways, and yet, you know, our adversaries don't.
417
00:28:01,760 --> 00:28:04,960
And so it's almost like an uneven playing field.
418
00:28:04,960 --> 00:28:05,960
It is.
419
00:28:05,960 --> 00:28:10,400
And you know, I think you and I are saying the same thing, I'm not in any way suggesting
420
00:28:10,400 --> 00:28:12,960
that we lower our moral standards, right?
421
00:28:12,960 --> 00:28:16,440
It's there are ways in which we can collaborate and cooperate.
422
00:28:16,440 --> 00:28:22,240
That I think that are fair, that protect the Constitution and privacy.
423
00:28:22,240 --> 00:28:24,880
There are a lot of things that would never change in the way that we're doing it, because
424
00:28:24,880 --> 00:28:28,840
I don't want the government looking in on my stuff and, you know, all that.
425
00:28:28,840 --> 00:28:33,480
But I think there are ways that we can collaborate and share information even more that we lost
426
00:28:33,480 --> 00:28:38,040
over the last 10 years that is critical for our government to have, you know, to have
427
00:28:38,040 --> 00:28:42,880
the what they need in order to protect our businesses.
428
00:28:42,880 --> 00:28:47,040
And I think that, you know, it's not a huge pendulum swing, but it is we need to get more
429
00:28:47,040 --> 00:28:49,640
back to where we were, I think.
430
00:28:49,640 --> 00:28:54,040
So I want to talk a little bit about insider threat.
431
00:28:54,040 --> 00:28:55,760
You mentioned Snowden.
432
00:28:55,760 --> 00:29:03,960
It was a recent Air National Guardsman who also, you know, shared sensitive data or got
433
00:29:03,960 --> 00:29:07,040
access to sensitive data.
434
00:29:07,040 --> 00:29:13,160
Do you have any insights or thoughts on how mid market companies and sleds specifically
435
00:29:13,160 --> 00:29:18,440
can protect against that insider threat and how to address that?
436
00:29:18,440 --> 00:29:26,560
You know, what seems to be more damaging than from outside?
437
00:29:26,560 --> 00:29:33,560
Yeah, so one of the cases we were on, it was actually the CTO that was leaking information
438
00:29:33,560 --> 00:29:40,360
to the lawyers of a company that there was a lawsuit involved in.
439
00:29:40,360 --> 00:29:46,560
And he was going to go work for that other company, which is why he was leaking information.
440
00:29:46,560 --> 00:29:50,520
You know, when I look at how we, you know, when we were brought in and how we investigated
441
00:29:50,520 --> 00:29:56,880
and all those things, it's a tough one, depending on who the insider is to protect.
442
00:29:56,880 --> 00:30:01,280
And that's why it's really important to have the right tools to look at behavior.
443
00:30:01,280 --> 00:30:08,280
You know, you know, when we think about the old days, and I use this analogy, firewalls
444
00:30:08,280 --> 00:30:14,240
and virus protection and all those things, think of it as like your front door, you open
445
00:30:14,240 --> 00:30:18,920
the front door, and if you had a list of all bad guys that you could look at the person
446
00:30:18,920 --> 00:30:22,320
at the door and look through the book of a bad guys and say, oh yeah, that's a bad guy,
447
00:30:22,320 --> 00:30:23,760
I'm not going to let him in.
448
00:30:23,760 --> 00:30:24,760
Right.
449
00:30:24,760 --> 00:30:28,640
The days of that being the way that people attack is just gone.
450
00:30:28,640 --> 00:30:33,360
The chances of the person walking up to the door that's going to be in your known bad
451
00:30:33,360 --> 00:30:36,680
guy book is not really who you're worried about.
452
00:30:36,680 --> 00:30:42,140
You're worried about, you know, the person that you were hanging out with at church,
453
00:30:42,140 --> 00:30:45,720
that you don't know is a bad guy, that you invite them into your home, or the person
454
00:30:45,720 --> 00:30:48,920
that's coming in through the window, not through the door.
455
00:30:48,920 --> 00:30:52,240
So those are the kinds of attacks that we have to worry about, and that's a behavioral
456
00:30:52,240 --> 00:30:54,240
discussion.
457
00:30:54,240 --> 00:30:57,400
It's not a identity discussion.
458
00:30:57,400 --> 00:31:04,160
And so when we look at the tools that monitor behavior, just look at, you know, this is
459
00:31:04,160 --> 00:31:08,960
about VMware, it's not a sales pitch, but it's just an observation.
460
00:31:08,960 --> 00:31:11,880
Virtual machines are the same as sort of physical machines.
461
00:31:11,880 --> 00:31:17,280
And while we put firewalls in front of physical machines, what a lot of people don't do is
462
00:31:17,280 --> 00:31:21,920
look at the behavior between virtual machines sitting on that same box.
463
00:31:21,920 --> 00:31:26,920
In fact, very, I could count on, you know, both hands, or maybe two sets of hands, the
464
00:31:26,920 --> 00:31:31,040
number of customers that actually monitor the behavior between virtual machines.
465
00:31:31,040 --> 00:31:35,640
They do monitor between physical devices, but not between logical devices.
466
00:31:35,640 --> 00:31:40,960
And since most of our environment is going to a virtual environment, whether it be through
467
00:31:40,960 --> 00:31:47,800
VMware, or through Hyper-V, or through cloud, or software defined, everything is going to
468
00:31:47,800 --> 00:31:49,120
virtual.
469
00:31:49,120 --> 00:31:53,440
And yet our security companies and our security personnel are not designed to look at the
470
00:31:53,440 --> 00:31:58,880
behavior between virtual environments until they transcend to a physical environment.
471
00:31:58,880 --> 00:32:01,640
Once they move to physical, everybody's good with that, right?
472
00:32:01,640 --> 00:32:04,480
Put it on the front of the physical device, we'll monitor behavior, no problem.
473
00:32:04,480 --> 00:32:07,520
It's in between all these layers that nobody's watching.
474
00:32:07,520 --> 00:32:09,440
And that's where you pick up odd behaviors.
475
00:32:09,440 --> 00:32:10,760
Now, I'll give you this example.
476
00:32:10,760 --> 00:32:15,040
We have a massive Postgres database.
477
00:32:15,040 --> 00:32:16,320
We call it Green Plum.
478
00:32:16,320 --> 00:32:22,240
And it's a, the only real massive advantage to it is that we can massively distribute
479
00:32:22,240 --> 00:32:26,440
this Postgres database to attack really complex data problems.
480
00:32:26,440 --> 00:32:31,720
And so when we run cyber data through it, we can run PETAs of cyber data through it.
481
00:32:31,720 --> 00:32:37,160
It will look at every bit of cyber data and it says, hey, we expect this behavior to happen
482
00:32:37,160 --> 00:32:40,760
from this device when it goes to this device through this device.
483
00:32:40,760 --> 00:32:45,440
And when it doesn't, we can match it against our bad guy lookup.
484
00:32:45,440 --> 00:32:47,640
Hey, we've seen this before, this behavior.
485
00:32:47,640 --> 00:32:50,160
We know it's probably this.
486
00:32:50,160 --> 00:32:53,960
And then it can analyze was it that, and we can give it a sureness like it's 80, 90%.
487
00:32:53,960 --> 00:32:54,960
Yep, we were right.
488
00:32:54,960 --> 00:32:56,680
That's what it was.
489
00:32:56,680 --> 00:32:58,320
That's not what's interesting.
490
00:32:58,320 --> 00:32:59,320
Everybody does that.
491
00:32:59,320 --> 00:33:03,000
What's interesting about the algorithms, and it's like, we're just running AI algorithms
492
00:33:03,000 --> 00:33:07,440
against this data set through this Postgres database.
493
00:33:07,440 --> 00:33:10,320
What's interesting is when you get down to the bottom, and this guy named Siva on our
494
00:33:10,320 --> 00:33:13,320
team, he's an engineer, he's an AI ML expert.
495
00:33:13,320 --> 00:33:17,840
He goes through and he shows you at the bottom, there is these really small percentage ones
496
00:33:17,840 --> 00:33:24,200
of, hey, we have no idea what these are, but we know the behavior is not matching any known
497
00:33:24,200 --> 00:33:27,600
behavior of a bad guy we've ever seen.
498
00:33:27,600 --> 00:33:31,960
And so it's varying from that, and so suddenly that becomes the zero day exploits that we're
499
00:33:31,960 --> 00:33:33,440
looking at.
500
00:33:33,440 --> 00:33:38,240
And so it's only through AI, it's not really AI, it's more machine learning against a massive
501
00:33:38,240 --> 00:33:42,360
data set that we're able to get down to these anomalies that he then says, these are the
502
00:33:42,360 --> 00:33:44,200
ones that I'm interested in.
503
00:33:44,200 --> 00:33:47,440
All these up here will go to the sock, they'll have a playbook against it and they'll run
504
00:33:47,440 --> 00:33:48,440
it.
505
00:33:48,440 --> 00:33:52,880
It's these down here that from a VMware perspective on our network, we're going, hey, wait a second.
506
00:33:52,880 --> 00:33:58,160
Why is this not matching the behavior that happens 99% of the time or 80% of the time?
507
00:33:58,160 --> 00:34:03,880
So that's how we've got to sort of, I think, start looking at how we attack this problem.
508
00:34:03,880 --> 00:34:06,800
Yeah, no, that's great stuff.
509
00:34:06,800 --> 00:34:08,280
I appreciate you sharing that.
510
00:34:08,280 --> 00:34:13,120
Hey, I want to kind of shift here as we conclude.
511
00:34:13,120 --> 00:34:19,560
What are some of two to three things that you would recommend that our state, local, educational
512
00:34:19,560 --> 00:34:27,880
listeners, government listeners should do today that you're seeing are the most impactful
513
00:34:27,880 --> 00:34:32,800
when it comes to securing their data, securing their critical infrastructure.
