Vollständiges Transkript von DtSR Episode 723 - Richard Bird Security is Built Wrong

like what are we gonna collect? 00:05:41.680 --> 00:05:42.800 And it was always the same thing. 00:05:42.879 --> 00:05:48.800 It was like, okay, how many antivirus semantic at the time did we have deployed? 00:05:48.959 --> 00:05:55.120 Uh, how many of them were within like one update at the time that was like a weekly update of signatures? 00:05:55.199 --> 00:05:56.639 Guys, remember how long ago that was? 00:05:56.879 --> 00:05:58.480 It was a long time ago. 00:05:59.199 --> 00:06:05.920 And then we collect collected all kinds of like how many attacks did we have and how many systems deployed, how many this, how many that. 00:06:06.079 --> 00:06:13.600 But you're right in that we we are measuring perhaps the the wrong things. 00:06:13.759 --> 00:06:14.319 Uh oh. 00:06:14.560 --> 00:06:18.079 And we've lost we've lost my guy again. 00:06:18.800 --> 00:06:20.480 I would say we're measuring the weather. 00:06:20.879 --> 00:06:22.240 I think we do a lot of measuring the weather. 00:06:22.560 --> 00:06:24.160 No, that's that's probably not wrong, right? 00:06:24.319 --> 00:06:36.959 Like measuring the weather feels like and and and then trying to but but but if we're but if we're measuring I mean for measuring the weather, at least that gives you an idea of what you're doing. 00:06:37.120 --> 00:06:44.319 I don't feel like we've we've adjusted behaviors a little bit, but not in a meaningful way, which is strange. 00:06:45.120 --> 00:06:57.759 Well, I use a I cannot believe that my two gig service sucks so bad that I just changed to my cell phone, and now I've got perfect I have perfect cellular and Wi-Fi to be connected to this call. 00:06:58.160 --> 00:07:00.720 There's a there's a great navigational reference here, right? 00:07:00.879 --> 00:07:04.160 You can measure speed and you can measure direction. 00:07:04.399 --> 00:07:12.480 Think of it from a standpoint of navigating a ship, and you can still be way off of where you're trying to get to because of currents. 00:07:12.560 --> 00:07:12.959 Yeah, fair. 00:07:13.199 --> 00:07:25.279 Because of wind, because of, you know, there are so many elements of measurement, and what we've done within cybersecurity is is persisted a near binary version of metrics. 00:07:25.439 --> 00:07:27.519 You either have or you don't, right? 00:07:27.759 --> 00:07:30.160 And and that has propagated, you know. 00:07:30.240 --> 00:07:37.199 I think it's when we think about how important accurate measurement is, we need to kind of reel this back. 00:07:37.360 --> 00:07:39.920 And these are many of the arguments within the book. 00:07:40.319 --> 00:07:52.639 If I start measuring the wrong things, and in the course of measuring the wrong things, I am incentivized and rewarded for measuring those wrong things, then what do I do? 00:07:52.800 --> 00:07:54.560 I produce more of those wrong things. 00:07:54.720 --> 00:08:03.839 Now think about in the context of the last 30 years of security: more dashboards, more blinky lights, more lines, more graphs, more this, more that. 00:08:04.000 --> 00:08:12.000 And yet nobody's ever stopped to question whether or not the the measurement devices that we're currently using are keeping us on course, right? 00:08:12.160 --> 00:08:14.480 And then this is compounded by a really interesting problem. 00:08:16.000 --> 00:08:17.439 Yeah, go ahead, please. 00:08:18.399 --> 00:08:18.959 No, no. 00:08:19.199 --> 00:08:26.720 So this is this this is something that's that's bothered me for years because we measure things like how many attempts have there been. 00:08:27.040 --> 00:08:36.480 Like we measure I I remember measuring things like how many IDs did we have that had not had a password change in 45 days. 00:08:37.200 --> 00:08:37.840 Yeah. 00:08:38.480 --> 00:08:45.600 And it seemed like it was a good idea to annoy people to change their password every 45 days. 00:08:45.759 --> 00:08:50.080 But if you sit and think about it, you go, but why is that relevant? 00:08:50.240 --> 00:08:52.960 And the answer was because that's what security does. 00:08:53.039 --> 00:08:55.440 We change passwords every 45 days because you need to. 00:08:56.399 --> 00:09:04.080 But if you kept saying why, eventually you'd get to well because we say so. 00:09:06.080 --> 00:09:06.720 Yeah. 00:09:06.960 --> 00:09:09.840 I mean, the because we say so thing is interesting. 00:09:10.080 --> 00:09:17.600 It's we have built massive amounts of processes around security. 00:09:18.159 --> 00:09:29.759 Basically, I I phrase it as you know, if you're a history buff at all, in 1961, Eisenhower talks about the uh cyber or puts about the uh military-industrial complex, right? 00:09:29.919 --> 00:09:31.200 That that the U.S. 00:09:31.360 --> 00:09:47.039 economy has become industry that serves military, and military makes you know economic requests of the industry, and then they just create this really self-perpetuating cycle of arms escalation, all the different kinds of things. 