S4E24 – Dream’s agentic attack report, cyber privateers, Taiwan’s internet drill

WEBVTT
00:00:00.000 --> 00:00:01.780
But consider the cybersecurity industry for a
00:00:01.780 --> 00:00:05.040
moment. We have threat intel providers who can
00:00:05.040 --> 00:00:08.939
potentially do offensive operations. So you have
00:00:08.939 --> 00:00:12.199
essentially a perverse incentive to create threat
00:00:12.199 --> 00:00:31.070
intel to conduct more offensive operations. Hey
00:00:31.070 --> 00:00:35.390
guys, welcome back to a mid -August early morning
00:00:35.390 --> 00:00:37.390
session, especially for you Mario over on the
00:00:37.390 --> 00:00:40.329
West Coast. Good to have the Adversarial Podcast
00:00:40.329 --> 00:00:44.289
rolling as always. What's going on with you guys?
00:00:44.590 --> 00:00:47.229
Mario, how's business? How's life? What's going
00:00:47.229 --> 00:00:49.969
on over there? It's funny you mention that. You
00:00:49.969 --> 00:00:54.119
know, every so often You know you you you share
00:00:54.119 --> 00:00:58.399
some security big vulnerability with friends
00:00:58.399 --> 00:01:01.640
and family right I try to keep the world separate.
00:01:01.840 --> 00:01:05.659
Okay, but every so often You you know, I think
00:01:05.659 --> 00:01:08.900
we all go through that we send a text message
00:01:08.900 --> 00:01:10.799
to our friends and says hey You really got to
00:01:10.799 --> 00:01:14.140
go past this is really bad. So this week was
00:01:14.140 --> 00:01:16.019
one of those I'm sure all of you guys have been
00:01:16.019 --> 00:01:18.060
dealing if you're a Mac user you're dealing with
00:01:18.060 --> 00:01:21.170
the same thing you you know the whole Mac OS
00:01:21.170 --> 00:01:23.329
screen sharing service. Have you guys heard about
00:01:23.329 --> 00:01:29.129
that? No, what's going on? It was released earlier
00:01:29.129 --> 00:01:33.989
this week, but when my my head security engineer
00:01:33.989 --> 00:01:36.129
tells me Mario, we got to go take care of this.
00:01:36.129 --> 00:01:39.769
It's a big deal. So anyway, it's basically Windows
00:01:39.769 --> 00:01:42.689
Mac OS screen sharing. You've all used it. But
00:01:42.689 --> 00:01:46.349
when you enable it, you have an enable if if
00:01:46.349 --> 00:01:48.950
an attacker or person is in the local network
00:01:48.950 --> 00:01:53.609
that you're in. your work, your home, your Starbucks.
00:01:54.909 --> 00:01:59.310
It will bypass the authentication component and
00:01:59.310 --> 00:02:02.109
it will take ownership of the machine. It's a
00:02:02.109 --> 00:02:05.109
complete RCE. It's one very critical one. Anyway,
00:02:06.090 --> 00:02:07.489
so that was what I've been working on. The screen
00:02:07.489 --> 00:02:11.669
sharing is based on VNC. It's totally based on
00:02:11.669 --> 00:02:16.129
VNC. Exactly. Yeah. Oh, wow. So I mean, so essentially
00:02:16.129 --> 00:02:18.069
it's not just a Mac screen sharing issue. It
00:02:18.069 --> 00:02:20.469
sounds like it's a VNC issue. It is anybody who's
00:02:20.469 --> 00:02:23.050
running VNC will have that same problem. Yeah.
00:02:23.250 --> 00:02:25.229
I used to use that to support my mom's computer,
00:02:25.229 --> 00:02:28.310
like, you know, 20 years ago. And I had port
00:02:28.310 --> 00:02:30.650
forwarding and all that crap. And people ask
00:02:30.650 --> 00:02:33.270
you what keeps you up at night. Port forwarding.
00:02:34.849 --> 00:02:37.870
No ingress. Don't ever turn on ingress. Ingress
00:02:37.870 --> 00:02:39.990
is another mouth to feed. You have to care and
00:02:39.990 --> 00:02:41.669
feed for it and read Twitter every morning to
00:02:41.669 --> 00:02:45.250
see what VNC exploits are. but anyway once once
00:02:45.250 --> 00:02:47.810
you text it to friends and family invariably
00:02:47.810 --> 00:02:50.270
they start asking you questions what version
00:02:50.270 --> 00:02:54.909
is it i have 26 .6 i don't have 26 .61 i'm like
00:02:54.909 --> 00:02:58.090
oh crap then i open myself up for this i'm like
00:02:58.090 --> 00:03:01.150
i'm trying to do the right thing i'm sure we've
00:03:01.150 --> 00:03:03.449
all done it yeah so that's what i've been doing
00:03:03.449 --> 00:03:05.770
this week yeah it's not worth it it's easier
00:03:05.770 --> 00:03:07.370
it's better to just let them all get owned i
00:03:07.370 --> 00:03:10.930
mean you can't keep up no how about you sunil
00:03:10.930 --> 00:03:12.789
what kind of trouble have you gotten yourself
00:03:12.789 --> 00:03:16.280
into Well, speaking of patching I got myself
00:03:16.280 --> 00:03:20.840
patched I got my flu shot and my hep B shot apparently
00:03:20.840 --> 00:03:26.400
happy is a Way to stall or prevent the liver
00:03:26.400 --> 00:03:30.000
cancer. But anyway, that's it Get yours get yourself
00:03:30.000 --> 00:03:33.520
patched And I heard from a number of folks who
00:03:33.520 --> 00:03:36.759
left Defcon that conflu and specifically kovat
00:03:36.759 --> 00:03:40.020
was spreading over there. So Again, get yourself
00:03:40.020 --> 00:03:42.580
patched. Thanks new Sunil. Good good advice as
00:03:42.580 --> 00:03:44.520
always All right, well things have been going
00:03:44.520 --> 00:03:48.500
pretty well in my world a lot of fun so adversarial
00:03:48.500 --> 00:03:51.240
calm my my startup my day job company we like
00:03:51.240 --> 00:03:53.639
officially launched and put out a new website,
00:03:53.680 --> 00:03:57.939
which is I Think building a website is so embarrassing
00:03:57.939 --> 00:04:01.580
How annoying and difficult it is like just strategically
00:04:01.580 --> 00:04:03.620
and thinking about it and like of all the things
00:04:03.620 --> 00:04:06.139
we do in life building a website Which we all
00:04:06.139 --> 00:04:09.280
could do in 1995 should be you know, nothing.
00:04:09.740 --> 00:04:12.949
It's a big thing It brings in a lot of stakeholders
00:04:12.949 --> 00:04:15.370
in such pain. So to get that shipped and out
00:04:15.370 --> 00:04:18.389
the door and promote it and see the reactions
00:04:18.389 --> 00:04:21.269
for everybody and the whole concept of like a
00:04:21.269 --> 00:04:23.290
system of record is kicking off a lot of great
00:04:23.290 --> 00:04:25.170
discussion and just the way we think about security.
00:04:25.949 --> 00:04:29.430
So that's awesome. One, I wonder if you made
00:04:29.430 --> 00:04:31.949
it AI engine optimized. That's what I was going
00:04:31.949 --> 00:04:36.990
to ask, that's right. Yeah, you know, for SEO
00:04:36.990 --> 00:04:38.490
purposes and like people that are out there doing
00:04:38.490 --> 00:04:40.709
research with an AI agent, that was an option
00:04:40.709 --> 00:04:43.149
that we had of like, when LLMs are out there
00:04:43.149 --> 00:04:46.410
shopping for somebody. We didn't push that angle
00:04:46.410 --> 00:04:48.310
yet, because it's kind of I think it's like low
00:04:48.310 --> 00:04:51.509
conversion rate, high volume, and I love I can't
00:04:51.509 --> 00:04:55.420
wait for that day to come. But MCP absolutely
00:04:55.420 --> 00:04:57.899
on the actual product and for plugin agents in
00:04:57.899 --> 00:04:59.839
for customers that exist and being able to mine
00:04:59.839 --> 00:05:02.180
through security data and reach conclusions and
00:05:02.180 --> 00:05:05.980
thematic observations. 100 % from wait, wait.