514
00:34:32,800 --> 00:34:39,040
Okay, so I'm going to start with the basics and people, I hate when I get on these podcasts
515
00:34:39,040 --> 00:34:42,040
and people give like the obvious things that we should be doing, but the reality is when
516
00:34:42,040 --> 00:34:48,840
you look at the data breach investigation report, it's just a great piece of research
517
00:34:48,840 --> 00:34:53,360
for multi, I mean, we came from Verizon, so we're biased, I know, but the reality is,
518
00:34:53,360 --> 00:34:58,720
I mean, you know this, Steve, we take, we, sorry, Verizon, Verizon takes data and they
519
00:34:58,720 --> 00:35:00,520
give it to data site, I know, right, you're laughing.
520
00:35:00,520 --> 00:35:03,760
Do you still say we when you talk about Verizon?
521
00:35:03,760 --> 00:35:06,640
I do make that, but we were there a long time, right?
522
00:35:06,640 --> 00:35:10,040
Yeah, it was, and all the executives over there, they're probably thinking, these guys
523
00:35:10,040 --> 00:35:12,280
bleed Verizon.
524
00:35:12,280 --> 00:35:17,680
So the great thing about the way the team did it over there and my hats off to them is
525
00:35:17,680 --> 00:35:22,120
that they take all the data, they pump it to data scientists who are not cyber experts.
526
00:35:22,120 --> 00:35:25,480
So because they're not cyber experts, they only analyze the data for the data's sake
527
00:35:25,480 --> 00:35:29,600
and every year it comes out that there's the same trends, right?
528
00:35:29,600 --> 00:35:34,040
So it doesn't, it shouldn't surprise you that some of my recommendations are going to be
529
00:35:34,040 --> 00:35:38,080
the things that we still continue to not do well.
530
00:35:38,080 --> 00:35:42,240
So obviously things like training our people because there's lots of human mistakes, those
531
00:35:42,240 --> 00:35:46,040
kinds of things, you know, training around email and how to not open attachments and
532
00:35:46,040 --> 00:35:47,040
all that stuff.
533
00:35:47,040 --> 00:35:52,240
It still remains a primary way that, you know, phishing remains a primary way that malware
534
00:35:52,240 --> 00:35:54,200
gets into our environments.
535
00:35:54,200 --> 00:35:58,120
So you know, from a CISO perspective, you can do web isolation, right?
536
00:35:58,120 --> 00:36:03,280
You can apply tools that break that executable code before it gets into your network.
537
00:36:03,280 --> 00:36:06,400
And so there's lots of products out there that do it, Mac, V, Symantec and all that
538
00:36:06,400 --> 00:36:08,560
jazzy stuff.
539
00:36:08,560 --> 00:36:12,200
Enterprise, you know, detection response, EDRs or endpoint detection response.
540
00:36:12,200 --> 00:36:15,000
So EDR is critically important.
541
00:36:15,000 --> 00:36:16,480
To me, it's the table stakes.
542
00:36:16,480 --> 00:36:19,080
If you're not doing EDR, you know what?
543
00:36:19,080 --> 00:36:23,560
You deserve to get hacked because, you know, that to me is you need to be looking at the
544
00:36:23,560 --> 00:36:27,480
behavior on your endpoints to be sure.
545
00:36:27,480 --> 00:36:31,080
I think that those two and then, you know, multi-factor authentication, those are the
546
00:36:31,080 --> 00:36:34,080
three basic things you have to do.
547
00:36:34,080 --> 00:36:39,960
And then I think looking forward, what I would say is most of the environments that we are
548
00:36:39,960 --> 00:36:45,080
putting in today, I talked about edge pushing to the edge, everything is going to be software
549
00:36:45,080 --> 00:36:46,920
defined.
550
00:36:46,920 --> 00:36:50,760
It's not today, but I can guarantee you it will be.
551
00:36:50,760 --> 00:36:58,160
So all networks will be running on a control player with gateways and endpoints that are
552
00:36:58,160 --> 00:37:01,400
communicating through that control.
553
00:37:01,400 --> 00:37:04,160
Everything will be software controlled.
554
00:37:04,160 --> 00:37:09,560
And so as an organization, we need to start looking at how do we enable individuals on
555
00:37:09,560 --> 00:37:12,360
endpoints to have access to the data.
556
00:37:12,360 --> 00:37:17,880
And I'll share with you, Steve, the way kind of we do it a little bit internally at VMware.
557
00:37:17,880 --> 00:37:19,240
I won't give away too many secrets.
558
00:37:19,240 --> 00:37:23,920
But, you know, on our devices, it's all BYOD.
559
00:37:23,920 --> 00:37:26,640
And then we have company issued things as well.
560
00:37:26,640 --> 00:37:31,480
So I've got a company issue computer, but then I have my personal iPad and my personal
561
00:37:31,480 --> 00:37:34,920
cell phone, because I don't want to carry two phones around.
562
00:37:34,920 --> 00:37:39,880
And so we have soft tokens on our devices.
563
00:37:39,880 --> 00:37:45,440
So if I want to access an application, it will require me to authenticate using my RSA
564
00:37:45,440 --> 00:37:49,840
soft, and then I can do that and it will automatically authenticate through an app.
565
00:37:49,840 --> 00:37:56,360
The moment I go from sort of basic access, so if I'm using Outlook or Office or those
566
00:37:56,360 --> 00:38:00,160
kinds of things, there's just the basic RSA token.
567
00:38:00,160 --> 00:38:04,920
The moment I go to an application, like an HR application or things that may have, I
568
00:38:04,920 --> 00:38:07,120
then have to go through an application control layer.
569
00:38:07,120 --> 00:38:12,800
So we actually have a workspace product, a company that we acquired.
570
00:38:12,800 --> 00:38:17,640
And so all of our applications are trusted applications that we only can launch from
571
00:38:17,640 --> 00:38:19,800
this security environment.
572
00:38:19,800 --> 00:38:24,320
And that allows me then access one layer further so I can access certain kinds of data from
573
00:38:24,320 --> 00:38:26,360
my personal devices.
574
00:38:26,360 --> 00:38:28,000
None of that data is stored locally.
575
00:38:28,000 --> 00:38:33,320
It's all kept inside the confines of mothership.
576
00:38:33,320 --> 00:38:39,560
And then lastly is I then on my company-issued device, I can actually get through, and not
577
00:38:39,560 --> 00:38:44,800
only that, but actually through my personal device, I can get through a workspace desktop.
578
00:38:44,800 --> 00:38:51,080
So we have something called Workspace One that allows me to actually visualize entire
579
00:38:51,080 --> 00:38:55,680
environments but through an interface where I'm not actually getting the data.
580
00:38:55,680 --> 00:38:59,760
I'm interfacing with the data that's on a server somewhere in the cloud.
581
00:38:59,760 --> 00:39:05,240
And so based on the kinds of data that I'm accessing, it just automatically makes me,
582
00:39:05,240 --> 00:39:07,040
it requires me to go.
583
00:39:07,040 --> 00:39:08,120
And I don't know I'm doing it.
584
00:39:08,120 --> 00:39:12,160
It literally is, I click on an app and it opens and it looks like I'm in the app, but
585
00:39:12,160 --> 00:39:18,400
behind the scenes, it's doing all this stuff to isolate my device from the data.
586
00:39:18,400 --> 00:39:23,080
So that if I've done something stupid on my personal device, downloaded some software that
587
00:39:23,080 --> 00:39:27,600
I really like, like Angry Birds from China, you know, that it's still not going to have
588
00:39:27,600 --> 00:39:31,400
the ability to get into VMware, you know, critical, critical data.
589
00:39:31,400 --> 00:39:35,040
So I think that's what we're going to have to do.
590
00:39:35,040 --> 00:39:38,360
You know, the government has come out and met with us many times to sort of look at
591
00:39:38,360 --> 00:39:42,960
how we've done our zero trust, because we did zero trust.
592
00:39:42,960 --> 00:39:46,960
We almost had all of it implemented before zero trust was even a thing.
593
00:39:46,960 --> 00:39:50,480
And that's why we made some of the acquisition acquisitions that we made was actually to move
594
00:39:50,480 --> 00:39:54,120
it and so we could use it internally as well.
595
00:39:54,120 --> 00:39:55,120
That's great stuff.
596
00:39:55,120 --> 00:39:57,680
And Craig, thank you for laying that out.
597
00:39:57,680 --> 00:40:04,040
So you mentioned training, tools to break the executables, endpoint protection, multi-factors
598
00:40:04,040 --> 00:40:10,200
and moving to that software defined kind of structure.
599
00:40:10,200 --> 00:40:13,360
And thank you for that, because I think that that's really incredibly valuable.
600
00:40:13,360 --> 00:40:19,000
And I think about this market segment, those are the areas that are most impactful.
601
00:40:19,000 --> 00:40:21,280
So thank you for sharing that.
602
00:40:21,280 --> 00:40:23,000
Thank you for your time.
603
00:40:23,000 --> 00:40:24,120
That's all for this episode.
604
00:40:24,120 --> 00:40:28,760
Make sure you tune in next time to Logically Speaking, Stay Cyber First and Future Ready.
00:00:00,000 --> 00:00:12,360
Welcome to Logically Speaking, where we discuss the latest trends in cybersecurity challenges
2
00:00:12,360 --> 00:00:14,320
with topic experts in their own field.
3
00:00:14,320 --> 00:00:18,600
Today, you're going to learn how to protect your data, how to keep your operation sound,
4
00:00:18,600 --> 00:00:21,160
and your business ready for whatever comes next.
5
00:00:21,160 --> 00:00:23,440
This is Logically Speaking.
6
00:00:23,440 --> 00:00:27,800
Today's guest is Craig Bowman, and I'm very excited about Craig joining us.