00:09:47.120 --> 00:09:48.799 And that's what Eisenhower is pointing to. 00:09:49.039 --> 00:09:54.720 What I've seen is the rise of the cybersecurity corporate complex, right? 00:09:54.879 --> 00:09:58.000 Which is, and let me give you a very specific example of this. 00:09:58.320 --> 00:10:03.679 I've got an index site out called the Hacker in a Hoodie Index, uh, hackernahoodie.com. 00:10:03.919 --> 00:10:05.919 Yes, that URL was available. 00:10:06.080 --> 00:10:14.240 And and instead of framing cybersecurity in terms of winning or losing, I'm framing it in terms of succeeding or failing. 00:10:14.399 --> 00:10:20.879 And in succeeding or failing, I decided, you know, the most relevant economic measure is investment growth. 00:10:21.120 --> 00:10:29.759 So if I invested$100 in the hacker 20 years ago, how much more money would I have if I invested in the hundred,$100 in the SP or NASDAQ? 00:10:30.000 --> 00:10:45.279 Well, it turns out that if you look at the last 10 years, 2014 to 2024,

that time frame, the growth rate for hacker returns just by using the FBI IC3 report was 35% compound average growth a year. 00:10:45.759 --> 00:10:49.200 The SP 500 with inflation return about 7%. 00:10:50.399 --> 00:10:50.720 Right? 00:10:50.960 --> 00:10:58.720 You would be better off investing in the hackers for your 401k than investing in security solutions companies or cybersecurity investment. 00:10:59.279 --> 00:11:07.759 Now, the cybersecurity corporate complex comes into play when you think about it from the standpoint of, oh, we have cyber insurance as a backstop, right? 00:11:08.000 --> 00:11:11.279 It's been the financial backstop and tool for more than two decades. 00:11:11.759 --> 00:11:21.600 Except if we're measuring all the wrong things, and then that's the way that cyber insurance is pricing policies, then we're insuring the wrong things. 00:11:21.679 --> 00:11:22.960 But it gets even worse than that. 00:11:23.120 --> 00:11:31.519 There's an exhibit on the Hacker in a Hoodie site about the most recent NAIC report, which is the National Insurance Consortium. 00:11:31.759 --> 00:11:37.039 And in the cybersecurity space, they come back and they say, well, the way that we price premiums, I don't make this stuff up. 00:11:37.120 --> 00:11:40.320 This is data that's readily available, just nobody's pulling it together. 00:11:40.559 --> 00:11:52.720 The way that we price insurance premiums for cyber insurance is based upon your investment plan in solutions for cybersecurity for the coming year. 00:11:52.960 --> 00:11:55.039 Now think about that for just a second. 00:11:55.279 --> 00:11:57.759 Like we're not basing it on actual losses. 00:11:57.919 --> 00:12:05.600 In fact, in 2025, for the first time ever in history, cyber insurance premiums went down and the FBI IC3 hit a brand new record. 00:12:05.759 --> 00:12:12.000 Like there is no insurance market in the world where losses go up and premiums go down at all. 00:12:12.159 --> 00:12:12.480 Right? 00:12:12.639 --> 00:12:14.960 That defies mathematics. 00:12:15.200 --> 00:12:23.759 But why then is the insurance industry pumping solutions acquisition as the solve for cybersecurity problems? 00:12:23.919 --> 00:12:31.919 Well, because it's become the self-perpetuating giant ecosystem of build more metrics, build more measures, build more, have more activity. 00:12:32.080 --> 00:12:35.919 And now if you buy more of that stuff, I'm going to reduce your cyber insurance premium. 00:12:36.080 --> 00:12:40.720 This is the death spiral that we've put cybersecurity in in the last 30 years. 00:12:40.960 --> 00:12:43.759 And we're all complicit in it, right? 00:12:44.159 --> 00:12:45.600 All of us have been a part of that. 00:12:46.080 --> 00:12:52.399 All I'm trying to do is draw attention to the fact that there's data and numbers that clearly show that forget about winning or losing. 00:12:52.559 --> 00:12:57.519 We are failing at cybersecurity, and we need to think about the problem set differently. 00:13:00.720 --> 00:13:01.679 That makes sense. 00:13:16.320 --> 00:13:19.120 Look at all the things I'm doing for you, right? 00:13:19.279 --> 00:13:19.600 Yeah. 00:13:19.919 --> 00:13:28.159 And so, I mean, I again, having been complicit in this, because I've been in this industry long enough to see it, you're like, it's it's like if you've ever sold something, right? 00:13:28.240 --> 00:13:31.840 And and and the customer says, ah, what's the ROI on this? 00:13:32.000 --> 00:13:38.559 And you go back and you and you create an ROI when we damn well know there's no ROI, right? 00:13:38.799 --> 00:13:43.120 Like there's there's not there's not a there's not a clear ROI here. 00:13:43.200 --> 00:13:45.039 You're making it look really good. 00:13:45.919 --> 00:13:47.919 Which congratulations to you. 00:13:48.240 --> 00:13:50.080 But but you're you're making stuff up. 00:13:50.159 --> 00:14:10.480 And and and so this is a lot of again to justify the spend, we create metrics and data points that show you how well something is working to to to then show you that you justify more spend and then and this is kind of the spiral. 