00:05:06.139 --> 00:05:07.899
So wait, wait, it's the webs. I'm sorry. Now
00:05:07.899 --> 00:05:09.560
we got to dig in a little bit of this. I did
00:05:09.560 --> 00:05:12.220
look at it. I didn't click on stuff. You're click
00:05:12.220 --> 00:05:16.220
click. Tell me click click. Okay, I got two questions
00:05:16.220 --> 00:05:19.339
on that. One, is the website just your general
00:05:19.339 --> 00:05:21.779
website or is the actual product, the actual
00:05:21.779 --> 00:05:25.079
product site, the SaaS application site? Well,
00:05:25.180 --> 00:05:26.759
I mean, that's been cooking for a long time because
00:05:26.759 --> 00:05:28.819
we've been, you know, live in GA, but just quiet
00:05:28.819 --> 00:05:31.379
about it. So it's just a website. I will tell
00:05:31.379 --> 00:05:34.500
you that it's funny. It's a leap to have the
00:05:34.500 --> 00:05:36.579
public login link so that, you know, people can
00:05:36.579 --> 00:05:38.459
just run right into it because our existing customers
00:05:38.459 --> 00:05:40.160
knew where to get it and where to actually log
00:05:40.160 --> 00:05:43.839
in. So that bridge is new. Okay, so here's my
00:05:43.839 --> 00:05:47.899
question. If the internet is dead, why bother?
00:05:50.540 --> 00:05:53.279
Right? If it's all just bunch of freaking AI
00:05:53.279 --> 00:05:56.579
agents and slop and then why do we do this to
00:05:56.579 --> 00:05:58.600
ourselves? Who cares? Nobody looks at these things
00:05:58.600 --> 00:06:01.399
anymore. I mean, that's where the puck is moving
00:06:01.399 --> 00:06:04.800
for sure. It's not today. You know, no one is
00:06:04.800 --> 00:06:08.199
just Going into a prompt and saying like hey,
00:06:08.220 --> 00:06:10.620
this is identify my pain points and shop for
00:06:10.620 --> 00:06:13.779
and close a deal on a solution Yeah, well first
00:06:13.779 --> 00:06:15.879
of all, let's let's consider what the dead internet
00:06:15.879 --> 00:06:18.779
theory talks about the the basic premise is that
00:06:18.779 --> 00:06:21.579
Much of the content is AI generated and the most
00:06:21.579 --> 00:06:23.680
of the people the things that are responding
00:06:23.680 --> 00:06:27.500
are also AI agents as well So that's that's the
00:06:27.500 --> 00:06:30.360
dead internet theory and effectively my earlier
00:06:30.360 --> 00:06:32.680
suggestion that you may get AI engine optimized
00:06:32.680 --> 00:06:35.870
is kind of pointing to that right that you're
00:06:35.870 --> 00:06:39.790
going to have potentially more AI agents visiting
00:06:39.790 --> 00:06:44.430
your website than humans. So yeah, I mean, the
00:06:44.430 --> 00:06:47.629
internet is definitely active. It's dead in the
00:06:47.629 --> 00:06:50.050
sense that we may have fewer and fewer humans
00:06:50.050 --> 00:06:53.550
participating in it, but it's definitely one
00:06:53.550 --> 00:06:55.910
thing that you should consider as far as how
00:06:55.910 --> 00:06:59.509
to gear your website towards AI engines. The
00:06:59.509 --> 00:07:03.009
other thing I would also say is system record,
00:07:03.269 --> 00:07:10.610
that's so 2023. When What I I missed it I haven't
00:07:10.610 --> 00:07:14.110
heard about one in sex in Good go on to Neil.
00:07:14.329 --> 00:07:19.350
Yeah, so With what the industry sort of has moved
00:07:19.350 --> 00:07:22.470
towards is this notion of a system of context
00:07:22.470 --> 00:07:25.649
and The the perspective, you know, what is the
00:07:25.649 --> 00:07:27.689
system a record? Well system record is some sort
00:07:27.689 --> 00:07:33.160
of authoritative repository that stores things
00:07:33.160 --> 00:07:36.240
about your business and your assets and whatnot,
00:07:36.819 --> 00:07:40.439
right? A system of context is then an intelligence
00:07:40.439 --> 00:07:43.060
and orchestration layer that sits above those
00:07:43.060 --> 00:07:45.439
that really connects the different aspects of
00:07:45.439 --> 00:07:49.800
the business together. And companies like Salesforce
00:07:49.800 --> 00:07:52.459
and ServiceNow and those companies that have
00:07:52.459 --> 00:07:56.079
largely been a traditional system of record for
00:07:56.079 --> 00:07:59.339
the business, what has rapidly tried to move
00:07:59.339 --> 00:08:03.269
to this notion of a system of context because
00:08:03.269 --> 00:08:06.709
they see the AI motion happening and they still
00:08:06.709 --> 00:08:08.850
want to be relevant. And the only way for them
00:08:08.850 --> 00:08:12.850
to be relevant is to say, okay, you'll come to
00:08:12.850 --> 00:08:16.089
us just for the system or the records of your
00:08:16.089 --> 00:08:17.870
business, but if you really want to understand
00:08:17.870 --> 00:08:20.629
your business, this is where you come to. You
00:08:20.629 --> 00:08:23.769
know, those companies remind me of like Salesforce
00:08:23.769 --> 00:08:26.189
being relevant. It's just like Workday. You guys
00:08:26.189 --> 00:08:29.170
hear about Workday being acquired? Well, let
00:08:29.170 --> 00:08:32.009
me... Pick on both of those things together,
00:08:32.009 --> 00:08:35.710
right? So That's right. If the system a record
00:08:35.710 --> 00:08:37.450
let's do the finance because it's like boring.
00:08:37.450 --> 00:08:39.629
Yeah static, right? So the system a record is
00:08:39.629 --> 00:08:42.850
ERP and it's fairly essential and the context
00:08:42.850 --> 00:08:45.230
is let's say your financial statements or even
00:08:45.230 --> 00:08:47.730
your earnings call like what we're gonna talk
00:08:47.730 --> 00:08:50.769
about what's forward look so in order to have
00:08:50.769 --> 00:08:53.690
like an agentic process that's gonna mind getting
00:08:53.690 --> 00:08:56.659
gonna make some discussion points for the earnings
00:08:56.659 --> 00:08:59.220
call, areas that performed well, areas that are
00:08:59.220 --> 00:09:01.299
flagging, and then go beyond that and say, like,
00:09:01.299 --> 00:09:03.840
what are some of the trends? At a minimum, you
00:09:03.840 --> 00:09:07.379
need to have normalized, consistent, reliable,
00:09:07.700 --> 00:09:11.139
normalized data. So you need your GL, you need
00:09:11.139 --> 00:09:13.240
your journal entries, all that stuff, and then
00:09:13.240 --> 00:09:15.299
bubbling up, and ultimately you need all the
00:09:15.299 --> 00:09:17.720
financial statement data in there. That's the
00:09:17.720 --> 00:09:21.740
system of record. The question is, to me, and
00:09:24.269 --> 00:09:27.250
Nikesh Arora brought this up on a podcast recently
00:09:27.250 --> 00:09:29.230
and he was talking about the SaaSpocalypse and
00:09:29.230 --> 00:09:31.570
where it's going and that sort of thing. And
00:09:31.570 --> 00:09:34.690
the question is to mine that data and get insights.