7
00:00:27,800 --> 00:00:32,160
Craig is a senior director at VMware's Federal Division, and previously Craig and I worked
8
00:00:32,160 --> 00:00:37,360
together at Verizon, where he was the vice president of advanced services, providing
9
00:00:37,360 --> 00:00:42,240
strategy, engineering support, secure cloud initiatives in the public sector.
10
00:00:42,240 --> 00:00:45,520
Craig speaks internationally about cybersecurity.
11
00:00:45,520 --> 00:00:51,440
He's briefed congressional officers, senators, Olympic committees, and international defense
12
00:00:51,440 --> 00:00:52,440
leaders.
13
00:00:52,440 --> 00:00:54,680
Craig, thank you very much for joining us.
14
00:00:54,680 --> 00:01:00,700
I'm hoping that you could share a little bit more about your history and experience in
15
00:01:00,700 --> 00:01:04,840
cybersecurity, because I know you've got an illustrious career.
16
00:01:04,840 --> 00:01:09,840
So you can start there and share a little bit about your experience.
17
00:01:09,840 --> 00:01:10,840
Sure.
18
00:01:10,840 --> 00:01:13,840
Steve's good to see you again.
19
00:01:13,840 --> 00:01:18,440
So I think people come to the industry differently, obviously.
20
00:01:18,440 --> 00:01:23,000
For me, it was a long time ago, so I'm much older probably than I look.
21
00:01:23,000 --> 00:01:27,800
When I got into the industry, I graduated back in the early 90s.
22
00:01:27,800 --> 00:01:29,560
Cyber was not really a big thing.
23
00:01:29,560 --> 00:01:33,920
The internet, where it didn't come about until 1996, that's when the Telecommunication
24
00:01:33,920 --> 00:01:40,560
Act was signed, and a little project called DARPA becomes the internet.
25
00:01:40,560 --> 00:01:44,040
And yes, Al Gore actually did have something to do with it, believe it or not.
26
00:01:44,040 --> 00:01:48,000
He was a young senator that introduced the bill.
27
00:01:48,000 --> 00:01:54,720
So I was actually talking to, I was actually talking to Vince Cerf, and Vince was the one
28
00:01:54,720 --> 00:02:01,080
who filled me in on the impact that Al Gore actually had by introducing the bill that
29
00:02:01,080 --> 00:02:02,680
made the internet possible.
30
00:02:02,680 --> 00:02:03,680
So I was a little surprised.
31
00:02:03,680 --> 00:02:06,960
I didn't realize that he had as much to do with it as I thought.
32
00:02:06,960 --> 00:02:09,720
Anyway, so I started off with the US government.
33
00:02:09,720 --> 00:02:16,200
So I was asked to join the Department of Defense in a very specific area that at the time it
34
00:02:16,200 --> 00:02:20,440
was all standalone computers and coaxial cables.
35
00:02:20,440 --> 00:02:25,440
Cybersecurity was really about securing printers and photocopiers.
36
00:02:25,440 --> 00:02:27,480
It sounds ridiculous, but that's that.
37
00:02:27,480 --> 00:02:28,480
I mean, that was it.
38
00:02:28,480 --> 00:02:32,600
And from an offensive perspective, it was very much how do you get into the physical
39
00:02:32,600 --> 00:02:33,600
building?
40
00:02:33,600 --> 00:02:36,200
How do you get into the physical building and have access?
41
00:02:36,200 --> 00:02:41,560
And that's, you know, Kevin Mitnick has written a whole book about how in the early days he
42
00:02:41,560 --> 00:02:44,560
used to get in by socially engineering people.
43
00:02:44,560 --> 00:02:45,960
So that was cyber.
44
00:02:45,960 --> 00:02:51,560
And then as many of us young people do as you're moving along in the IT field, you from
45
00:02:51,560 --> 00:02:57,040
networking to software development, and then suddenly cyber becomes a thing as we begin
46
00:02:57,040 --> 00:03:00,720
to realize that adversaries are coming after our computers.
47
00:03:00,720 --> 00:03:04,600
And so then you sort of get into cybersecurity and start learning about cyber as you go along.
48
00:03:04,600 --> 00:03:09,400
But there wasn't this sort of formal training that we have now in colleges that you go take
49
00:03:09,400 --> 00:03:11,800
a course and get a degree in that just didn't exist.
50
00:03:11,800 --> 00:03:18,120
So we all of mine was OJT directly working for folks and figuring it out as I went along.
51
00:03:18,120 --> 00:03:19,800
That's how I got into it.
52
00:03:19,800 --> 00:03:24,120
Yeah, I know you and I have similar kind of paths into cybersecurity.
53
00:03:24,120 --> 00:03:26,240
I kind of stumbled into it.
54
00:03:26,240 --> 00:03:34,160
And back in the same timeframe in the nineties, and I remember when it was MCI at the time,
55
00:03:34,160 --> 00:03:41,560
WorldCom talking about writing TCP of the TCP IP, and that was kind of his contribution.
56
00:03:41,560 --> 00:03:50,400
And I remember we sound like two old guys, but we do, you know, stepping into cybersecurity
57
00:03:50,400 --> 00:03:56,200
just kind of deploying firewalls, Raptor firewalls at the time that eventually Symantec ended
58
00:03:56,200 --> 00:03:57,200
up buying.
59
00:03:57,200 --> 00:04:03,200
Hey, Steve, I had to tell you we are old just to let you know.
60
00:04:03,200 --> 00:04:04,200
We are a bunch of old guys.
61
00:04:04,200 --> 00:04:07,400
You may not think about it, but we are.
62
00:04:07,400 --> 00:04:12,360
But it's so interesting because you then see evolution of an industry, right, and you
63
00:04:12,360 --> 00:04:15,400
look back and you start to see these changes.
64
00:04:15,400 --> 00:04:24,040
So I'm interested to know your opinion, especially in the sled space, how they're handling this
65
00:04:24,040 --> 00:04:27,720
kind of ever changing, ever evolving threat landscape.
66
00:04:27,720 --> 00:04:28,720
Right.
67
00:04:28,720 --> 00:04:33,600
This is an area that our listeners sometimes are challenged with.
68
00:04:33,600 --> 00:04:38,920
So with your experience, how do you see what's your opinion on how that sled market is addressing
69
00:04:38,920 --> 00:04:40,800
the ever changing landscape?
70
00:04:40,800 --> 00:04:43,000
State and local education.
71
00:04:43,000 --> 00:04:44,000
All right.
72
00:04:44,000 --> 00:04:45,920
So that's a really good one, actually.
73
00:04:45,920 --> 00:04:47,760
I didn't know you were going to go sleds.
74
00:04:47,760 --> 00:04:49,720
That's a good one.
75
00:04:49,720 --> 00:04:52,680
So it depends on the state.
76
00:04:52,680 --> 00:04:56,160
I was fortunate enough, as you know, at Verizon to cover all of state and local.
77
00:04:56,160 --> 00:04:58,840
And I am very much a hands on person.
78
00:04:58,840 --> 00:05:02,320
Steve, as you know, so I was traveling a lot, I was on an airplane a lot to all the different
79
00:05:02,320 --> 00:05:03,320
states.
80
00:05:03,320 --> 00:05:05,360
And the state has a very different set of problems.
81
00:05:05,360 --> 00:05:10,480
If you look at Mike Dent in Fairfax County, Virginia, for instance, and he was just on
82
00:05:10,480 --> 00:05:16,640
my podcast recently, you know, his challenge is that this area is becoming the next Silicon
83
00:05:16,640 --> 00:05:17,920
Valley.
84
00:05:17,920 --> 00:05:25,120
And so he has to create a cyber trust around the infrastructure that is at the same level
85
00:05:25,120 --> 00:05:28,280
as what you would expect from big tech companies.
86
00:05:28,280 --> 00:05:35,480
That is a very different challenge than if you go to California and you go to like Eli
87
00:05:35,480 --> 00:05:41,440
Owen, who's running the emergency response team for all of the forest fires and all that
88
00:05:41,440 --> 00:05:42,440
stuff.
89
00:05:42,440 --> 00:05:48,400
So, you know, we don't have the sort of natural disasters in Virginia that Eli has in California.
90
00:05:48,400 --> 00:05:52,080
And so how do you protect those two different environments is very different.
91
00:05:52,080 --> 00:05:56,520
You know, in the case of, you know, in the case of Mike Dent, it's about just sort of
92
00:05:56,520 --> 00:06:02,440
traditional endpoint detection, firewalls, all the things that we as a company do.
93
00:06:02,440 --> 00:06:07,680
But then when you get out into California, you know, it's very much edge devices, low
94
00:06:07,680 --> 00:06:13,640
bandwidth, unpredictable networks that they've got to account for and plan for.
95
00:06:13,640 --> 00:06:17,800
And that's not something that I think the average citizen kind of thinks about, you
96
00:06:17,800 --> 00:06:21,480
know, when you're in California, you know, if communications goes down and gets hacked
97
00:06:21,480 --> 00:06:27,000
during a natural disaster, people actually die or they could be left, you know, stranded
98
00:06:27,000 --> 00:06:29,080
to where they can't survive.
99
00:06:29,080 --> 00:06:32,440
And so they've got to think through all of that very differently than than like Mike Dent
100
00:06:32,440 --> 00:06:33,640
does.
101
00:06:33,640 --> 00:06:37,080
And then you go to university areas.
102
00:06:37,080 --> 00:06:41,080
And when you talk to the universities, you know, they have an interesting challenge in
103
00:06:41,080 --> 00:06:49,040
that their customers or their quote, quote, employees, the students are incredibly transient.
104
00:06:49,040 --> 00:06:52,280
So they come in, it has to be BYOD.
105
00:06:52,280 --> 00:06:56,840
So they've got to account for for in all kinds of devices and configurations.
106
00:06:56,840 --> 00:06:58,440
They've got to protect those things.
107
00:06:58,440 --> 00:07:01,720
And then within four years, you know, every year, a whole new tranche comes in and every
108
00:07:01,720 --> 00:07:06,480
four years, the accounts that they started with are terminated are gone as the students
109
00:07:06,480 --> 00:07:08,000
graduate and move on.