00:14:10.720 --> 00:14:11.039 Okay. 00:14:11.279 --> 00:14:12.960 Well that that's I don't love that. 00:14:13.840 --> 00:14:16.000 Yeah, there's an important question in there. 00:14:16.320 --> 00:14:22.559 Does that suggest that the the ROI math that we're using for cybersecurity is wrong? 00:14:22.960 --> 00:14:36.879 If we can't quantify in financial terms, which is what the business speaks, if we can't quantify it, have we spent the last 25 years sitting on our hands just mumbling and compliant, complaining and groaning, going, it's impossible? 00:14:37.200 --> 00:14:39.759 It does not seem impossible. 00:14:40.080 --> 00:14:48.799 It seems like if you are measuring based upon what our currency is, and let me let me give you a really great example of this. 00:14:49.039 --> 00:14:58.480 I hear all the time, and you guys can finish this sentence too, the problem with security, and the reason that we can't prove ROI is because cybersecurity is a cost of doing business. 00:14:59.679 --> 00:15:00.000 Right? 00:15:00.159 --> 00:15:02.720 That that is the economic justification for what we do. 00:15:03.279 --> 00:15:07.759 There are only two costs of doing business in corporate America. 00:15:08.399 --> 00:15:08.720 Two. 00:15:09.600 --> 00:15:15.440 One is cybersecurity by our own emission, two are corporate taxes. 00:15:16.399 --> 00:15:18.879 What are the things that we all try and avoid in life? 00:15:19.360 --> 00:15:22.799 Taxes and in the corporate environment, cybersecurity. 00:15:23.039 --> 00:15:23.440 Why? 00:15:23.600 --> 00:15:25.279 Because we priced it as a tax. 00:15:25.600 --> 00:15:28.080 We didn't price it as a business function. 00:15:28.320 --> 00:15:40.799 And so when you start to look at things like, okay, what if I had something like, and this is all in the book, my I propose a whole new series of

models around turning cybersecurity into an actual business function? 00:15:41.120 --> 00:15:46.480 What if there were math that associated to something like a security yield? 00:15:46.720 --> 00:15:49.120 Now, CFO knows what a yield is, right? 00:15:49.360 --> 00:16:00.639 So for every dollar that I spend on cybersecurity solutions, how many dollars does that does that represent in reduction of risk and external threat? 00:16:00.879 --> 00:16:03.759 Now, the argument could be made as I don't know that number. 00:16:04.080 --> 00:16:08.159 And forgive me, folks, on LinkedIn Live, but that's bullshit. 00:16:08.960 --> 00:16:09.919 We know that number. 00:16:10.080 --> 00:16:11.360 We know that number in spades. 00:16:11.600 --> 00:16:22.480 In fact, IBM financial cost of reach has been consistent for 20 plus years, and that number has been around four and a half to five million dollars minimum for every incident. 00:16:22.639 --> 00:16:24.720 You could start there, right? 00:16:24.879 --> 00:16:35.039 And you could put a solution in place and go, okay, how much of that four or five million dollars that is a potential financial impact, would your solution reduce? 00:16:35.360 --> 00:16:50.159 Or how much would replacing a 20-year contract with one of the top 10 security solution providers actually save me in both reduced risk and cost of dollars spent if I could compare it against a security yield? 00:16:50.399 --> 00:16:54.480 Now, I you deep diving into this discussion is is difficult. 00:16:54.639 --> 00:17:03.840 I'd need the glass whiteboard and all that, but it is there, and it is true, and it begins with a very simple economic reality that cybersecurity has never embraced. 00:17:04.000 --> 00:17:08.720 And I didn't create it, and I learned it at JP Morgan Chase, and that is unit costing. 00:17:08.960 --> 00:17:16.960 We unit costed everything in security down to the OS and stack for every transaction in security. 00:17:17.200 --> 00:17:31.119 And because I had unit costing, I knew exactly how much my program cost, and because I knew exactly how much my program cost and what value it delivered, I could make financial decisions and business decisions and replace solutions that weren't getting the job done. 00:17:31.359 --> 00:17:41.680 And the reality is that the cybersecurity industry hasn't embraced that because the business has convinced us that we are a tax and we are a problem and we are the office of no. 00:17:41.839 --> 00:17:56.400 And every time I hear somebody say CISOs are going to have to be much more, become much more like business leaders, I say baloney because there's no possible way for a CISO to become a business leader when his function or her function is priced as a tax. 00:17:56.799 --> 00:18:02.400 As soon as it's priced as a business function, then they get a seat at the big kids table. 00:18:02.720 --> 00:18:09.599 And we all know most of us in security haven't had a seat at the big kids table for decades, right? 00:18:10.000 --> 00:18:11.440 We don't report to a CEO. 00:18:11.599 --> 00:18:16.079 We don't don't give me the five percent that are reporting to a board or to a CEO. 00:18:16.240 --> 00:18:18.160 Give me the 95% who aren't. 00:18:18.400 --> 00:18:19.279 Or the 95%. 