00:09:34.750 --> 00:09:37.309
He was saying systems record are the only safe
00:09:37.309 --> 00:09:39.409
place because everyone's going to be pointing
00:09:39.409 --> 00:09:42.110
their low switching costs, new model, new tools
00:09:42.110 --> 00:09:45.669
every single day at the system of record. And
00:09:45.669 --> 00:09:49.129
the system of context to me sounds like, I don't
00:09:49.129 --> 00:09:50.870
know, kind of like it's mainly a semantic game,
00:09:51.029 --> 00:09:53.889
but for service now to be trying to say, But
00:09:53.889 --> 00:09:55.590
don't point your agents at our awesome system
00:09:55.590 --> 00:09:58.070
a record come to us and we have the agents for
00:09:58.070 --> 00:10:01.149
you right in the platform Nice try. I don't blame
00:10:01.149 --> 00:10:03.490
you because the margins are gonna be going out
00:10:03.490 --> 00:10:06.190
in system a record world I get that but I don't
00:10:06.190 --> 00:10:08.429
think it's gonna work. Like you tell all these
00:10:08.429 --> 00:10:09.809
people they're okay We want to use Claude like
00:10:09.809 --> 00:10:12.090
no, no, there's no need anymore Salesforce now
00:10:12.090 --> 00:10:14.789
has AI in it. I shut up get out of the way. I
00:10:14.789 --> 00:10:18.629
I'm working in here. So I think systems a record
00:10:18.629 --> 00:10:22.240
are More important than ever though Because if
00:10:22.240 --> 00:10:24.220
you were YOLO in it before and you didn't have
00:10:24.220 --> 00:10:26.940
an authoritative record over that almost near
00:10:26.940 --> 00:10:31.159
-miss attack from September of 2024, then what
00:10:31.159 --> 00:10:32.539
are you going to feed the AI when you're trying
00:10:32.539 --> 00:10:35.159
to draw trends? You see, you see, you see for
00:10:35.159 --> 00:10:37.259
the audience that there are some things that
00:10:37.259 --> 00:10:40.299
Jerry really is passionate about. System of records
00:10:40.299 --> 00:10:46.360
is not one of them. Well, I'm just trying to,
00:10:46.519 --> 00:10:50.000
if you want to have a AI engine optimized. website,
00:10:50.200 --> 00:10:52.139
then you probably want to talk about System of
00:10:52.139 --> 00:10:55.139
Contacts at least somewhere in there. Yeah, they
00:10:55.139 --> 00:10:58.480
were SEO more than anything. It sounds like note
00:10:58.480 --> 00:11:00.419
to self, we're going to add that into the metadata.
00:11:00.940 --> 00:11:03.580
Yeah. But let me challenge an earlier assertion
00:11:03.580 --> 00:11:07.059
that you made, which is I generally agree that
00:11:07.059 --> 00:11:09.700
system records are great if you have one and
00:11:09.700 --> 00:11:11.899
it's up to date and it's correct and blah, blah,
00:11:12.000 --> 00:11:14.379
blah, blah. But of course, we know much of that
00:11:14.379 --> 00:11:16.990
is That's not true, right? The business changes
00:11:16.990 --> 00:11:20.289
so quickly that your system of record is really,
00:11:20.590 --> 00:11:22.629
one, an older snapshot of your business, and
00:11:22.629 --> 00:11:25.769
two, a subset of that because new aspects of
00:11:25.769 --> 00:11:27.870
the business just aren't captured in your system
00:11:27.870 --> 00:11:33.049
of record. The whole notion of shadow IT and
00:11:33.049 --> 00:11:36.909
shadow AI is really part of that. Can you find
00:11:36.909 --> 00:11:39.750
all the latest AI tools that you're using in
00:11:39.750 --> 00:11:41.649
any system of record? And if the answer is no,
00:11:41.750 --> 00:11:45.230
then that's your shadow, whatever. So the challenge
00:11:45.230 --> 00:11:49.269
I think is for any organization that is trying
00:11:49.269 --> 00:11:54.789
to move at AI speed is how do you continue to
00:11:54.789 --> 00:11:58.230
adapt your system and record to make it as relevant
00:11:58.230 --> 00:12:00.470
and useful to the business as possible? And that
00:12:00.470 --> 00:12:02.990
is essentially this notion of a system of context.
00:12:04.169 --> 00:12:06.509
The system record, yes, I agree. So there's a
00:12:06.509 --> 00:12:08.509
foundation, it's like a foundational layer, but
00:12:08.509 --> 00:12:10.389
we also know that so many other things are being
00:12:10.389 --> 00:12:14.039
built around it, next to it. That's ignoring
00:12:14.039 --> 00:12:16.759
it and the system of context is really to try
00:12:16.759 --> 00:12:19.299
to supplement beyond that as well But I don't
00:12:19.299 --> 00:12:21.220
think it applies for everybody I think if you
00:12:21.220 --> 00:12:23.500
you talked about the rate of change and I'm just
00:12:23.500 --> 00:12:25.559
gonna call the rate of change in an organization
00:12:25.559 --> 00:12:27.759
But I think if you're if you if you're hosting
00:12:27.759 --> 00:12:30.379
you're out here your company in IBM cloud Oracle
00:12:30.379 --> 00:12:32.919
cloud You're not changing very much, dude. All
00:12:32.919 --> 00:12:35.799
right. Sorry Yeah, yeah, I like for traditional
00:12:35.799 --> 00:12:40.340
traditional ERP sure but two thoughts that come
00:12:40.340 --> 00:12:43.720
out of that like so one of the The conversations
00:12:43.720 --> 00:12:48.700
I have a lot is about CMDB, right? And so most
00:12:48.700 --> 00:12:51.679
of our audience knows that term. It's this mythical
00:12:51.679 --> 00:12:54.720
construct that supposedly companies have an inventory
00:12:54.720 --> 00:13:00.129
of computers. It's useful in security because
00:13:00.129 --> 00:13:02.450
when you see a host name you go to this inventory
00:13:02.450 --> 00:13:05.549
and it tells you context. So this is ideally
00:13:05.549 --> 00:13:07.710
is this internet facing is it used by a more
00:13:07.710 --> 00:13:09.750
important person or a less important person which
00:13:09.750 --> 00:13:11.450
are all fallacies but that's like it all goes
00:13:11.450 --> 00:13:15.230
hand in hand with the CMDB fallacy. So my take
00:13:15.230 --> 00:13:18.070
on that is and you use it in two places right
00:13:18.070 --> 00:13:20.509
risks and incidents. You use it in hey there's
00:13:20.509 --> 00:13:22.789
this risk detected and we want to enrich that
00:13:22.789 --> 00:13:26.519
record we want to know how risky is this. We
00:13:26.519 --> 00:13:28.080
want to get context It'll help us assess the
00:13:28.080 --> 00:13:30.480
likelihood and impact that manifesting and use
00:13:30.480 --> 00:13:32.320
it in incidents where hey we got a detection
00:13:32.320 --> 00:13:35.659
here Okay, where is that is it you have lateral
00:13:35.659 --> 00:13:37.480
capability to get to other systems and all of
00:13:37.480 --> 00:13:42.419
that in practice I have seen a Programmatic real
00:13:42.419 --> 00:13:45.639
seem to be very rarely used super effectively
00:13:45.639 --> 00:13:49.159
What I usually because inventory for the sake
00:13:49.159 --> 00:13:51.720
of the inventory is always stale like if you
00:13:51.720 --> 00:13:53.919
walk around with a clipboard and and okay where's
00:13:53.919 --> 00:13:57.120
the thing that's born out of terrible dairy you're
00:13:57.120 --> 00:14:00.700
terrible come on that's born of like hey we spent
00:14:00.700 --> 00:14:02.960
this money on capex and i want to make sure for
00:14:02.960 --> 00:14:05.179
our external auditors that we still own the assets
00:14:05.179 --> 00:14:06.899
and haven't stolen that's where that came from
00:14:06.899 --> 00:14:09.139
and that's not relevant at all in security where
00:14:09.139 --> 00:14:10.500
you're just trying to see something exists or
00:14:10.500 --> 00:14:14.259
not what i like is what i've been calling jit
00:14:14.259 --> 00:14:18.539
cmdb just in time cmdb which is What real practitioners
00:14:18.539 --> 00:14:20.679
do is they say, what's this host? What, what
00:14:20.679 --> 00:14:23.259
is this? What is this application? Forget host
00:14:23.259 --> 00:14:25.240
is like a structured format. Most things aren't
00:14:25.240 --> 00:14:28.200
what's this application I see here or even a
00:14:28.200 --> 00:14:30.720
fully qualified domain name. And what really
00:14:30.720 --> 00:14:33.460
good practitioners do is they go into Slack and
00:14:33.460 --> 00:14:35.320
they go into JIRA and they go into teams and
00:14:35.320 --> 00:14:37.039
they go into confluence and they go into email,
00:14:37.059 --> 00:14:40.299
e -discovery, whatever it is to figure out that
00:14:40.299 --> 00:14:42.659
last week, this app was deployed and it's really
00:14:42.659 --> 00:14:44.820
important to this business unit. That's what
00:14:44.820 --> 00:14:47.379
you have to really do. And to think you're going
00:14:47.379 --> 00:14:50.940
to proactively mine that, put it in a CMDB, there's
00:14:50.940 --> 00:14:53.559
no need. If nobody's asking, why are you trying
00:14:53.559 --> 00:14:56.080
to maintain a record? So I think the approach
00:14:56.080 --> 00:14:59.240
is it's agentic, but it's mining these different
00:14:59.240 --> 00:15:01.240
systems of record and not counting on them all
00:15:01.240 --> 00:15:03.259
being consistent and building the picture at
00:15:03.259 --> 00:15:07.639
the moment it matters. It was one of those, if
00:15:07.639 --> 00:15:09.860
you ever do a CMDB, I'm sure you guys have done
00:15:09.860 --> 00:15:14.799
it. I did it before and I found it to be more
00:15:14.799 --> 00:15:18.330
pain. More mm -hmm. It's just you know, it's
00:15:18.330 --> 00:15:23.149
almost done It's like a demigod that you have
00:15:23.149 --> 00:15:26.529
to go and worship and donate stuff and donate
00:15:26.529 --> 00:15:28.710
your time But it never gives you any love back.