110
00:07:08,000 --> 00:07:10,360
So state and locals got a very different footprint.
111
00:07:10,360 --> 00:07:13,720
And so when I look across it, I would say, am I seeing trends?
112
00:07:13,720 --> 00:07:17,400
Oh, and there's one other which is infrastructure.
113
00:07:17,400 --> 00:07:23,800
So globally, I think when we saw the infrastructure bill introduced, it gave the states an opportunity
114
00:07:23,800 --> 00:07:29,400
to really look at our critical infrastructure.
115
00:07:29,400 --> 00:07:38,160
Our critical infrastructure for years has been has been neglected by the country in general.
116
00:07:38,160 --> 00:07:42,200
We see it in our roads and our bridges and our water treatment facilities and all those
117
00:07:42,200 --> 00:07:44,920
things are power grids.
118
00:07:44,920 --> 00:07:51,360
And I think that from a nation state actor perspective, when we look at the sort of like
119
00:07:51,360 --> 00:07:56,880
the individual small hackers going after university or something, that's annoying to the university.
120
00:07:56,880 --> 00:08:03,200
But the big hits are going to be when, let's say, Russia decides that they want to retaliate
121
00:08:03,200 --> 00:08:06,640
for what's going on in Eastern Europe.
122
00:08:06,640 --> 00:08:10,240
Or you know, there are worse adversary, which is China.
123
00:08:10,240 --> 00:08:14,760
If they decide to come after us, they're going to be coming after us from a core infrastructure
124
00:08:14,760 --> 00:08:15,760
perspective.
125
00:08:15,760 --> 00:08:21,160
They want to take down our financial institutions, our critical infrastructure, our government
126
00:08:21,160 --> 00:08:23,080
and our defense.
127
00:08:23,080 --> 00:08:28,680
If they can destabilize the economy, that will have a bigger impact on the citizen's
128
00:08:28,680 --> 00:08:34,920
willingness to support our US government in any kind of in any kind of tit for tat thing
129
00:08:34,920 --> 00:08:35,920
going on overseas.
130
00:08:35,920 --> 00:08:39,400
So they're going to, they're going to come after us and our infrastructure is woefully
131
00:08:39,400 --> 00:08:40,800
neglected.
132
00:08:40,800 --> 00:08:46,280
So I'm hopeful that the infrastructure bill will be used to shore up some of those weaknesses.
133
00:08:46,280 --> 00:08:50,840
Yeah, you brought up a couple of really interesting points that I wanted to kind of hone in on
134
00:08:50,840 --> 00:08:53,480
universities first.
135
00:08:53,480 --> 00:09:00,920
So you know, the environments in universities oftentimes want to be more collaborative and
136
00:09:00,920 --> 00:09:03,320
less restrictive.
137
00:09:03,320 --> 00:09:08,680
In your opinion, how does that kind of play into this, you know, addressing the cybersecurity
138
00:09:08,680 --> 00:09:09,680
challenge?
139
00:09:09,680 --> 00:09:18,000
How do you recommend that they navigate that versus locking down systems and reducing collaboration,
140
00:09:18,000 --> 00:09:24,920
but universities traditionally want to be more open, be more, you know, sharing of information
141
00:09:24,920 --> 00:09:25,920
and data?
142
00:09:25,920 --> 00:09:29,320
How do you envision that kind of delicate balance?
143
00:09:29,320 --> 00:09:34,280
Yeah, I think the universities are doing a fairly decent job because they've got some
144
00:09:34,280 --> 00:09:39,200
new tools at their disposal, which make it makes it easier.
145
00:09:39,200 --> 00:09:42,000
They move most of their stuff to the cloud.
146
00:09:42,000 --> 00:09:49,040
And by jettisoning a lot of their infrastructure to cloud providers, it allows them to consolidate
147
00:09:49,040 --> 00:09:56,160
some of their initiatives and to, and to focus areas of attack from a cyber perspective.
148
00:09:56,160 --> 00:10:03,720
The challenge there is that the consumption cost is often higher than, than it could be
149
00:10:03,720 --> 00:10:09,440
traditionally if they have a high capacity student base and they were running it on prem.
150
00:10:09,440 --> 00:10:14,440
But the fortunate thing for universities is that they can pass that cost back to the student.
151
00:10:14,440 --> 00:10:16,640
And that's why we see our tuition so high, or part of it, right?
152
00:10:16,640 --> 00:10:19,320
And part of it is that some of that cost being passed back.
153
00:10:19,320 --> 00:10:26,840
And so students are basically paying, or parents of students are paying for their kids to be
154
00:10:26,840 --> 00:10:31,640
able to bring their own device to access things and not to have a bad experience in how they
155
00:10:31,640 --> 00:10:33,520
interact with the universities.
156
00:10:33,520 --> 00:10:38,520
The universities can rely on cloud infrastructure and pass that cost back to the students.
157
00:10:38,520 --> 00:10:45,000
I think that the weaknesses, the weakness areas are going to be when there is a sort of complacency
158
00:10:45,000 --> 00:10:48,600
to believe that because you've moved to the cloud, you are therefore secure, which is
159
00:10:48,600 --> 00:10:49,600
not the case.
160
00:10:49,600 --> 00:10:52,120
It's through application development.
161
00:10:52,120 --> 00:10:57,120
Those weaknesses in the way the apps are being developed and being deployed and being consumed,
162
00:10:57,120 --> 00:10:59,920
that's going to be the weak area for the universities.
163
00:10:59,920 --> 00:11:01,120
If they're not focused on that.
164
00:11:01,120 --> 00:11:05,120
If they think that, hey, we're running in Microsoft and so therefore we're secure, we're
165
00:11:05,120 --> 00:11:06,960
using all the Microsoft apps.
166
00:11:06,960 --> 00:11:10,960
It's the moment that they leave those Microsoft apps and they're interfacing with those apps,
167
00:11:10,960 --> 00:11:16,120
with apps they've developed, that API security and vulnerabilities are going to be introduced
168
00:11:16,120 --> 00:11:17,600
to the entire ecosystem.
169
00:11:17,600 --> 00:11:25,840
A lot of CISOs and CIOs know that, but a lot of application developers don't think it.
170
00:11:25,840 --> 00:11:29,240
I know how it is today because I don't write code.
171
00:11:29,240 --> 00:11:34,160
I don't throw code around like I used to, but when I was developing, I was never measured
172
00:11:34,160 --> 00:11:38,360
on the success of my security posture of my application.
173
00:11:38,360 --> 00:11:45,240
I was measured and rewarded on how quickly I could deliver the features of my software.
174
00:11:45,240 --> 00:11:50,480
Then it would go through some kind of a process that somebody would check for vulnerabilities,
175
00:11:50,480 --> 00:11:54,880
but nobody rewarded me for developing good security.
176
00:11:54,880 --> 00:11:57,680
So application developers, it's not the key thing to think about.
177
00:11:57,680 --> 00:12:03,520
Yeah, no, it's a really good point because when I started as a database programmer and
178
00:12:03,520 --> 00:12:10,680
I worked for a major pharmaceutical, we were doing clinical trials over the internet pretty
179
00:12:10,680 --> 00:12:15,120
much without any encryption.
180
00:12:15,120 --> 00:12:18,640
And now that would be unheard of, but yeah, you're right.
181
00:12:18,640 --> 00:12:24,640
We were more concerned about accessibility, ease of use, the user interface and security
182
00:12:24,640 --> 00:12:27,280
wasn't even an afterthought.
183
00:12:27,280 --> 00:12:34,400
You also mentioned critical infrastructure, how that's often neglected.
184
00:12:34,400 --> 00:12:37,960
So some of our listeners are in that space, right?
185
00:12:37,960 --> 00:12:46,240
Critical infrastructure, utilities, municipalities that are providing those services.
186
00:12:46,240 --> 00:12:50,800
What recommendations would you give just as a baseline?
187
00:12:50,800 --> 00:12:55,880
Is there something that you've seen to help them begin that crawl, walk, run in terms
188
00:12:55,880 --> 00:12:57,680
of cybersecurity?
189
00:12:57,680 --> 00:12:59,160
First of all, look at the infrastructure bill.
190
00:12:59,160 --> 00:13:01,040
I mentioned it before.
191
00:13:01,040 --> 00:13:03,080
We have to get funding.
192
00:13:03,080 --> 00:13:07,560
Right now the biggest challenge that people running water treatment facilities, power
193
00:13:07,560 --> 00:13:14,800
facilities, dams, all of those things, they just lack funding.
194
00:13:14,800 --> 00:13:16,040
It's not like they don't want to do it.
195
00:13:16,040 --> 00:13:17,680
It's just that they don't have the money to do it.
196
00:13:17,680 --> 00:13:25,360
A lot of the systems that these critical infrastructure systems were built on run on really old versions
197
00:13:25,360 --> 00:13:27,800
of windows, for instance.
198
00:13:27,800 --> 00:13:30,560
And they can't run on the new version in some cases.
199
00:13:30,560 --> 00:13:32,000
They simply won't run.
200
00:13:32,000 --> 00:13:35,240
And so they're stuck with, we can't get off.
201
00:13:35,240 --> 00:13:39,240
We're on unsupported versions of operating systems.
202
00:13:39,240 --> 00:13:42,880
And the cost to change that is very high.
203
00:13:42,880 --> 00:13:43,880
And that's not the majority.
204
00:13:43,880 --> 00:13:48,080
A lot of them are using standard software that's from big companies that modernize and
205
00:13:48,080 --> 00:13:49,080
all that jazz and stuff.
206
00:13:49,080 --> 00:13:55,280
But the other thing is that just the people that run the actual facilities are not cyber
207
00:13:55,280 --> 00:13:56,840
security experts.
208
00:13:56,840 --> 00:14:01,080
A lot of times they're required to do IT, but they're not really IT professionals.