00:18:23.680 --> 00:18:24.960 What the hell? 00:18:27.359 --> 00:18:28.640 Everything just shut down. 00:18:28.799 --> 00:18:29.680 Am I back? 00:18:31.599 --> 00:18:36.400 Uh your video is your video is toast, but your audio is as good. 00:18:36.720 --> 00:18:38.319 Everything just wit kablooey. 00:18:38.400 --> 00:18:42.960 Anyhow, it's uh you know, I'm I'm I'm doing a lot of you know data dumping and verbal vomit here. 00:18:43.039 --> 00:18:45.440 I mean, come on, you guys gotta take some swings. 00:18:47.680 --> 00:18:49.200 I I do want to make one quick point. 00:18:49.359 --> 00:18:50.480 It's going back a little while ago. 00:18:50.559 --> 00:18:51.920 You said something that resonated with me. 00:18:52.079 --> 00:19:05.279 I can give a dozen examples, but in situations where we're measuring things because they they one the process of measuring takes so much time and energy, it creates you know teams around it sometimes. 00:19:06.000 --> 00:19:09.200 And also there's this fear of changing. 00:19:09.279 --> 00:19:17.680 And I've seen this again, I've got a number of stories like this, but where I've walked into leadership room and said, hey, you're literally measuring the wrong thing. 00:19:17.839 --> 00:19:20.480 You're actually your math is actually wrong. 00:19:20.640 --> 00:19:23.359 Let's take a step back and at least get the math right. 00:19:23.759 --> 00:19:31.680 And they were like, nope, because you know, they had already gotten into a rhythm, and that rhythm had defined their professional identity within that organization. 00:19:32.000 --> 00:19:33.200 So there's a lot of danger there. 00:19:33.359 --> 00:19:45.279 Yeah, a a question for for you, Richard, would be let's take something kind of simple and maybe help us, you know, frame it in kind of a model that you're speaking about in your book. 00:19:46.240 --> 00:19:54.559 You know, so let's say, for example, I don't know, you need to replace all your firewalls, or you need to buy new firewalls, or you need to upgrade your firewalls kind of thing. 00:19:54.799 --> 00:20:01.279 You know, new license come out from Paolo, they need they're now they're doing fancy things, and you need to sort of justify that expense. 00:20:01.599 --> 00:20:08.720 And your model, I like to, by the way, I love the yield concept, but help me to take, let's take a really small something. 00:20:09.200 --> 00:20:17.920 And how how can we start framing that differently to be more like a contributing business unit as opposed to a you know, giant sucking sound? 00:20:19.279 --> 00:20:19.759 Yeah. 00:20:20.000 --> 00:20:33.680 Well, the you know, it's it's interesting to dive into something like that specifically because it it raises a couple

of key questions first, which is you know, what are your input data sources to make the decision to begin with? 00:20:33.759 --> 00:20:34.079 Right. 00:20:34.240 --> 00:20:47.839 Now, if we look at the way that the world has grown for cybersecurity solutions today, the way that we do that is is maybe a POC and and really a whole lot of promises from the vendor, right? 00:20:48.240 --> 00:20:49.519 We we just do better. 00:20:49.680 --> 00:20:51.039 We do more, right? 00:20:51.119 --> 00:20:54.960 And I and and so it raises and AI. 00:20:55.519 --> 00:20:56.880 And it raises that question. 00:20:56.960 --> 00:20:58.720 It's like based on what? 00:20:58.960 --> 00:20:59.279 Right? 00:20:59.359 --> 00:21:06.640 Like, what are your comparative metrics that you're telling me that you do better than you know firewall company, you know, Q, right? 00:21:07.119 --> 00:21:19.119 And and and this gets into a really interesting set of problems because we lack for a tremendous amount of comparative information amongst our industry comparatives, right? 00:21:19.359 --> 00:21:22.400 I mean, Jim, I know you know this, you know, inside and out. 00:21:22.559 --> 00:21:25.759 Like we go in in front of customers, and the customer is desperate. 00:21:25.839 --> 00:21:28.319 They're like, great, we're gonna put your technology in. 00:21:28.480 --> 00:21:31.599 Can you give us an entire manual of best practices? 00:21:32.079 --> 00:21:33.599 It's like, wait, what? 00:21:34.000 --> 00:21:37.920 Wait, like you want to know how to run the thing in your environment, right? 00:21:38.160 --> 00:21:40.079 Well, why did they ask for best practices? 00:21:40.240 --> 00:21:48.400 Because there's no industry sharing of actual breach numbers, of attack vectors, of nobody is sharing that stuff, right? 00:21:48.480 --> 00:21:49.440 And why don't we do that? 00:21:49.599 --> 00:21:59.119 Well, you know, if if we shared how we got breached, then we would be opening up the door to admitting that uh in class action litigation that we, you know, we made a mistake. 00:21:59.359 --> 00:22:03.039 Well, that's That's great, except nobody learns anything. 00:22:03.200 --> 00:22:04.480 Like, how on earth? 00:22:04.720 --> 00:22:06.000 Great input source. 00:22:06.160 --> 00:22:18.240 How on earth are the key three identity vectors in the in the Verizon DBIR the same breach metrics that we have been exposed to for the last 23 years? 00:22:18.480 --> 00:22:25.119 Like, how did we how is it possible that we could have all this information about what we're doing wrong? 