00:15:28.850 --> 00:15:32.370
Okay, this is fake like fake. Thank you. Yeah
00:15:32.370 --> 00:15:35.370
So so you mentioned finance and let me let me
00:15:35.370 --> 00:15:40.179
use a financial analogy for a moment if for If
00:15:40.179 --> 00:15:41.639
you want to really understand the health of a
00:15:41.639 --> 00:15:43.279
business, you look at a couple things. You look
00:15:43.279 --> 00:15:45.620
at a balance sheet, you look at your income statement,
00:15:45.740 --> 00:15:51.059
you look at your cash flow. And they reflect
00:15:51.059 --> 00:15:53.100
some aspects of what we're talking about. A balance
00:15:53.100 --> 00:15:54.879
sheet is sort of like your inventory. Here's
00:15:54.879 --> 00:15:58.039
the assets and liabilities that we have. But
00:15:58.039 --> 00:16:00.940
the reality is you don't actually need a balance
00:16:00.940 --> 00:16:05.519
sheet. You can reconstruct a balance sheet based
00:16:05.519 --> 00:16:10.460
on... System or record? Well, you can reconstruct
00:16:10.460 --> 00:16:12.159
it based on your income statement, your cash
00:16:12.159 --> 00:16:15.440
flow. The balance sheet gives you sort of like
00:16:15.440 --> 00:16:19.379
a point in time sort of view, but really the
00:16:19.379 --> 00:16:22.080
income statement and the cash flow tell you how
00:16:22.080 --> 00:16:24.299
your money's being deployed, how it's being used.
00:16:24.740 --> 00:16:26.820
And that's actually far more, I mean, to me,
00:16:26.980 --> 00:16:29.340
it's a bit more valuable in understanding those
00:16:29.340 --> 00:16:31.039
two particular pieces, because that gives you
00:16:31.039 --> 00:16:34.419
a better understanding of the financial performance
00:16:34.419 --> 00:16:39.639
over a period of time. To use the financial analogy
00:16:39.639 --> 00:16:42.519
here and then tie that back into a system of
00:16:42.519 --> 00:16:44.580
record or system of context, a system of record
00:16:44.580 --> 00:16:46.179
to me is just a balance sheet saying, here's
00:16:46.179 --> 00:16:49.620
what you have. But a system of context is, how
00:16:49.620 --> 00:16:52.059
are you using these assets? What's happening
00:16:52.059 --> 00:16:54.919
with these assets? Are you actually using your
00:16:54.919 --> 00:16:57.059
investments and the money in an effective way
00:16:57.059 --> 00:17:00.639
that produces business, that's increasing your
00:17:00.639 --> 00:17:03.440
marginal value and such? And so that's the way
00:17:03.440 --> 00:17:07.279
I would think about it. Each of them have its
00:17:07.279 --> 00:17:09.440
purpose in understanding the health of a business,
00:17:10.039 --> 00:17:11.940
but the income statement and the cash flow. In
00:17:11.940 --> 00:17:14.619
other words, how you're actually using your assets
00:17:14.619 --> 00:17:16.900
is far more valuable than just saying, here's
00:17:16.900 --> 00:17:21.259
your list of assets. Yeah, I disagree with that
00:17:21.259 --> 00:17:23.839
in that, for one, I think the big three, those
00:17:23.839 --> 00:17:25.180
are the big three you mentioned, right? Like
00:17:25.180 --> 00:17:29.059
business school style. There's no direct derivative
00:17:29.059 --> 00:17:32.259
work among the three. I don't think you can reconstruct
00:17:32.259 --> 00:17:36.089
a proper. One from just the data and the other
00:17:36.089 --> 00:17:38.970
two but I would say that they're all built upon
00:17:38.970 --> 00:17:42.289
the system of record That is a ledger the transactional
00:17:42.289 --> 00:17:45.230
ledger think of a bank statement wire went out
00:17:45.230 --> 00:17:48.069
this counterparty for this amount Transfer from
00:17:48.069 --> 00:17:50.470
this account to that account You know, that's
00:17:50.470 --> 00:17:53.170
the to me the system of record and it's boring
00:17:53.170 --> 00:17:55.869
as hell But it's just transactions and it's truth
00:17:55.869 --> 00:17:59.789
and then the big three are the first Work that
00:17:59.789 --> 00:18:01.769
is contextual like I think all three of them
00:18:01.769 --> 00:18:03.529
are contextual and they're built off of that
00:18:03.529 --> 00:18:06.789
underlying data But in cybersecurity, we don't
00:18:06.789 --> 00:18:10.029
even have the ledger of transactions I mean listeners
00:18:10.029 --> 00:18:13.269
just you know, think about an incident that happened
00:18:13.269 --> 00:18:15.730
that wasn't the end of the world But maybe you
00:18:15.730 --> 00:18:17.970
had thought about giving the CFO a heads up in
00:18:17.970 --> 00:18:19.589
case they heard about it from someone else and
00:18:19.589 --> 00:18:21.849
you didn't quite whatever What's the unique ID
00:18:21.849 --> 00:18:25.990
for that? And where is it? I think that's a Table
00:18:25.990 --> 00:18:28.490
stakes question that there has to be and if the
00:18:28.490 --> 00:18:29.910
stanceable we don't like to write stuff down
00:18:29.910 --> 00:18:32.109
because then people can find out that is not
00:18:32.109 --> 00:18:35.930
a strategy so That's where i'm saying like we
00:18:35.930 --> 00:18:38.650
need to get religion about this and become where
00:18:38.650 --> 00:18:40.730
do you think it actually helped though? I mean
00:18:40.730 --> 00:18:43.809
this whole thing came out i'm sure from an auditor's
00:18:43.809 --> 00:18:46.089
point of view and says Why don't we do this in
00:18:46.089 --> 00:18:48.430
security? But okay, let's give it a benefit of
00:18:48.430 --> 00:18:51.170
the doubt jerry. Let's play contrary Yeah, yeah
00:18:51.170 --> 00:18:54.289
straw man it Well a couple of things one during
00:18:54.289 --> 00:18:56.769
mna Right? When you go in and you're doing due
00:18:56.769 --> 00:18:58.970
diligence on potential acquisition, you ask all
00:18:58.970 --> 00:19:00.589
these ridiculous questions and you get all the
00:19:00.589 --> 00:19:02.690
smoke and mirrors. I want to know about all the
00:19:02.690 --> 00:19:04.809
rest and all the incidents with unique identifiers
00:19:04.809 --> 00:19:06.789
and where they are to happen. So it absolutely
00:19:06.789 --> 00:19:09.490
compresses and raises the efficacy in M &A reference.
00:19:10.089 --> 00:19:12.309
And then second, and especially now in the MCP
00:19:12.309 --> 00:19:15.029
day, if you want to be able to say like, what
00:19:15.029 --> 00:19:17.630
are our top policies that have been being violated
00:19:17.630 --> 00:19:20.269
or which are unrealistic policy we don't really
00:19:20.269 --> 00:19:23.250
do. Or what is the number one control change
00:19:23.250 --> 00:19:25.910
that would have the most impact on incidents?