209
00:14:01,080 --> 00:14:02,400
It's not a knock on them.
210
00:14:02,400 --> 00:14:06,880
It's just that just like you and I grew up changing printer cartridges, a lot of them
211
00:14:06,880 --> 00:14:08,680
don't have to do it every day.
212
00:14:08,680 --> 00:14:13,520
And so as a result, they do things to make their lives easier that unfortunately introduce
213
00:14:13,520 --> 00:14:16,080
risk into the environment.
214
00:14:16,080 --> 00:14:21,960
I was on a case not too long ago with critical infrastructure where somebody had stood up
215
00:14:21,960 --> 00:14:27,880
a relay so that they could access it from home because a lot of times they're called
216
00:14:27,880 --> 00:14:33,000
in at night to do things with the infrastructure and they just simply found it burdensome
217
00:14:33,000 --> 00:14:35,240
to get in their car and drive to the office and have to log in.
218
00:14:35,240 --> 00:14:39,480
And so they set up a relay and a closet that allowed them to get into the system.
219
00:14:39,480 --> 00:14:46,640
And those kinds of things, there are other ways of doing it now that can be used once
220
00:14:46,640 --> 00:14:48,520
the infrastructure has been modernized.
221
00:14:48,520 --> 00:14:52,560
But that was the only way they could have the ease of use.
222
00:14:52,560 --> 00:14:56,200
And in the moment they did that, it introduced unbelievable vulnerability where somebody remotely
223
00:14:56,200 --> 00:14:59,280
could come in and control our critical infrastructure.
224
00:14:59,280 --> 00:15:04,480
So I guess in the old Verizon days of the data breach investigation report, we would call
225
00:15:04,480 --> 00:15:05,960
that human error.
226
00:15:05,960 --> 00:15:06,960
Right.
227
00:15:06,960 --> 00:15:07,960
Right.
228
00:15:07,960 --> 00:15:08,960
Miscellaneous, I think is where they put it.
229
00:15:08,960 --> 00:15:12,600
You can't fix stupid is what we used to say.
230
00:15:12,600 --> 00:15:15,520
Oh, man.
231
00:15:15,520 --> 00:15:16,520
That's great.
232
00:15:16,520 --> 00:15:17,520
No, you're absolutely right.
233
00:15:17,520 --> 00:15:22,720
Hey, let's shift a little bit and think about looking back on your career.
234
00:15:22,720 --> 00:15:27,720
What's the biggest cybersecurity risk that you've seen?
235
00:15:27,720 --> 00:15:34,240
You just talked about one that seemed rather egregious, but look back on your career.
236
00:15:34,240 --> 00:15:39,920
What's the biggest one that you've had to address or you've seen over your career?
237
00:15:39,920 --> 00:15:41,720
I'm going to flip the question on you.
238
00:15:41,720 --> 00:15:44,320
How about the biggest risk I see today?
239
00:15:44,320 --> 00:15:50,320
As fast as for me is almost like who cares because the new risk is more significant.
240
00:15:50,320 --> 00:15:54,840
I think that question, by the way, Craig, but okay.
241
00:15:54,840 --> 00:15:55,840
All right.
242
00:15:55,840 --> 00:15:57,440
Well, maybe a couple of books.
243
00:15:57,440 --> 00:15:59,760
So I think yeah, we'll do, we'll do sort of past to present.
244
00:15:59,760 --> 00:16:03,960
I think that endpoint detection was always the biggest one.
245
00:16:03,960 --> 00:16:07,680
We, you know, the moment that all of us got these devices, that was the biggest like,
246
00:16:07,680 --> 00:16:11,520
yeah, we just didn't account for it properly.
247
00:16:11,520 --> 00:16:13,920
The mindset of people, so this is the past, right?
248
00:16:13,920 --> 00:16:17,920
The mindset of people that by downloading McPhee or Symantec, that that was somehow
249
00:16:17,920 --> 00:16:20,360
going to protect everything.
250
00:16:20,360 --> 00:16:21,360
Great companies, by the way.
251
00:16:21,360 --> 00:16:27,280
I mean, both of them are fantastic, you know, fantastic companies, but the reality is that,
252
00:16:27,280 --> 00:16:31,480
you know, they, all those companies were scrambling to kind of fill the gaps of the device.
253
00:16:31,480 --> 00:16:37,000
The devices came out long before we could adapt to the new threats that were going to
254
00:16:37,000 --> 00:16:38,000
be coming after them.
255
00:16:38,000 --> 00:16:41,240
That was the biggest risk I saw, endpoint detection.
256
00:16:41,240 --> 00:16:45,200
And with that comes the combined two-factor authentication, right?
257
00:16:45,200 --> 00:16:50,320
We did not adapt to factor authentication or multi-factor authentication quickly enough,
258
00:16:50,320 --> 00:16:52,200
let alone two factor.
259
00:16:52,200 --> 00:16:55,440
So many people, you know, multi-factor is not even a question.
260
00:16:55,440 --> 00:16:59,680
So anyway, that's what I saw what that was the biggest risk is how do we adapt quickly
261
00:16:59,680 --> 00:17:03,200
to an expanding footprint.
262
00:17:03,200 --> 00:17:11,080
I think as I look forward, the biggest challenges and worries that keep me up at night and I
263
00:17:11,080 --> 00:17:16,040
still work with the U.S. government is in two areas.
264
00:17:16,040 --> 00:17:23,760
One is that we must, by function of how we have to operate to make our government safe
265
00:17:23,760 --> 00:17:29,680
and to do more work, we're going to be pushing data further and further out to the edge.
266
00:17:29,680 --> 00:17:34,840
So we see words like sassy and edge computing and things like that.
267
00:17:34,840 --> 00:17:41,560
What that means is that, you know, the old methodology of our castle and moat firewalls
268
00:17:41,560 --> 00:17:49,360
protection, endpoint detection and those kinds of things are simply going away as we begin
269
00:17:49,360 --> 00:17:56,040
to move our trusted assets out of that castle wall and store them all over the place.
270
00:17:56,040 --> 00:18:01,480
That is going to be a huge threat to us because most of the scorecards and the evaluations
271
00:18:01,480 --> 00:18:07,120
that we've been doing have been under the understanding that we can create this cocoon
272
00:18:07,120 --> 00:18:11,480
and put all of our protected stuff in there and create ways of monitoring behavior within
273
00:18:11,480 --> 00:18:13,240
that environment.
274
00:18:13,240 --> 00:18:16,320
And then suddenly we start putting things in the cloud and then we go, okay, now we can
275
00:18:16,320 --> 00:18:20,880
do a CASB and now we can do, you know, let's just do the same thing there with a CASB in
276
00:18:20,880 --> 00:18:22,840
between and okay, we got that.
277
00:18:22,840 --> 00:18:25,040
But that's not the future of IT.
278
00:18:25,040 --> 00:18:29,800
The future of IT is literally the data is moving closest to who's consuming it almost
279
00:18:29,800 --> 00:18:30,800
on demand.
280
00:18:30,800 --> 00:18:35,960
That is a very heterogeneous and amorphous sort of environment.
281
00:18:35,960 --> 00:18:41,120
And so that is going to be something that most IT and security professionals simply
282
00:18:41,120 --> 00:18:42,120
are not prepared for.
283
00:18:42,120 --> 00:18:43,200
They're not trained for.
284
00:18:43,200 --> 00:18:47,480
They're old guys like us that, you know, we've got to go back to school.
285
00:18:47,480 --> 00:18:50,480
Young people will get it because they'll be coming out of school and that's what they'll
286
00:18:50,480 --> 00:18:53,020
be learning, but they have no experience.
287
00:18:53,020 --> 00:18:57,440
So they'll lack the historical knowledge with all this great new knowledge.
288
00:18:57,440 --> 00:19:00,320
And so somehow we've got to kind of merge those together.
289
00:19:00,320 --> 00:19:03,920
And our adversaries are going to take advantage of it for sure.
290
00:19:03,920 --> 00:19:10,920
The number two, I think, and this is going to be critical is computing.
291
00:19:10,920 --> 00:19:15,480
And I think that when people hear about quantum computing security risk, they don't quite
292
00:19:15,480 --> 00:19:18,040
understand what the problem is.
293
00:19:18,040 --> 00:19:26,240
AES-256 encryption is not something that can be easily broken even with quantum computers.
294
00:19:26,240 --> 00:19:28,640
So people say quantum is going to break encryption.
295
00:19:28,640 --> 00:19:35,040
It's not really going to break AES-256 in any meaningful way within my lifetime.
296
00:19:35,040 --> 00:19:41,440
What it is going to do in a few years is going to be able to break the keys that we use to
297
00:19:41,440 --> 00:19:44,920
open AES-256.
298
00:19:44,920 --> 00:19:46,120
Now why does that matter?
299
00:19:46,120 --> 00:19:52,440
Well, it matters because we know that our adversaries are beginning to harvest our encrypted data
300
00:19:52,440 --> 00:19:53,440
today.
301
00:19:53,440 --> 00:19:57,960
So the documents that we're sending over the public internet that we are encrypting that
302
00:19:57,960 --> 00:20:03,280
we believe are secure, our adversaries are literally taking it off the wire and storing
303
00:20:03,280 --> 00:20:07,960
it because they know in a few short years they're going to be able to open all of those
304
00:20:07,960 --> 00:20:09,800
documents.
305
00:20:09,800 --> 00:20:13,760
And so the big threat there is not only the documents that we're storing today and transferring
306
00:20:13,760 --> 00:20:22,000
over the public internet, but also we've developed our entire ecosystem with keys that we believe
307
00:20:22,000 --> 00:20:24,360
are secure than a few years or not.
308
00:20:24,360 --> 00:20:29,320
The moment that they break or we discover they have the ability to open those documents,
309
00:20:29,320 --> 00:20:33,920
Steve, we're going to have to retrofit all of our software, all of it.