00:22:25.359 --> 00:22:30.640 And we have never improved on a single Verizon DBIR attack vector. 00:22:30.720 --> 00:22:31.440 Not one. 00:22:31.680 --> 00:22:41.440 In fact, the only one that has ever come off was POS malware because we went to chip and pin in 2015 and then all of a sudden malware dropped off. 00:22:41.680 --> 00:22:43.039 Every one of them's been the same. 00:22:43.119 --> 00:22:44.480 We know how we get beat. 00:22:44.559 --> 00:22:46.640 And that comes back to the firewall point. 00:22:46.799 --> 00:22:49.200 How do we use data that's available? 00:22:49.440 --> 00:22:54.000 Well, first of all, we stop hamstring our pen testers, right? 00:22:54.160 --> 00:22:55.759 Pen testers can't touch production. 00:22:55.920 --> 00:22:58.079 Pen testers do fully scope pen tests. 00:22:58.240 --> 00:23:01.119 Last I checked, bad guys don't have any scoping. 00:23:01.359 --> 00:23:03.759 Bad guys get to do whatever the hell they want to. 00:23:03.920 --> 00:23:19.359 And when you don't have the data that can tell you that one thing is better than another, in the case of firewalls, then the best that you can do is rely on markitecture and marketing slicks and all the information that comes from your providers and trying to dedicate engineers to POCs. 00:23:19.519 --> 00:23:31.200 So what you need to do is to assemble information that is clear and available, the Verizon DBIR, OWASP top 10, particularly as it relates to networking. 00:23:31.359 --> 00:23:38.160 And then you take that bolus of information, and that is what you put the firewall provider up against. 00:23:38.400 --> 00:23:45.119 Like, show me how you eliminate this specific attack vector with your solution. 00:23:45.359 --> 00:23:49.440 And if the argument comes back, well, we can't promise that we can eliminate it. 00:23:49.759 --> 00:23:51.920 Well, what can you promise? 00:23:52.400 --> 00:23:52.880 Right? 00:23:53.119 --> 00:24:04.160 What is it that you can do with your solution that shows market improvement against the attack vectors that we have known about for decades and have made no improvement or progress against? 00:24:04.400 --> 00:24:08.480 If you show me you can take one of those out, then we've got a really interesting conversation. 00:24:08.720 --> 00:24:12.640 And that's without even having to go into the financials on this, right? 00:24:13.200 --> 00:24:27.279 The the we tend to ignore I've said it for years, cybersecurity is the only function in the enterprise world that actively ignores evidence, data, and history. 00:24:27.519 --> 00:24:32.000 We just flat out refuse to actually look at any of that, right? 00:24:32.240 --> 00:24:38.880 We look at the data inside of our own organization, and then we don't understand the echo chamber effect that that causes. 00:24:39.119 --> 00:24:41.200 If it's the old hammer and the nail problem. 00:24:41.359 --> 00:24:51.839 If all I ever see is attacks through this particular port, then I'm going to build a solution that only addresses attacks through this just this specific port, right? 00:24:52.240 --> 00:24:55.279 I have a hammer, therefore everything is a nail. 00:24:55.599 --> 00:24:59.839 In today's world, our problems are not nails anymore, right? 00:25:00.240 --> 00:25:02.480 Our problems are way more diverse than that. 00:25:02.720 --> 00:25:15.359 So the the use of data, I actually think that using data that's ready readily available

like that, Jim, could could uh eliminate half of the field in any vendor category right out of the gate. 00:25:15.519 --> 00:25:19.839 Like you're not going to be dorking around with POCs taking three months of your engineer's time, right? 00:25:20.240 --> 00:25:34.880 Yeah, I remember conversations we would have about the concept, and this is a long time ago about actuarial tables and the concept of having a data-driven risk discussion so you can actually make investments where it made a difference to the business. 00:25:35.119 --> 00:25:41.680 And you know, I used to always say is security is nothing more than the controls you put to protect your assets from threats. 00:25:41.759 --> 00:25:49.680 And we just need to really focus on threats, trying to make a control where we think it's going to be, and we still are trying to figure out the data part sometimes. 00:25:49.920 --> 00:26:02.240 And I and I and it's just kind of like if we could get information, actual information about what's happening in a in a tactical sense and more up to date, then you could actually adjust more readily without having to spend a ton of money. 00:26:02.319 --> 00:26:15.680 But I think your core around using data for decision making, you know, you say I say that out loud and you would think that's what we're doing, but I don't think I think we're not doing it to your point at a level of sophistication. 00:26:15.920 --> 00:26:24.160 And then if we are, as it moves to the system, it gets refined and it gets more executized into a bullet point. 00:26:24.480 --> 00:26:25.440 Well, how much is that going to be? 00:26:25.599 --> 00:26:27.519 A million dollars, you know, whatever kind of thing. 