00:19:26.710 --> 00:19:28.910
You mine the ledger, right? And you play back,
00:19:29.029 --> 00:19:31.150
you do a regression test. What if we blocked
00:19:31.150 --> 00:19:34.269
egress to FQDNs in countries where we don't operate?
00:19:34.490 --> 00:19:37.069
You can actually go through the data and say,
00:19:37.069 --> 00:19:40.730
oh, we would have dropped incidents by 43%. Impossible
00:19:40.730 --> 00:19:43.690
without the system record. Let people run with
00:19:43.690 --> 00:19:45.690
the context. We're in the AI age. People will
00:19:45.690 --> 00:19:47.309
come up with their own reports and views and
00:19:47.309 --> 00:19:49.789
all of that. But they need some freaking data.
00:19:51.370 --> 00:19:54.529
I think. Alright, before I get off of it, because
00:19:54.529 --> 00:19:55.950
I had a little placeholder, but you mentioned
00:19:55.950 --> 00:19:59.369
this about optimizing for AI agents. While we
00:19:59.369 --> 00:20:03.269
were talking about that. Cloudflare. Right today,
00:20:03.269 --> 00:20:05.549
you know, I was saying that we went through that
00:20:05.549 --> 00:20:07.490
and I just remember what it was. It's we see
00:20:07.490 --> 00:20:10.089
Cloudflare CCDN just like a big chunk of the
00:20:10.089 --> 00:20:13.250
world and. One of the things that I would say
00:20:13.250 --> 00:20:14.970
quietly, but for the right audience is probably
00:20:14.970 --> 00:20:17.390
noisy, but they were just talking about. There's
00:20:17.390 --> 00:20:19.809
a tick box you could just turn on right now that
00:20:19.809 --> 00:20:23.339
will generate. Markdown files for agents. So
00:20:23.339 --> 00:20:25.079
like what you're talking about agent optimization
00:20:25.079 --> 00:20:28.539
of the site That's just debating whether or not
00:20:28.539 --> 00:20:31.319
to turn that tick box on wait, wait Wait a little
00:20:31.319 --> 00:20:33.859
bit more about this. Whoa. Whoa. Whoa. So I mean
00:20:33.859 --> 00:20:37.759
what's cool is a CDN cloudflare tube I mean all
00:20:37.759 --> 00:20:39.640
of them in theory are so well positioned to do
00:20:39.640 --> 00:20:42.470
some really unique things So a dumber example
00:20:42.470 --> 00:20:44.849
would be images. And when the web P format came
00:20:44.849 --> 00:20:47.029
out, like you could turn on a tick box and cloud
00:20:47.029 --> 00:20:49.569
flare and you could have some big fat PNGs and
00:20:49.569 --> 00:20:51.589
JPEGs and everything else on the site. But by
00:20:51.589 --> 00:20:54.289
the time the, the, the render layer came in,
00:20:54.569 --> 00:20:56.390
it would just serve them off of the edge. These
00:20:56.390 --> 00:20:59.289
web P optimized images. You could have it obfuscate
00:20:59.289 --> 00:21:01.089
email addresses, right? You had put it in a fricking
00:21:01.089 --> 00:21:02.309
site. You have these email addresses are going
00:21:02.309 --> 00:21:04.960
to get scraped. They could change it and escape
00:21:04.960 --> 00:21:06.420
it and make it really hard for someone to scrape
00:21:06.420 --> 00:21:09.220
email addresses. And likewise, when agents come
00:21:09.220 --> 00:21:12.420
in, they can dynamically build markdown files
00:21:12.420 --> 00:21:14.720
that are basically like metadata. You can almost
00:21:14.720 --> 00:21:17.640
think of it as perfectly structured so that it
00:21:17.640 --> 00:21:19.980
will feed into an agent without all of the images,
00:21:20.039 --> 00:21:22.519
without all of the noise, cut down bandwidth
00:21:22.519 --> 00:21:25.480
massively, improve speed, and tell the agents
00:21:25.480 --> 00:21:27.079
the things that are optimized for what their
00:21:27.079 --> 00:21:30.779
queries are likely to be. And you just turn it
00:21:30.779 --> 00:21:34.490
on and, uh, Markdown for agents is what it's
00:21:34.490 --> 00:21:38.089
called, and it converts HTML into Markdown on
00:21:38.089 --> 00:21:40.829
the fly when it knows that the user agent is
00:21:40.829 --> 00:21:43.430
an agent. Yeah, user agent's an agent. Actually,
00:21:43.609 --> 00:21:46.730
that reminded me of another conversation I had
00:21:46.730 --> 00:21:49.710
with a guy named Caleb Quern. I forget where
00:21:49.710 --> 00:21:53.250
he's from, but he talked about a light version
00:21:53.250 --> 00:21:56.009
of the internet in the case when we have bandwidth
00:21:56.009 --> 00:22:00.680
issues or an attack scenario. And he talked about
00:22:00.680 --> 00:22:04.220
this. And basically, Wall Street Journal news
00:22:04.220 --> 00:22:06.380
agencies, they have a light version of their
00:22:06.380 --> 00:22:10.240
website, which I would prefer to visit actually,
00:22:10.380 --> 00:22:12.259
personally, just because - I remember this during
00:22:12.259 --> 00:22:14.799
the pandemic with CNN, they had that. Yeah, yeah.
00:22:15.339 --> 00:22:19.579
And anyway, it just struck me that Cloudflare
00:22:19.579 --> 00:22:22.400
can actually, or rather, by designing websites
00:22:22.400 --> 00:22:24.740
for agents with Markdown, we're actually addressing
00:22:24.740 --> 00:22:28.450
- The problem that Caleb corn was bringing up
00:22:28.450 --> 00:22:31.150
which is exactly this Can we come up with a light
00:22:31.150 --> 00:22:33.349
version of the internet in the case when we have
00:22:33.349 --> 00:22:37.069
very little bandwidth for whatever reason? Anyway,
00:22:37.089 --> 00:22:39.690
I need to make sure he he knows about that too.
00:22:39.910 --> 00:22:42.950
I do go back to the cloudflare example, though
00:22:42.950 --> 00:22:45.609
I remember so it's like a it's a two different
00:22:45.609 --> 00:22:49.210
types of toggles I guess one is I want to monetize
00:22:49.210 --> 00:22:52.670
any AI that's scraping my website That was a
00:22:52.670 --> 00:22:56.130
feature that Craig cloudflare rolled out a couple
00:22:56.130 --> 00:22:58.549
months ago. And then this is quite the opposite,
00:22:58.730 --> 00:23:02.609
which is I want an AI system to scrape my website,
00:23:02.789 --> 00:23:04.730
and I want to make it as easy as possible for
00:23:04.730 --> 00:23:05.789
them to do so. And that's what we're talking
00:23:05.789 --> 00:23:11.670
about. How do you monetize the former Sunil?
00:23:11.670 --> 00:23:13.329
I don't understand how you make money out of
00:23:13.329 --> 00:23:16.190
that. I don't think it was necessarily clear.
00:23:16.430 --> 00:23:20.450
It was more so Cloudflare proposed a model to
00:23:20.450 --> 00:23:23.240
do something like this where you... turn on the
00:23:23.240 --> 00:23:26.220
ability for scrapers to visit your website. But
00:23:26.220 --> 00:23:30.220
in doing so, the scrapers have to pay some fee
00:23:30.220 --> 00:23:33.440
to Cloudflare, which then trickles down to the
00:23:33.440 --> 00:23:36.339
content providers. Interesting. Yeah, it's pretty
00:23:36.339 --> 00:23:38.480
cool. I mean, the alternative to that is that
00:23:38.480 --> 00:23:40.720
they jam ads in dynamically or anything like
00:23:40.720 --> 00:23:42.200
that, which I'm so scared that they're going
00:23:42.200 --> 00:23:47.170
to start going down that road. I'm gonna I'm
00:23:47.170 --> 00:23:49.329
gonna add game time it on the on the run a show
00:23:49.329 --> 00:23:51.529
here for a minute because you brought up something
00:23:51.529 --> 00:23:54.390
right there about the the low bandwidth page
00:23:54.390 --> 00:23:55.789
during time of crisis and all that and it made
00:23:55.789 --> 00:23:57.609
me think about One of the stories we were gonna
00:23:57.609 --> 00:23:59.190
talk about later in the show, which was Taiwan
00:23:59.190 --> 00:24:02.730
And they've been doing some drills to say what
00:24:02.730 --> 00:24:05.650
if internet is all cut off I mean who could how
00:24:05.650 --> 00:24:07.589
could such a thing possibly ever happen to Taiwan?