310
00:20:33,920 --> 00:20:37,600
And that is going to be a very, very long process.
311
00:20:37,600 --> 00:20:44,280
And so how do we build new software capabilities today that allow us to move the form of encryption
312
00:20:44,280 --> 00:20:48,240
that we're using to a new form quickly?
313
00:20:48,240 --> 00:20:51,680
And we've got to get our software developers to start building that into the software now
314
00:20:51,680 --> 00:20:58,280
so that when quantum becomes reality, they can push a button and instantly change all
315
00:20:58,280 --> 00:21:03,280
of the software that they've built to enable that new encryption and all of our networks
316
00:21:03,280 --> 00:21:05,640
have to be able to respect it as well.
317
00:21:05,640 --> 00:21:10,520
And so if we don't start making that change now, they're going to break the holy grail
318
00:21:10,520 --> 00:21:14,720
and then we're going to be reactive and we're going to be behind the eight ball trying to
319
00:21:14,720 --> 00:21:17,400
meet that new threat.
320
00:21:17,400 --> 00:21:21,920
That's kind of my biggest sort of like, oh, shit moment.
321
00:21:21,920 --> 00:21:30,280
Yeah, no, it's pretty frightening to hear that they're harvesting encrypted data knowing
322
00:21:30,280 --> 00:21:34,000
that they're going to be able to break that encryption.
323
00:21:34,000 --> 00:21:42,720
So that in and of itself is, like you said, kind of like, wow, that's actually happening.
324
00:21:42,720 --> 00:21:49,520
That's the reality though of developers being able to retrofit in a timely fashion.
325
00:21:49,520 --> 00:21:54,400
It almost senses, I'm going to date myself, but it almost sense like why to K, right?
326
00:21:54,400 --> 00:22:01,400
This whole kind of fear of something breaking that will have a cascading effect that will
327
00:22:01,400 --> 00:22:04,440
break other things downstream.
328
00:22:04,440 --> 00:22:11,960
So our folks, our software providers prepared for this, are they preparing for it or is this
329
00:22:11,960 --> 00:22:14,200
something yet to take room?
330
00:22:14,200 --> 00:22:16,480
No, it's a good question.
331
00:22:16,480 --> 00:22:23,200
Yeah, I mean, so internal at VMware, we have a project that a young guy from Australia,
332
00:22:23,200 --> 00:22:27,360
Hayden, if he listens to the podcast, I called you out.
333
00:22:27,360 --> 00:22:28,560
So he's phenomenal.
334
00:22:28,560 --> 00:22:31,480
He's working on that project now.
335
00:22:31,480 --> 00:22:37,960
And so it's basically for him, he's built like a sidecar kind of encryption key service
336
00:22:37,960 --> 00:22:42,920
that our software can call into and instantly replace so that you don't have to go through
337
00:22:42,920 --> 00:22:43,920
and write all the code.
338
00:22:43,920 --> 00:22:45,720
And it's more than just concept.
339
00:22:45,720 --> 00:22:48,520
He has a working pro and we've been demonstrating it and all that.
340
00:22:48,520 --> 00:22:53,520
It's not really a product we sell, but it's a technique and a methodology that we are
341
00:22:53,520 --> 00:22:57,120
working towards in anticipation of this.
342
00:22:57,120 --> 00:23:03,560
We've been told that out of all of the demonstrations, like when we demonstrate this to the government,
343
00:23:03,560 --> 00:23:07,920
because again, we're not trying to sell it to them, but they're interested in how we're
344
00:23:07,920 --> 00:23:09,440
doing it.
345
00:23:09,440 --> 00:23:14,120
They always tell us that we appear to be much further along in our maturity level of making
346
00:23:14,120 --> 00:23:17,280
it a reality than what they've seen elsewhere.
347
00:23:17,280 --> 00:23:21,280
So this young, I say young kid, he's not a kid, but a young man, he's much younger than
348
00:23:21,280 --> 00:23:24,480
me that's working on this is truly talented.
349
00:23:24,480 --> 00:23:28,640
And when you see him open up a whole bunch of code and hit a button and instantly can
350
00:23:28,640 --> 00:23:33,000
see all of the encryption change out across the software, it's a pretty impressive demonstration.
351
00:23:33,000 --> 00:23:35,040
So yeah, I think people are doing it.
352
00:23:35,040 --> 00:23:39,120
I think that when you have the funding to do it, it's easy.
353
00:23:39,120 --> 00:23:44,360
But when you don't, how does CIOs decide that they're going to allocate funds to this?
354
00:23:44,360 --> 00:23:47,160
Maybe they just wait for companies to come out with products and then they buy the product
355
00:23:47,160 --> 00:23:52,360
and then they tell the software companies to, or their software developers to implement
356
00:23:52,360 --> 00:23:53,360
it.
357
00:23:53,360 --> 00:23:54,360
I don't know.
358
00:23:54,360 --> 00:23:57,000
Right now it's more on the R&D stage than anything else.
359
00:23:57,000 --> 00:23:58,000
Got it.
360
00:23:58,000 --> 00:24:03,200
You know, you touched on nation state actors and I wanted to ask you about your, how you
361
00:24:03,200 --> 00:24:07,560
think the concept of cyber warfare is going to evolve over the next couple of years.
362
00:24:07,560 --> 00:24:13,640
I know that, you know, you've got some experience in offensive and defensive capabilities, but
363
00:24:13,640 --> 00:24:19,280
how do you think that's going to have an impact on international relations, global stability,
364
00:24:19,280 --> 00:24:23,240
kind of moving forward in this idea of cyber warfare?
365
00:24:23,240 --> 00:24:27,040
Do you have any thoughts around that?
366
00:24:27,040 --> 00:24:28,520
It's a whole different podcast.
367
00:24:28,520 --> 00:24:31,240
Do I have thoughts on it?
368
00:24:31,240 --> 00:24:32,240
Yeah, I do.
369
00:24:32,240 --> 00:24:35,320
You know, this is going to be a politically charged, I guess, response.
370
00:24:35,320 --> 00:24:41,040
So to be clear, this is not a political statement in any way, shape, or form.
371
00:24:41,040 --> 00:24:43,600
Anybody that knows me knows I'm right up the middle on politics.
372
00:24:43,600 --> 00:24:49,720
The reality is that we have to treat cyber as we do the Department of Defense.
373
00:24:49,720 --> 00:24:56,120
And every American, regardless of your political position, should be thinking that way.
374
00:24:56,120 --> 00:25:01,560
If you like, you know, knowing that your financial institution is going to be there to give you
375
00:25:01,560 --> 00:25:06,640
funds when you need it, then you need to be more understanding of a more offensive and
376
00:25:06,640 --> 00:25:09,800
aggressive government in the area of cyber.
377
00:25:09,800 --> 00:25:15,000
Because remember, there are adversaries do not have any rules about coming against us.
378
00:25:15,000 --> 00:25:21,440
But we have a huge amount of rules about what we're allowed to do because of our free country.
379
00:25:21,440 --> 00:25:22,440
And that's a good thing.
380
00:25:22,440 --> 00:25:27,040
And I think it keeps government in check, and I am a big supporter of that.
381
00:25:27,040 --> 00:25:33,840
But at the same time, a lot of our citizens, I think, you know, resist any interaction
382
00:25:33,840 --> 00:25:37,920
between commercial industry and government where it comes to national security.
383
00:25:37,920 --> 00:25:45,080
And I think that that is hindering our ability to protect citizens from nation state actors.
384
00:25:45,080 --> 00:25:46,440
And I'll give you a perfect example.
385
00:25:46,440 --> 00:25:51,640
When Edward Snowden walked out with all of those documents, many of the relationships,
386
00:25:51,640 --> 00:25:54,800
you know, that that were made very public.
387
00:25:54,800 --> 00:25:58,440
And you know, there were companies that said, we're not going to do business with the government.
388
00:25:58,440 --> 00:26:01,320
Employees went on protest and, you know, all these things.
389
00:26:01,320 --> 00:26:08,600
It severed a very critical need and relationship between commercial industry and the U.S. government,
390
00:26:08,600 --> 00:26:15,040
where there was collaboration and cooperation to make sure that the government could respond
391
00:26:15,040 --> 00:26:21,120
and protect our critical infrastructure, our financial institutions, all of those things.
392
00:26:21,120 --> 00:26:26,360
And we lost a lot of that because of this, you know, you know, enemy of the state came
393
00:26:26,360 --> 00:26:27,360
out, right?
394
00:26:27,360 --> 00:26:31,560
And we watched the movie of Will Smith and the big evil brother and all that.
395
00:26:31,560 --> 00:26:34,600
And all those things came together at about the same time.
396
00:26:34,600 --> 00:26:38,280
And so we've lost some of that public-private cooperation.
397
00:26:38,280 --> 00:26:40,160
And that is what we've got to get back.
398
00:26:40,160 --> 00:26:44,640
If we, you know, if we don't start having more cooperation between the commercial industry
399
00:26:44,640 --> 00:26:49,880
and government, then government can't be effective, 100% effective at defending.
400
00:26:49,880 --> 00:26:53,200
And the commercial industry is then going to have to take the responsibility of putting
401
00:26:53,200 --> 00:26:59,520
more and more money into protecting the assets as almost like their own independent country,
402
00:26:59,520 --> 00:27:03,360
because they've sort of put their arms up and said, government, you know, go away, we'll
403
00:27:03,360 --> 00:27:04,360
take care of this.
404
00:27:04,360 --> 00:27:08,960
Well, with all due respect, there is no company that can take on nation-state actors.
405
00:27:08,960 --> 00:27:09,960
There isn't.
406
00:27:09,960 --> 00:27:14,920
It's only through the cooperation of commercial companies and the U.S. government that we have
407
00:27:14,920 --> 00:27:20,360
any chance of taking on a nation, the funding of a nation like China, where they don't have
408
00:27:20,360 --> 00:27:23,920
rules to come against the United States, United States best interests.