00:26:27.759 --> 00:26:40.960 But I I I 100% agree with your point, is we are we could use, I don't know if I would say more data, but more more information that more not more data, but better information that we can make decisions. 00:26:41.200 --> 00:26:43.680 Jim, it's almost like we have too much data already. 00:26:43.839 --> 00:26:47.599 Yeah in the in the sense that we're trying to cover everything. 00:26:47.839 --> 00:26:50.799 I mean, Richard, you mentioned uh, you know, OWASP top 10. 00:26:51.200 --> 00:26:59.119 Going back kind of like fundamental, like which OWASP top 10 of the hundred top 10s that exist out there, like everybody's trying to solve. 00:26:59.279 --> 00:27:07.839 I gotta do PCI, I gotta do HIPAA, I gotta do SOC2, I gotta do this, I gotta do, you know, again, all hundred of the OWASP top tens, I gotta do all these. 00:27:07.920 --> 00:27:09.200 Now AI's involved. 00:27:09.359 --> 00:27:14.799 Like nobody's taking the time to step back and say, okay, but what are the issues to my organization? 00:27:14.880 --> 00:27:16.480 It's I gotta solve all this. 00:27:16.640 --> 00:27:16.880 Yeah. 00:27:17.200 --> 00:27:19.920 Instead of those what they would call the fundamentals, right? 00:27:20.000 --> 00:27:22.160 That we've talked about for the last 20 years. 00:27:22.480 --> 00:27:29.039 Yeah, I I don't say this to insult anybody, but look, companies are still getting popped on SQL injection. 00:27:29.200 --> 00:27:31.039 That's how bad we suck. 00:27:31.440 --> 00:27:38.240 Like, we haven't fixed a 30-year attack vector anywhere. 00:27:38.480 --> 00:27:55.440 Like, and and when when you look at it, so so to your point, it you you know, James, when you come back to we have too much data, do we have do we have enough data that points us towards actual effectiveness, or do we have too much data of all the things that we're measuring incorrectly? 00:27:55.599 --> 00:27:55.839 Right. 00:27:56.000 --> 00:27:59.039 And that that kind of is the mess that we find ourselves in. 00:27:59.119 --> 00:28:04.720 And I think that the I think it gets really frustrating when you take this step and back. 00:28:04.799 --> 00:28:07.759 And I'd love hearing what you guys have said so far. 00:28:08.000 --> 00:28:16.240 Like us as old dogs in security, we take a step back and we go, oh my God, we have actually been doing this. 00:28:16.400 --> 00:28:18.720 Maybe we aren't looking at the right things. 00:28:18.960 --> 00:28:24.240 I haven't talked to, I've had 40 peer readers in the cybersecurity industry for this book. 00:28:24.480 --> 00:28:31.359 Everyone is a name that you know, and every one of them is an important voice in cybersecurity, and everyone says the same thing. 00:28:31.519 --> 00:28:36.720 They're like, damn, we probably have been looking at the wrong stuff, right? 00:28:36.880 --> 00:28:41.440 Maybe we need to think about looking at things differently. 00:28:41.680 --> 00:28:45.680 And then that presents opportunities for us to look at data differently. 00:28:45.759 --> 00:28:50.880 And I want to make sure that that I cover some of the things that I'm sure the people who are listening wanna know about. 00:28:51.200 --> 00:29:02.559 Two and a half, nearly three years of research, I realized that when you think about everything in cybersecurity, it really falls into three specific buckets. 00:29:02.799 --> 00:29:07.759 And this is where we can begin, Jim, to orient data and information toward those buckets. 00:29:07.920 --> 00:29:16.319 There are really only three things in security exposure, interdiction, okay, exposure, what am I exposed to? 00:29:16.640 --> 00:29:38.559 And and when you have things like stuff that I see in the Hacker and the Hoodie index when the breaches come across, when you've gotten popped on a third-party vendor supply problem from a from a breach standpoint, and then 21 months 21 months later, you get popped again on the same vector, you're just ignoring data at that point. 00:29:38.720 --> 00:29:41.599 Like you are willfully choosing to get hit again. 00:29:41.680 --> 00:29:43.519 And that actually is a company called Veridime. 00:29:43.759 --> 00:29:44.960 It happened, right? 00:29:45.200 --> 00:29:47.200 Tell us it just happened again. 00:29:47.759 --> 00:29:49.359 That one just

popped yesterday. 00:29:49.599 --> 00:29:52.160 Revolute bank, it just popped again. 00:29:52.400 --> 00:29:55.039 Same vectors, API hijacking. 00:29:55.680 --> 00:29:57.200 And you're like, wait a minute. 00:29:57.359 --> 00:30:03.359 Like, if you know that it's a problem, why aren't you going to address that problem specifically? 00:30:03.759 --> 00:30:06.319 And because now you know where your exposure is at. 00:30:06.480 --> 00:30:07.119 Interdiction. 00:30:07.279 --> 00:30:11.119 Once that exposure has been exploited, what are the interdiction measures? 00:30:11.279 --> 00:30:13.039 Now we start talking about micro-segmentation. 00:30:13.119 --> 00:30:15.119 We start talking about how do I contain it? 00:30:15.200 --> 00:30:17.440 Because you get to the third one and it's consequence. 00:30:17.599 --> 00:30:19.039 How big is the blast radius? 