00:24:07.910 --> 00:24:11.650
Well, we know the answer to that one I love the
00:24:11.650 --> 00:24:16.059
idea of exercising. I mean in any adversarial
00:24:16.059 --> 00:24:18.019
control, whether it's physical or cyber or anything
00:24:18.019 --> 00:24:21.960
like that. Have you seen the private sector doing
00:24:21.960 --> 00:24:26.099
stuff like that? Can you? It's how aggressive
00:24:26.099 --> 00:24:28.079
is this that Taiwan is even doing? Have you heard
00:24:28.079 --> 00:24:30.180
of any other countries trying? Well, actually,
00:24:30.200 --> 00:24:33.700
we've tried to do that in the US around disconnect
00:24:33.700 --> 00:24:36.640
scenarios and disconnect, reconnect scenarios.
00:24:36.779 --> 00:24:40.000
So even what I mentioned with Caleb Corn, Corn
00:24:40.000 --> 00:24:46.200
is spelled Q. I can't spell his name. Q. It's
00:24:46.200 --> 00:24:51.559
like Q you er and I guess anyway But he's been
00:24:51.559 --> 00:24:53.480
promoting and in fact, I think he even had a
00:24:53.480 --> 00:24:57.339
talk at DEF CON about this, too Anyway, whatever
00:24:57.339 --> 00:25:01.920
Q EE RN Queen. Yes. Okay. There you go. And I
00:25:01.920 --> 00:25:04.319
saw it at a conference called critical effect
00:25:04.319 --> 00:25:07.740
Where we were talking about this exact type of
00:25:07.740 --> 00:25:11.200
scenario in the event of a Chinese attack against
00:25:11.200 --> 00:25:14.970
Taiwan. We should expect degraded communications,
00:25:15.509 --> 00:25:19.910
and we need to exercise such scenarios. So that's
00:25:19.910 --> 00:25:22.650
been discussed. How far we've taken that scenario
00:25:22.650 --> 00:25:27.250
is debatable across different organizations and
00:25:27.250 --> 00:25:30.049
industries. But the whole notion of how do we
00:25:30.049 --> 00:25:33.349
deal with disconnect, disconnect, reconnect scenarios
00:25:33.349 --> 00:25:37.170
is something that is actively discussed in the
00:25:37.170 --> 00:25:40.150
context of operational resiliency. And I'm actually
00:25:40.150 --> 00:25:42.789
on a board of a group called the Global Resilience
00:25:42.789 --> 00:25:46.250
Federation where we are trying to push manufacturers
00:25:46.250 --> 00:25:50.490
and many other entities towards doing this as
00:25:50.490 --> 00:25:53.309
a tabletop. Are we going analog again, guys?
00:25:55.270 --> 00:25:58.710
Well, that's what we're trying to find out. It's
00:25:58.710 --> 00:26:00.910
good, but I think tabletop isn't enough. Like
00:26:00.910 --> 00:26:02.650
there was this, um, there's still a reconnect
00:26:02.650 --> 00:26:05.190
exercise going on by the futures industry association
00:26:05.190 --> 00:26:06.730
that we used to do and they would call it the
00:26:06.730 --> 00:26:09.390
ping test because it started in the days where
00:26:09.390 --> 00:26:11.730
you would have to, in order to fail over to an
00:26:11.730 --> 00:26:13.750
exchange, you'd have to go to the backup site
00:26:13.750 --> 00:26:16.269
and people would say like, here's the IP addresses,
00:26:16.549 --> 00:26:18.349
change all your config files and go to that.
00:26:18.829 --> 00:26:21.440
And so the idea was during the ping test, People
00:26:21.440 --> 00:26:23.720
would test connectivity to the disaster recovery
00:26:23.720 --> 00:26:25.859
sites. It wasn't literally just paying they would
00:26:25.859 --> 00:26:28.319
submit an order there was a little book and you
00:26:28.319 --> 00:26:29.880
know during the day they'd walk through it and
00:26:29.880 --> 00:26:32.859
everybody get together and what was good about
00:26:32.859 --> 00:26:36.480
it was that it was You know real what we learned
00:26:36.480 --> 00:26:38.079
pretty quickly was what we actually need to do
00:26:38.079 --> 00:26:40.059
is run production out of the disaster recovery
00:26:40.059 --> 00:26:42.940
site and I think that's what's going on here
00:26:42.940 --> 00:26:44.500
like and by the end in the financial services
00:26:44.500 --> 00:26:47.980
world and the reconnect tests and We did a lot
00:26:47.980 --> 00:26:49.720
of like, when would you be willing to reconnect
00:26:49.720 --> 00:26:51.539
to Swift? And the cyber people would all go,
00:26:51.619 --> 00:26:53.539
well, I'd need to do that. And then in real life,
00:26:53.640 --> 00:26:55.119
the financial people would kick them out of the
00:26:55.119 --> 00:26:57.460
room and lock the doors and continue using Swift
00:26:57.460 --> 00:27:00.859
immediately. But you need live fire. And that's
00:27:00.859 --> 00:27:03.480
what Taiwan is doing. And for whatever we've
00:27:03.480 --> 00:27:06.400
done in the United States, I never got an amber
00:27:06.400 --> 00:27:09.380
alert type thing on my phone saying, sorry, Internet's
00:27:09.380 --> 00:27:10.700
going to be really slow for the next three hours.
00:27:10.819 --> 00:27:13.559
We're doing a test. And my wife couldn't get
00:27:13.559 --> 00:27:15.730
in touch with me. And until that happens, We
00:27:15.730 --> 00:27:18.490
haven't tested anything. Right? I mean, that's
00:27:18.490 --> 00:27:21.349
true for companies too, until it hurts. I think
00:27:21.349 --> 00:27:24.029
it's cool that Taiwan can get away with this
00:27:24.029 --> 00:27:27.829
at a nation level. I don't think walmart .com
00:27:27.829 --> 00:27:29.670
could. I don't know that they really need to,
00:27:29.789 --> 00:27:32.509
but like from a commercial standpoint. Yeah.
00:27:33.069 --> 00:27:35.750
So there are things that we also need to be mindful
00:27:35.750 --> 00:27:40.250
of that where we essentially have no more excess
00:27:40.250 --> 00:27:44.450
capacity, especially on the human level. And
00:27:44.450 --> 00:27:48.009
we've seen this, unfortunately, manifest in not
00:27:48.009 --> 00:27:49.170
so great ways. What do you mean by that? Explain
00:27:49.170 --> 00:27:51.589
that. Yeah. What is that, Sunil? So let's take
00:27:51.589 --> 00:27:54.609
a hospital. You have a hospital, and it relies
00:27:54.609 --> 00:27:58.190
on a series of IT systems to, let's say, monitor
00:27:58.190 --> 00:28:03.849
the status of babies in an ICU. Back before all
00:28:03.849 --> 00:28:06.809
these systems were in place, you'd have, I'm
00:28:06.809 --> 00:28:09.589
partly making this up, so. this, some of these
00:28:09.589 --> 00:28:11.289
numbers and ratios, because I don't know the
00:28:11.289 --> 00:28:13.029
exact ones, but let's suppose it used to be one
00:28:13.029 --> 00:28:15.049
to one. So you'd have one nurse for every baby.
00:28:15.329 --> 00:28:17.190
And so you'd have, I don't know, you know, 20
00:28:17.190 --> 00:28:20.130
nurses and your capacity was 20 babies, right?