409
00:27:23,920 --> 00:27:24,920
That's my opinion.
410
00:27:24,920 --> 00:27:25,920
Yeah, no, that's great.
411
00:27:25,920 --> 00:27:33,400
Because you talk about nation-states that don't adhere to the same kind of, dare I say,
412
00:27:33,400 --> 00:27:38,480
moral code that we have here in the United States in terms of privacy, in terms of the
413
00:27:38,480 --> 00:27:40,320
way that we treat our citizens.
414
00:27:40,320 --> 00:27:50,560
And yet we're trying to compete on a battlefield with different kind of moral codes.
415
00:27:50,560 --> 00:27:57,400
And it seems to me that it's pretty obvious that we will restrict ourselves from acting
416
00:27:57,400 --> 00:28:01,760
in certain ways, and yet, you know, our adversaries don't.
417
00:28:01,760 --> 00:28:04,960
And so it's almost like an uneven playing field.
418
00:28:04,960 --> 00:28:05,960
It is.
419
00:28:05,960 --> 00:28:10,400
And you know, I think you and I are saying the same thing, I'm not in any way suggesting
420
00:28:10,400 --> 00:28:12,960
that we lower our moral standards, right?
421
00:28:12,960 --> 00:28:16,440
It's there are ways in which we can collaborate and cooperate.
422
00:28:16,440 --> 00:28:22,240
That I think that are fair, that protect the Constitution and privacy.
423
00:28:22,240 --> 00:28:24,880
There are a lot of things that would never change in the way that we're doing it, because
424
00:28:24,880 --> 00:28:28,840
I don't want the government looking in on my stuff and, you know, all that.
425
00:28:28,840 --> 00:28:33,480
But I think there are ways that we can collaborate and share information even more that we lost
426
00:28:33,480 --> 00:28:38,040
over the last 10 years that is critical for our government to have, you know, to have
427
00:28:38,040 --> 00:28:42,880
the what they need in order to protect our businesses.
428
00:28:42,880 --> 00:28:47,040
And I think that, you know, it's not a huge pendulum swing, but it is we need to get more
429
00:28:47,040 --> 00:28:49,640
back to where we were, I think.
430
00:28:49,640 --> 00:28:54,040
So I want to talk a little bit about insider threat.
431
00:28:54,040 --> 00:28:55,760
You mentioned Snowden.
432
00:28:55,760 --> 00:29:03,960
It was a recent Air National Guardsman who also, you know, shared sensitive data or got
433
00:29:03,960 --> 00:29:07,040
access to sensitive data.
434
00:29:07,040 --> 00:29:13,160
Do you have any insights or thoughts on how mid market companies and sleds specifically
435
00:29:13,160 --> 00:29:18,440
can protect against that insider threat and how to address that?
436
00:29:18,440 --> 00:29:26,560
You know, what seems to be more damaging than from outside?
437
00:29:26,560 --> 00:29:33,560
Yeah, so one of the cases we were on, it was actually the CTO that was leaking information
438
00:29:33,560 --> 00:29:40,360
to the lawyers of a company that there was a lawsuit involved in.
439
00:29:40,360 --> 00:29:46,560
And he was going to go work for that other company, which is why he was leaking information.
440
00:29:46,560 --> 00:29:50,520
You know, when I look at how we, you know, when we were brought in and how we investigated
441
00:29:50,520 --> 00:29:56,880
and all those things, it's a tough one, depending on who the insider is to protect.
442
00:29:56,880 --> 00:30:01,280
And that's why it's really important to have the right tools to look at behavior.
443
00:30:01,280 --> 00:30:08,280
You know, you know, when we think about the old days, and I use this analogy, firewalls
444
00:30:08,280 --> 00:30:14,240
and virus protection and all those things, think of it as like your front door, you open
445
00:30:14,240 --> 00:30:18,920
the front door, and if you had a list of all bad guys that you could look at the person
446
00:30:18,920 --> 00:30:22,320
at the door and look through the book of a bad guys and say, oh yeah, that's a bad guy,
447
00:30:22,320 --> 00:30:23,760
I'm not going to let him in.
448
00:30:23,760 --> 00:30:24,760
Right.
449
00:30:24,760 --> 00:30:28,640
The days of that being the way that people attack is just gone.
450
00:30:28,640 --> 00:30:33,360
The chances of the person walking up to the door that's going to be in your known bad
451
00:30:33,360 --> 00:30:36,680
guy book is not really who you're worried about.
452
00:30:36,680 --> 00:30:42,140
You're worried about, you know, the person that you were hanging out with at church,
453
00:30:42,140 --> 00:30:45,720
that you don't know is a bad guy, that you invite them into your home, or the person
454
00:30:45,720 --> 00:30:48,920
that's coming in through the window, not through the door.
455
00:30:48,920 --> 00:30:52,240
So those are the kinds of attacks that we have to worry about, and that's a behavioral
456
00:30:52,240 --> 00:30:54,240
discussion.
457
00:30:54,240 --> 00:30:57,400
It's not a identity discussion.
458
00:30:57,400 --> 00:31:04,160
And so when we look at the tools that monitor behavior, just look at, you know, this is
459
00:31:04,160 --> 00:31:08,960
about VMware, it's not a sales pitch, but it's just an observation.
460
00:31:08,960 --> 00:31:11,880
Virtual machines are the same as sort of physical machines.
461
00:31:11,880 --> 00:31:17,280
And while we put firewalls in front of physical machines, what a lot of people don't do is
462
00:31:17,280 --> 00:31:21,920
look at the behavior between virtual machines sitting on that same box.
463
00:31:21,920 --> 00:31:26,920
In fact, very, I could count on, you know, both hands, or maybe two sets of hands, the
464
00:31:26,920 --> 00:31:31,040
number of customers that actually monitor the behavior between virtual machines.
465
00:31:31,040 --> 00:31:35,640
They do monitor between physical devices, but not between logical devices.
466
00:31:35,640 --> 00:31:40,960
And since most of our environment is going to a virtual environment, whether it be through
467
00:31:40,960 --> 00:31:47,800
VMware, or through Hyper-V, or through cloud, or software defined, everything is going to
468
00:31:47,800 --> 00:31:49,120
virtual.
469
00:31:49,120 --> 00:31:53,440
And yet our security companies and our security personnel are not designed to look at the
470
00:31:53,440 --> 00:31:58,880
behavior between virtual environments until they transcend to a physical environment.
471
00:31:58,880 --> 00:32:01,640
Once they move to physical, everybody's good with that, right?
472
00:32:01,640 --> 00:32:04,480
Put it on the front of the physical device, we'll monitor behavior, no problem.
473
00:32:04,480 --> 00:32:07,520
It's in between all these layers that nobody's watching.
474
00:32:07,520 --> 00:32:09,440
And that's where you pick up odd behaviors.
475
00:32:09,440 --> 00:32:10,760
Now, I'll give you this example.
476
00:32:10,760 --> 00:32:15,040
We have a massive Postgres database.
477
00:32:15,040 --> 00:32:16,320
We call it Green Plum.
478
00:32:16,320 --> 00:32:22,240
And it's a, the only real massive advantage to it is that we can massively distribute
479
00:32:22,240 --> 00:32:26,440
this Postgres database to attack really complex data problems.
480
00:32:26,440 --> 00:32:31,720
And so when we run cyber data through it, we can run PETAs of cyber data through it.
481
00:32:31,720 --> 00:32:37,160
It will look at every bit of cyber data and it says, hey, we expect this behavior to happen
482
00:32:37,160 --> 00:32:40,760
from this device when it goes to this device through this device.
483
00:32:40,760 --> 00:32:45,440
And when it doesn't, we can match it against our bad guy lookup.
484
00:32:45,440 --> 00:32:47,640
Hey, we've seen this before, this behavior.
485
00:32:47,640 --> 00:32:50,160
We know it's probably this.
486
00:32:50,160 --> 00:32:53,960
And then it can analyze was it that, and we can give it a sureness like it's 80, 90%.
487
00:32:53,960 --> 00:32:54,960
Yep, we were right.
488
00:32:54,960 --> 00:32:56,680
That's what it was.
489
00:32:56,680 --> 00:32:58,320
That's not what's interesting.
490
00:32:58,320 --> 00:32:59,320
Everybody does that.
491
00:32:59,320 --> 00:33:03,000
What's interesting about the algorithms, and it's like, we're just running AI algorithms
492
00:33:03,000 --> 00:33:07,440
against this data set through this Postgres database.
493
00:33:07,440 --> 00:33:10,320
What's interesting is when you get down to the bottom, and this guy named Siva on our
494
00:33:10,320 --> 00:33:13,320
team, he's an engineer, he's an AI ML expert.
495
00:33:13,320 --> 00:33:17,840
He goes through and he shows you at the bottom, there is these really small percentage ones
496
00:33:17,840 --> 00:33:24,200
of, hey, we have no idea what these are, but we know the behavior is not matching any known
497
00:33:24,200 --> 00:33:27,600
behavior of a bad guy we've ever seen.
498
00:33:27,600 --> 00:33:31,960
And so it's varying from that, and so suddenly that becomes the zero day exploits that we're
499
00:33:31,960 --> 00:33:33,440
looking at.
500
00:33:33,440 --> 00:33:38,240
And so it's only through AI, it's not really AI, it's more machine learning against a massive
501
00:33:38,240 --> 00:33:42,360
data set that we're able to get down to these anomalies that he then says, these are the
502
00:33:42,360 --> 00:33:44,200
ones that I'm interested in.
503
00:33:44,200 --> 00:33:47,440
All these up here will go to the sock, they'll have a playbook against it and they'll run
504
00:33:47,440 --> 00:33:48,440
it.
505
00:33:48,440 --> 00:33:52,880
It's these down here that from a VMware perspective on our network, we're going, hey, wait a second.
506
00:33:52,880 --> 00:33:58,160
Why is this not matching the behavior that happens 99% of the time or 80% of the time?