00:30:19.119 --> 00:30:21.680 And you guys are already hearing this in the AI world. 00:30:21.839 --> 00:30:24.640 People have stopped talking about trying to make security better. 00:30:24.799 --> 00:30:29.279 Now everybody is already taught always talking about resiliency, right? 00:30:30.079 --> 00:30:31.359 What another indictment. 00:30:31.519 --> 00:30:37.680 If everybody in the AI space is going, we're not going to ever make security better, so we just need to make sure that we can survive it. 00:30:37.920 --> 00:30:39.519 That's messed up. 00:30:39.759 --> 00:30:43.200 Like, how about we go back and like fix security? 00:30:43.440 --> 00:30:53.359 Like, so inner exposure, interdiction, and consequence, it I haven't found anything in security that falls outside of those three building blocks. 00:30:53.680 --> 00:30:57.200 And that gets us where we're into the right level of metrics. 00:30:57.599 --> 00:30:59.599 Yeah, I mean, look, that that makes sense. 00:30:59.839 --> 00:31:02.000 I'm sorry we lost your lost your video there. 00:31:02.160 --> 00:31:09.759 I think if if you refresh in your browser, that might bring that restart that part of your you want you want to give it a shot? 00:31:10.240 --> 00:31:11.039 Yeah, hang on. 00:31:11.200 --> 00:31:12.079 Here we go. 00:31:12.400 --> 00:31:14.000 See if he comes back. 00:31:19.119 --> 00:31:21.200 And he is back, kids. 00:31:21.359 --> 00:31:21.920 All right. 00:31:24.000 --> 00:31:24.799 I don't know, man. 00:31:24.960 --> 00:31:27.759 Your internet connection just does not want to participate with us today. 00:31:27.839 --> 00:31:29.359 I don't know what's going on there, bud. 00:31:30.000 --> 00:31:30.880 Me neither, man. 00:31:31.119 --> 00:31:31.599 Me neither. 00:31:31.759 --> 00:31:39.759 It's it, you know, if technology is truly going to run the world, we better fix both fix both teleconferencing and bandwidth. 00:31:40.240 --> 00:31:41.839 Because those are the limiting factors. 00:31:42.559 --> 00:31:43.200 Yeah. 00:31:44.079 --> 00:31:45.519 Yeah, for for sure. 00:31:45.680 --> 00:31:48.880 Listen, so one last thought here before I let you go. 00:31:50.880 --> 00:31:58.160 There's a there's a bit of me that says we we've had this conversation before. 00:31:59.119 --> 00:32:02.000 We've been trying to fix this for a long time. 00:32:02.799 --> 00:32:09.759 I like I distinctly remember early 2000s saying these these are just numbers. 00:32:09.920 --> 00:32:14.880 These don't help drive decisions, they're just numbers for the sake of gathering numbers. 00:32:15.359 --> 00:32:17.599 Where where's the inflection point? 00:32:17.759 --> 00:32:18.640 Where's the pivot? 00:32:18.720 --> 00:32:21.839 What what's gotta change so that things change? 00:32:22.000 --> 00:32:38.720 Because we've had like so one podcast back, if you go back a show, Rob and Jeremiah on talking about how vulnerability management is is finally, now that there's actuarial data, is finally able to make a change in in itself. 00:32:40.079 --> 00:32:43.440 Is that gonna catalyze other changes? 00:32:43.680 --> 00:32:45.680 Please say yes, please say yes, please say yes. 00:32:45.920 --> 00:32:46.720 No, no. 00:32:47.599 --> 00:32:50.480 No, but but but but it's not hopeless, right? 00:32:50.559 --> 00:32:51.920 I I had a kid that came up to me. 00:32:52.000 --> 00:32:59.680 I did a kind of a teaser spoiler presentation on this in in Columbus, Ohio at the at the big conference there, because it was old home turf. 00:33:00.000 --> 00:33:03.920 And uh young man was super excited. 00:33:04.160 --> 00:33:05.920 He was like, I loved everything in your presentation. 00:33:06.079 --> 00:33:09.440 He goes, and I've I've I'm rolling out a new maturity model. 00:33:10.160 --> 00:33:13.440 And um I think it's gonna really, really make a difference. 00:33:13.599 --> 00:33:16.160 And and I said, you know, I said, I I appreciate that. 00:33:16.240 --> 00:33:18.240 I said, I have a question for you. 00:33:18.480 --> 00:33:22.799 I said, who gets paid when that maturity model successfully implements? 00:33:23.759 --> 00:33:27.599 And he kind of paused for a second and I said, nobody. 00:33:28.480 --> 00:33:31.920 Welcome to American Business, incentives and rewards. 00:33:32.240 --> 00:33:34.960 So you can do all the maturity programs that you want. 00:33:35.119 --> 00:33:40.480 You can do all the vulnerability, you know, uh solution and process uplift that you want. 00:33:40.720 --> 00:33:50.640 When we live in a world where a CEO can stand in front of a shareholder conference and say, security in our company is everybody's job. 00:33:51.279 --> 00:33:56.559 And the only person that actually gets compensated or penalized for security performance is a CISO. 00:33:57.680 --> 00:33:59.680 Again, that's bullshit, right? 00:34:00.240 --> 00:34:12.480 Imagine a business function that is the only business function in corporate America that nobody in corporate America is incentivized or rewarded for success or failure, right? 00:34:12.800 --> 00:34:14.559 And you're talking about cybersecurity. 00:34:14.639 --> 00:34:14.800 Why?