00:28:20.569 --> 00:28:22.710
Then you had these monitoring systems put in
00:28:22.710 --> 00:28:26.069
place that help you reduce that ratio for, you
00:28:26.069 --> 00:28:28.630
know, to five babies per nurse. And then there's
00:28:28.630 --> 00:28:30.430
better monitoring systems. So now you can do
00:28:30.519 --> 00:28:33.420
One nurse for 20 babies. Okay. So there aren't
00:28:33.420 --> 00:28:35.700
20, there aren't 19 more nurses anymore. There's
00:28:35.700 --> 00:28:37.700
only one nurse and maybe two nurses, you know,
00:28:37.759 --> 00:28:40.599
three nurses as backups for one another. Uh,
00:28:40.640 --> 00:28:45.259
but if the systems go down, then massive overwhelm
00:28:45.259 --> 00:28:47.859
and, and some babies will die. In fact, that's
00:28:47.859 --> 00:28:50.640
exactly what happened during some of the, some
00:28:50.640 --> 00:28:53.660
of these recent attacks where you have excess
00:28:53.660 --> 00:28:57.140
mortality. The data points show to excess mortality
00:28:57.140 --> 00:29:02.440
because It's hard to, there's not, people are
00:29:02.440 --> 00:29:04.079
concerned about direct linkage or ransomware
00:29:04.079 --> 00:29:07.420
to patient deaths, but there's a pretty strong
00:29:07.420 --> 00:29:11.200
connection there between patient deaths and the
00:29:11.200 --> 00:29:15.079
ability for these nurses to keep their patients
00:29:15.079 --> 00:29:18.660
ratios, the ratios, you know, proper. Yep. And
00:29:18.660 --> 00:29:21.680
it sounds like a freaking episode on that HBO
00:29:21.680 --> 00:29:26.039
series about hospital, like being at the emergency.
00:29:27.079 --> 00:29:30.160
Place where like the entire unit went off for
00:29:30.160 --> 00:29:32.839
this hospital because there was a they were under
00:29:32.839 --> 00:29:35.140
attack or something like that and they had to
00:29:35.140 --> 00:29:38.740
bring even Nurses who were there before they
00:29:38.740 --> 00:29:40.440
had computers because they were the only ones
00:29:40.440 --> 00:29:44.440
you could work without computers I I just want
00:29:44.440 --> 00:29:46.240
to say if I'm ever explaining that our podcast
00:29:46.240 --> 00:29:47.920
is someone and the roles of the different people
00:29:47.920 --> 00:29:49.519
I'll say Sunil is the guy who can get away with
00:29:49.519 --> 00:29:54.119
saying excess mortality That sums up city else
00:29:54.119 --> 00:29:59.420
roll on the podcast Doctor death so I look on
00:29:59.420 --> 00:30:00.900
the Taiwan thing if you think about it to with
00:30:00.900 --> 00:30:03.019
Iran this happened as a matter of fact I remember
00:30:03.019 --> 00:30:06.920
being a little bit confused during the the initial
00:30:06.920 --> 00:30:11.039
you know US action in Iran the headlines were
00:30:11.039 --> 00:30:13.599
internet access completely cut off in Iran and
00:30:13.599 --> 00:30:15.519
what the implication was that the United States
00:30:15.519 --> 00:30:19.700
had cut that off and but you know for 20 years
00:30:19.700 --> 00:30:22.210
leading up to that point it was The Iranian regime
00:30:22.210 --> 00:30:24.309
is cutting off internet access from all of its
00:30:24.309 --> 00:30:26.609
citizens and keeping them from communicating
00:30:26.609 --> 00:30:28.509
the outside world. So I kind of thought the last
00:30:28.509 --> 00:30:29.990
thing that we would do as the United States we
00:30:29.990 --> 00:30:31.930
went in was like help them out and cut off even
00:30:31.930 --> 00:30:33.890
more access. Thought if anything we'd be dropping
00:30:33.890 --> 00:30:36.170
in star links and stuff, which did happen later
00:30:36.170 --> 00:30:39.250
on. But I imagine Taiwan is taking a little bit
00:30:39.250 --> 00:30:44.650
out of that playbook saying, OK, that's the first
00:30:44.650 --> 00:30:46.910
thing that's going to happen. Think it's great
00:30:46.910 --> 00:30:49.049
that they're exercising that I think they're
00:30:49.049 --> 00:30:50.450
supposed to be doing another one right now as
00:30:50.450 --> 00:30:52.809
we're recording And it'll be good to get some
00:30:52.809 --> 00:30:55.730
readouts on that Yeah, maybe they're gonna have
00:30:55.730 --> 00:30:57.490
to do some personnel changes on the back of that
00:30:57.490 --> 00:30:59.029
Maybe they're gonna learn like oh here's some
00:30:59.029 --> 00:31:02.250
critical areas where we need to be bloated during
00:31:02.250 --> 00:31:06.170
normal operation because during crisis There's
00:31:06.170 --> 00:31:11.170
gonna be excess mortality Simulations you think
00:31:11.170 --> 00:31:15.490
all these exercises that we do actually in reality
00:31:15.640 --> 00:31:19.240
Actually pan out they actually were because you
00:31:19.240 --> 00:31:21.119
reminded me I just finished reading a book called
00:31:21.119 --> 00:31:24.059
the guns the guns of August have you guys ever
00:31:24.059 --> 00:31:40.200
heard For World War one and so the whole idea
00:31:40.200 --> 00:31:43.400
was Germany had this plan that they were going
00:31:43.400 --> 00:31:46.519
to win the war in six weeks And they had planned
00:31:46.519 --> 00:31:49.460
out just about everything. The German military
00:31:49.460 --> 00:31:53.039
just had planned out everything of what, what
00:31:53.039 --> 00:31:57.640
if scenarios, but guess what? It wasn't enough.
00:31:57.980 --> 00:32:00.680
There was enough chaos and randomness in the
00:32:00.680 --> 00:32:04.619
system that eventually there were some burps,
00:32:04.859 --> 00:32:08.319
messed ups that it turned out not from six weeks,
00:32:08.460 --> 00:32:12.779
but more four years. Well, to quote Eisenhower,
00:32:12.920 --> 00:32:15.450
I think it's Eisenhower, plans are useless. planning
00:32:15.450 --> 00:32:18.690
is essential. So I think the basic premise here
00:32:18.690 --> 00:32:22.910
is that the activity of planning and readjusting
00:32:22.910 --> 00:32:26.470
your plans is what's essential here. The analogy
00:32:26.470 --> 00:32:29.089
I oftentimes give, and this is especially appropriate
00:32:29.089 --> 00:32:32.970
for startups, is whatever startup plan that you
00:32:32.970 --> 00:32:36.329
proposed, I'm sure it's changed many times over.
00:32:37.990 --> 00:32:40.390
You've heard me say we are all high velocity
00:32:40.390 --> 00:32:43.519
engineering organizations. engineering in that
00:32:43.519 --> 00:32:47.240
we're constantly tweaking, problem solving, trying
00:32:47.240 --> 00:32:48.920
to figure out how to apply the technologies we
00:32:48.920 --> 00:32:51.079
have towards a certain problem, but also high
00:32:51.079 --> 00:32:53.619
velocity in that we're changing whatever those
00:32:53.619 --> 00:32:57.680
plans are on a constant basis as we hit reality,
00:32:57.960 --> 00:33:02.720
right? And so we have to have a plan, but it's
00:33:02.720 --> 00:33:04.319
not about the plan, it's about the planning.
00:33:04.940 --> 00:33:07.200
And the planning is essentially what's the most
00:33:07.200 --> 00:33:09.619
important aspect of it. The exercise itself,
00:33:10.099 --> 00:33:12.289
we oftentimes, I've run a number of tabletop
00:33:12.289 --> 00:33:14.609
scenarios when I was over at Booz Allen. And
00:33:14.609 --> 00:33:17.549
we told the participants, look, don't fight the
00:33:17.549 --> 00:33:22.809
scenario. The scenario is whatever, right? And
00:33:22.809 --> 00:33:25.650
much of it can be fantastical in some nature.
00:33:26.710 --> 00:33:28.710
But what was really important was the fact that
00:33:28.710 --> 00:33:31.289
you're here together in this room, figuring out
00:33:31.289 --> 00:33:35.569
how to collaborate, how to get past a particular
00:33:35.569 --> 00:33:38.650
problem. Because those muscles that you're exercising
00:33:38.650 --> 00:33:40.450
right there are the muscles that you're going
00:33:40.450 --> 00:33:42.589
to exercise when some new scenario comes up that
00:33:42.589 --> 00:33:46.309
you'd never planned for. Yeah, absolutely. Likewise.