507
00:33:58,160 --> 00:34:03,880
So that's how we've got to sort of, I think, start looking at how we attack this problem.
508
00:34:03,880 --> 00:34:06,800
Yeah, no, that's great stuff.
509
00:34:06,800 --> 00:34:08,280
I appreciate you sharing that.
510
00:34:08,280 --> 00:34:13,120
Hey, I want to kind of shift here as we conclude.
511
00:34:13,120 --> 00:34:19,560
What are some of two to three things that you would recommend that our state, local, educational
512
00:34:19,560 --> 00:34:27,880
listeners, government listeners should do today that you're seeing are the most impactful
513
00:34:27,880 --> 00:34:32,800
when it comes to securing their data, securing their critical infrastructure.
514
00:34:32,800 --> 00:34:39,040
Okay, so I'm going to start with the basics and people, I hate when I get on these podcasts
515
00:34:39,040 --> 00:34:42,040
and people give like the obvious things that we should be doing, but the reality is when
516
00:34:42,040 --> 00:34:48,840
you look at the data breach investigation report, it's just a great piece of research
517
00:34:48,840 --> 00:34:53,360
for multi, I mean, we came from Verizon, so we're biased, I know, but the reality is,
518
00:34:53,360 --> 00:34:58,720
I mean, you know this, Steve, we take, we, sorry, Verizon, Verizon takes data and they
519
00:34:58,720 --> 00:35:00,520
give it to data site, I know, right, you're laughing.
520
00:35:00,520 --> 00:35:03,760
Do you still say we when you talk about Verizon?
521
00:35:03,760 --> 00:35:06,640
I do make that, but we were there a long time, right?
522
00:35:06,640 --> 00:35:10,040
Yeah, it was, and all the executives over there, they're probably thinking, these guys
523
00:35:10,040 --> 00:35:12,280
bleed Verizon.
524
00:35:12,280 --> 00:35:17,680
So the great thing about the way the team did it over there and my hats off to them is
525
00:35:17,680 --> 00:35:22,120
that they take all the data, they pump it to data scientists who are not cyber experts.
526
00:35:22,120 --> 00:35:25,480
So because they're not cyber experts, they only analyze the data for the data's sake
527
00:35:25,480 --> 00:35:29,600
and every year it comes out that there's the same trends, right?
528
00:35:29,600 --> 00:35:34,040
So it doesn't, it shouldn't surprise you that some of my recommendations are going to be
529
00:35:34,040 --> 00:35:38,080
the things that we still continue to not do well.
530
00:35:38,080 --> 00:35:42,240
So obviously things like training our people because there's lots of human mistakes, those
531
00:35:42,240 --> 00:35:46,040
kinds of things, you know, training around email and how to not open attachments and
532
00:35:46,040 --> 00:35:47,040
all that stuff.
533
00:35:47,040 --> 00:35:52,240
It still remains a primary way that, you know, phishing remains a primary way that malware
534
00:35:52,240 --> 00:35:54,200
gets into our environments.
535
00:35:54,200 --> 00:35:58,120
So you know, from a CISO perspective, you can do web isolation, right?
536
00:35:58,120 --> 00:36:03,280
You can apply tools that break that executable code before it gets into your network.
537
00:36:03,280 --> 00:36:06,400
And so there's lots of products out there that do it, Mac, V, Symantec and all that
538
00:36:06,400 --> 00:36:08,560
jazzy stuff.
539
00:36:08,560 --> 00:36:12,200
Enterprise, you know, detection response, EDRs or endpoint detection response.
540
00:36:12,200 --> 00:36:15,000
So EDR is critically important.
541
00:36:15,000 --> 00:36:16,480
To me, it's the table stakes.
542
00:36:16,480 --> 00:36:19,080
If you're not doing EDR, you know what?
543
00:36:19,080 --> 00:36:23,560
You deserve to get hacked because, you know, that to me is you need to be looking at the
544
00:36:23,560 --> 00:36:27,480
behavior on your endpoints to be sure.
545
00:36:27,480 --> 00:36:31,080
I think that those two and then, you know, multi-factor authentication, those are the
546
00:36:31,080 --> 00:36:34,080
three basic things you have to do.
547
00:36:34,080 --> 00:36:39,960
And then I think looking forward, what I would say is most of the environments that we are
548
00:36:39,960 --> 00:36:45,080
putting in today, I talked about edge pushing to the edge, everything is going to be software
549
00:36:45,080 --> 00:36:46,920
defined.
550
00:36:46,920 --> 00:36:50,760
It's not today, but I can guarantee you it will be.
551
00:36:50,760 --> 00:36:58,160
So all networks will be running on a control player with gateways and endpoints that are
552
00:36:58,160 --> 00:37:01,400
communicating through that control.
553
00:37:01,400 --> 00:37:04,160
Everything will be software controlled.
554
00:37:04,160 --> 00:37:09,560
And so as an organization, we need to start looking at how do we enable individuals on
555
00:37:09,560 --> 00:37:12,360
endpoints to have access to the data.
556
00:37:12,360 --> 00:37:17,880
And I'll share with you, Steve, the way kind of we do it a little bit internally at VMware.
557
00:37:17,880 --> 00:37:19,240
I won't give away too many secrets.
558
00:37:19,240 --> 00:37:23,920
But, you know, on our devices, it's all BYOD.
559
00:37:23,920 --> 00:37:26,640
And then we have company issued things as well.
560
00:37:26,640 --> 00:37:31,480
So I've got a company issue computer, but then I have my personal iPad and my personal
561
00:37:31,480 --> 00:37:34,920
cell phone, because I don't want to carry two phones around.
562
00:37:34,920 --> 00:37:39,880
And so we have soft tokens on our devices.
563
00:37:39,880 --> 00:37:45,440
So if I want to access an application, it will require me to authenticate using my RSA
564
00:37:45,440 --> 00:37:49,840
soft, and then I can do that and it will automatically authenticate through an app.
565
00:37:49,840 --> 00:37:56,360
The moment I go from sort of basic access, so if I'm using Outlook or Office or those
566
00:37:56,360 --> 00:38:00,160
kinds of things, there's just the basic RSA token.
567
00:38:00,160 --> 00:38:04,920
The moment I go to an application, like an HR application or things that may have, I
568
00:38:04,920 --> 00:38:07,120
then have to go through an application control layer.
569
00:38:07,120 --> 00:38:12,800
So we actually have a workspace product, a company that we acquired.
570
00:38:12,800 --> 00:38:17,640
And so all of our applications are trusted applications that we only can launch from
571
00:38:17,640 --> 00:38:19,800
this security environment.
572
00:38:19,800 --> 00:38:24,320
And that allows me then access one layer further so I can access certain kinds of data from
573
00:38:24,320 --> 00:38:26,360
my personal devices.
574
00:38:26,360 --> 00:38:28,000
None of that data is stored locally.
575
00:38:28,000 --> 00:38:33,320
It's all kept inside the confines of mothership.
576
00:38:33,320 --> 00:38:39,560
And then lastly is I then on my company-issued device, I can actually get through, and not
577
00:38:39,560 --> 00:38:44,800
only that, but actually through my personal device, I can get through a workspace desktop.
578
00:38:44,800 --> 00:38:51,080
So we have something called Workspace One that allows me to actually visualize entire
579
00:38:51,080 --> 00:38:55,680
environments but through an interface where I'm not actually getting the data.
580
00:38:55,680 --> 00:38:59,760
I'm interfacing with the data that's on a server somewhere in the cloud.
581
00:38:59,760 --> 00:39:05,240
And so based on the kinds of data that I'm accessing, it just automatically makes me,
582
00:39:05,240 --> 00:39:07,040
it requires me to go.
583
00:39:07,040 --> 00:39:08,120
And I don't know I'm doing it.
584
00:39:08,120 --> 00:39:12,160
It literally is, I click on an app and it opens and it looks like I'm in the app, but
585
00:39:12,160 --> 00:39:18,400
behind the scenes, it's doing all this stuff to isolate my device from the data.
586
00:39:18,400 --> 00:39:23,080
So that if I've done something stupid on my personal device, downloaded some software that
587
00:39:23,080 --> 00:39:27,600
I really like, like Angry Birds from China, you know, that it's still not going to have
588
00:39:27,600 --> 00:39:31,400
the ability to get into VMware, you know, critical, critical data.
589
00:39:31,400 --> 00:39:35,040
So I think that's what we're going to have to do.
590
00:39:35,040 --> 00:39:38,360
You know, the government has come out and met with us many times to sort of look at
591
00:39:38,360 --> 00:39:42,960
how we've done our zero trust, because we did zero trust.
592
00:39:42,960 --> 00:39:46,960
We almost had all of it implemented before zero trust was even a thing.
593
00:39:46,960 --> 00:39:50,480
And that's why we made some of the acquisition acquisitions that we made was actually to move
594
00:39:50,480 --> 00:39:54,120
it and so we could use it internally as well.
595
00:39:54,120 --> 00:39:55,120
That's great stuff.
596
00:39:55,120 --> 00:39:57,680
And Craig, thank you for laying that out.
597
00:39:57,680 --> 00:40:04,040
So you mentioned training, tools to break the executables, endpoint protection, multi-factors
598
00:40:04,040 --> 00:40:10,200
and moving to that software defined kind of structure.
599
00:40:10,200 --> 00:40:13,360
And thank you for that, because I think that that's really incredibly valuable.
600
00:40:13,360 --> 00:40:19,000
And I think about this market segment, those are the areas that are most impactful.
601
00:40:19,000 --> 00:40:21,280
So thank you for sharing that.
602
00:40:21,280 --> 00:40:23,000
Thank you for your time.
603
00:40:23,000 --> 00:40:24,120
That's all for this episode.
604
00:40:24,120 --> 00:40:28,760
Make sure you tune in next time to Logically Speaking, Stay Cyber First and Future Ready.