00:34:14.960 --> 00:34:17.920 Because it's a cost of doing business under the current model. 00:34:18.400 --> 00:34:29.039 So the truth is that we need to talk about cybersecurity performance in economic terms, not in technical terms. 00:34:29.280 --> 00:34:34.320 We can build the next best technical solution for any attack vector. 00:34:34.559 --> 00:34:44.880 And until a group of senior executives in a company is held responsible and accountable from an incentives and rewards standpoint, and this always brings up a problem. 00:34:45.039 --> 00:34:54.480 And I, Ralph, I know that you've heard this line before because we've tried it, except the way that we phrase it in cybersecurity is that if we get breached, you don't get paid a bonus. 00:34:54.719 --> 00:34:56.480 That is freaking stupid. 00:34:56.800 --> 00:34:58.639 A breach is an outcome. 00:34:58.880 --> 00:35:01.599 A breach is not a task, a function. 00:35:01.840 --> 00:35:20.000 It is so when Jeff jailbreaks production for the eighth time in DevOps, because he keeps hiding one of those passwords, and then you go to that manager, and that manager says, you know what, we can't let Jeff go because if Jeff gets hit by a bus, our business stops tomorrow. 00:35:20.239 --> 00:35:27.360 Well, guess who gets to eat the risk of Jeff and DevOps continuously jailbreaking production? 00:35:27.599 --> 00:35:28.719 The CISO. 00:35:29.119 --> 00:35:46.800 Last thing I saw, Jeff Joe Sullivan got sold out by his CEO for evidence and got, you know, got popped in in terms of litigation because you had a C-suite in Uber that was willing to just walk away and say, not our problem. 00:35:47.119 --> 00:35:53.679 This this CISO over here is the guy that screwed this up, even though the CEO was in every single freaking meeting, right? 00:35:54.000 --> 00:35:58.159 We have built a massive unaccountability model on cybersecurity. 00:35:58.320 --> 00:36:01.519 And those are harder problems to solve. 00:36:01.840 --> 00:36:15.840 But until we do, until we start actually talking about incentives and rewards, and if you are doing unsafe things, if you fail your cybersecurity awareness training for 17 consecutive times, Jane, right? 00:36:16.159 --> 00:36:23.599 And you don't actually suffer any consequences from it, then why on earth would anybody do security in my organization? 00:36:23.840 --> 00:36:24.239 Right? 00:36:24.480 --> 00:36:26.400 These are the things that we've got to solve. 00:36:26.559 --> 00:36:34.639 We've got to fix the problems economically and business function wise before we will see massive improvements in actual security performance. 00:36:36.880 --> 00:36:41.840 Well, that's a good place to end it because that that's the that's the punctuation mark at the end of that sentence, right? 00:36:41.920 --> 00:36:42.800 We got we got to do that. 00:36:42.960 --> 00:36:48.480 I think I think I think that's a lot of I don't know how we get there though. 00:36:48.559 --> 00:36:50.639 I maybe that's a conversation for the next time. 00:36:50.800 --> 00:36:58.400 But thanks for breaking through us with the a guy might have written a book. 00:36:58.480 --> 00:37:01.679 So go go when it's available, go grab a copy. 00:37:01.920 --> 00:37:03.360 This will be a good read. 00:37:03.840 --> 00:37:07.039 Cathartic, I think, for a lot of us, at very least. 00:37:07.440 --> 00:37:10.880 Well, I and let me let me let me be clear real quick. 00:37:10.960 --> 00:37:13.280 I I I obviously do not have all the answers. 00:37:13.440 --> 00:37:14.960 I barely have any, right? 00:37:15.039 --> 00:37:20.239 I I just I've embarked on a journey to just ask a different set of questions. 00:37:20.480 --> 00:37:47.199 And my hope is that instead of being cathartic, instead of, as my buddy Chase Cunningham likes to say, and all in enjoying a lick at the perpetual self-licking ice cream cone of misery, maybe we can actually start to have internal reason debate and conversation and discourse around changing things in cybersecurity instead of commiserating with each other about how badly it sucks. 00:37:47.440 --> 00:37:48.880 That's my goal, right? 00:37:48.960 --> 00:37:56.559 Is we have a way, because we have a tremendous amount of intellectual horsepower in the cybersecurity realm. 00:37:56.719 --> 00:38:01.599 And if we can get together and start thinking about these problems differently, maybe we can start solving them differently. 00:38:01.679 --> 00:38:03.199 That's my motivation. 00:38:04.000 --> 00:38:04.719 I like it. 00:38:04.800 --> 00:38:05.920 Let's end it there. 00:38:06.239 --> 00:38:08.239 Richard, congrats on the book. 00:38:08.480 --> 00:38:10.079 I I'm looking forward to the read. 00:38:10.239 --> 00:38:11.440 James, Jim, thanks. 00:38:11.519 --> 00:38:12.320 Uh thanks for joining. 00:38:12.400 --> 00:38:14.800 Uh good questions, good conversation. 00:38:15.039 --> 00:38:18.320 Not the last we're gonna we're gonna have of this for sure. 00:38:18.480 --> 00:38:25.440 Uh, and if you're listening thinking, I've got some ideas, or you guys are nuts, let's hear it. 00:38:25.519 --> 00:38:27.840 I I think that healthy debate is a good thing. 00:38:28.000 --> 00:38:30.960 I think we need to, I think we certainly need to talk about this. 00:38:31.280 --> 00:38:34.159 So Richard, thank you for joining us, folks. 00:38:34.239 --> 00:38:38.480 Thank you for listening and bearing with our audio video streaming issues today. 00:38:38.639 --> 00:38:42.400 The internet just some days does not want to cooperate, and that's how it's gonna be. 00:38:42.639 --> 00:38:45.440 But I hope you get a good one, and thanks guys for listening. 00:38:45.519 --> 00:38:50.800 We'll catch you another time, another place, another down the security rabbit hole podcast. 00:38:51.039 --> 00:38:52.000 We'll catch you guys later.