00:33:46.930 --> 00:33:51.089
Well, while talking about Taiwan, another story
00:33:51.089 --> 00:33:52.809
of the week that was pretty big, right? So right
00:33:52.809 --> 00:33:57.009
off the heels of the headlines around the capabilities
00:33:57.009 --> 00:34:00.710
of frontier models without guard rails and how
00:34:00.710 --> 00:34:03.609
it was exemplified in breakouts from OpenAI.
00:34:04.649 --> 00:34:06.930
and the hugging face attack and that sort of
00:34:06.930 --> 00:34:12.289
thing. That just catalyzed a real like wave of
00:34:12.289 --> 00:34:14.389
stories about, oh yeah, mine too, mine too, my
00:34:14.389 --> 00:34:19.070
agents are breaking out too. And on the, to me
00:34:19.070 --> 00:34:21.090
the main story, the headline there should have
00:34:21.090 --> 00:34:24.489
been, wow, you know, an agentic attack can be
00:34:24.489 --> 00:34:26.250
very capable in the hands of the wrong person.
00:34:26.849 --> 00:34:29.250
So one story was coming out about Taiwan and
00:34:29.250 --> 00:34:32.090
saying that, A company was saying that they found
00:34:32.090 --> 00:34:35.389
evidence that there was a massive attack in July
00:34:35.389 --> 00:34:40.630
from Chinese language actors against a Asia area
00:34:40.630 --> 00:34:44.570
nation. And that they found, and they started
00:34:44.570 --> 00:34:46.849
rattling off some numbers here about how it was
00:34:46.849 --> 00:34:49.949
able to succeed and go through. And that like
00:34:49.949 --> 00:34:52.349
came out as the next headline of, oh man, it's
00:34:52.349 --> 00:34:54.590
happening. It's real. It's not just the hugging
00:34:54.590 --> 00:34:56.829
face scenario. Now we actually see it going on.
00:34:57.409 --> 00:35:00.670
I don't think that story is holding up to scrutiny
00:35:00.670 --> 00:35:04.969
in that the, for one, it's put out by a company
00:35:04.969 --> 00:35:08.030
that kind of has a conflict of interest and people
00:35:08.030 --> 00:35:10.949
getting excited about AI based attacks. And then
00:35:10.949 --> 00:35:12.590
secondly, they're basically saying they stumbled
00:35:12.590 --> 00:35:14.949
across a trove of information that was like agent
00:35:14.949 --> 00:35:18.230
logs of what it did and took it at face value.
00:35:20.110 --> 00:35:22.250
A lot of stuff to take away from that one. It's
00:35:22.250 --> 00:35:24.449
always been hard to fight disinformation in cybersecurity.
00:35:24.829 --> 00:35:26.869
Is it going to be even more of an issue, and
00:35:26.869 --> 00:35:29.210
especially as agents are documenting their own
00:35:29.210 --> 00:35:32.570
exploits and sensationalizing them? OK, so there
00:35:32.570 --> 00:35:36.289
are a couple of things that bother me about this.
00:35:36.510 --> 00:35:38.389
And the least of my concerns is actually the
00:35:38.389 --> 00:35:42.489
marketing part of it. There's an Israeli startup
00:35:42.489 --> 00:35:45.750
that's trying to market their stuff, and they'll
00:35:45.750 --> 00:35:48.409
do what they need to do. What bothers me perhaps
00:35:48.409 --> 00:35:53.349
more than any of this is This agentic attack
00:35:53.349 --> 00:35:58.210
activity is happening Much more broadly than
00:35:58.210 --> 00:36:01.449
what then we realize and we don't hear many signals
00:36:01.449 --> 00:36:04.190
about it Except maybe one out of every I don't
00:36:04.190 --> 00:36:08.449
know 20 companies or so. Okay, maybe I'm estimating
00:36:08.449 --> 00:36:12.250
here if you go back to the open AI Incident with
00:36:12.250 --> 00:36:14.809
hugging face how many companies were attacked
00:36:14.809 --> 00:36:18.329
not just by open AI but also by anthropic by
00:36:18.329 --> 00:36:22.300
Gemini by Chinese models and And of all those,
00:36:22.360 --> 00:36:24.440
which ones do we actually hear from? We only
00:36:24.440 --> 00:36:27.480
heard from one, right? So in other words, we
00:36:27.480 --> 00:36:30.219
have all these defensive measures in place, these
00:36:30.219 --> 00:36:32.039
alerting, you know, whatever, whatever, whatever.
00:36:32.840 --> 00:36:35.800
And we've only heard from one of them so far,
00:36:35.800 --> 00:36:39.119
like in terms of proactively letting us know,
00:36:39.239 --> 00:36:42.599
hey, we got attacked by an AI enabled attacker
00:36:42.599 --> 00:36:45.739
of some sort. So anyway, so that kind of puts
00:36:45.739 --> 00:36:50.900
a really bad sort of view on our existing Monitoring
00:36:50.900 --> 00:36:53.719
capabilities and and whatever else it is either
00:36:53.719 --> 00:36:56.699
that or there is no AI enabled attacks happening
00:36:56.699 --> 00:37:00.159
in the world that we know of which clearly Analysis
00:37:00.159 --> 00:37:03.300
of competing hypotheses on that right which just
00:37:03.300 --> 00:37:06.199
doesn't you know defies any sort of expectation
00:37:06.199 --> 00:37:10.280
of attacker behavior couple that with the executive
00:37:10.280 --> 00:37:13.840
order that that Trump put out around basically
00:37:13.840 --> 00:37:18.159
enabling hack back and so on There are some guardrails
00:37:18.159 --> 00:37:22.869
around around the you know combating Enabling
00:37:22.869 --> 00:37:25.349
the hack back but point is that we should be
00:37:25.349 --> 00:37:28.170
seeing a lots of this activity all over the place
00:37:28.170 --> 00:37:31.590
and we only see very little and to me that suggests
00:37:31.590 --> 00:37:35.050
that our Defenses or a monitoring capability
00:37:35.050 --> 00:37:38.789
detection suck. Yes. I think that's correct Wait,
00:37:38.789 --> 00:37:41.750
wait, wait, wait, you're saying that it is happening
00:37:41.750 --> 00:37:44.949
But we're just don't have good monitoring to
00:37:44.949 --> 00:37:48.409
tell us that this is happening. Yes Sorry Sunil,
00:37:48.409 --> 00:37:50.429
I didn't want to put words in your mouth. Let
00:37:50.429 --> 00:37:53.389
the data prove itself, right? I mean, how many
00:37:53.389 --> 00:37:55.369
breakout incidents have we seen and how many
00:37:55.369 --> 00:37:57.889
have actually been observed? Well, forget breakout.
00:37:58.050 --> 00:38:00.769
I mean, even just adversarial operations, they
00:38:00.769 --> 00:38:07.409
have to be going on. Well, I don't know. I don't
00:38:07.409 --> 00:38:09.269
know. I'm not going to jump on that bandwagon.
00:38:09.769 --> 00:38:12.550
But I tell you this, on Taiwan, this Taiwan incident
00:38:12.550 --> 00:38:14.889
or the one we're talking about, the eighth...
00:38:15.739 --> 00:38:18.380
Yeah, that's right. You know, you read the article,
00:38:19.320 --> 00:38:23.920
it turns out there were a number of APIs. Seems
00:38:23.920 --> 00:38:26.400
like they were accessible via the public internet.
00:38:26.539 --> 00:38:28.920
I don't know that, but it looked like they were.
00:38:29.480 --> 00:38:32.559
But the main component was that they were unauthenticated.
00:38:32.679 --> 00:38:35.139
There was no authentication to these APIs, which
00:38:35.139 --> 00:38:37.679
then led to getting more access to data that
00:38:37.679 --> 00:38:40.199
was, quote unquote, more sensitive. Bro, I could
00:38:40.199 --> 00:38:42.510
have used Nestles for that. I don't need an AI
00:38:42.510 --> 00:38:45.010
thing. It's no different. You know what I mean?
00:38:45.690 --> 00:38:48.510
I mean, if I just run across a log of an agent
00:38:48.510 --> 00:38:50.789
saying it did all this stuff. The cool thing
00:38:50.789 --> 00:38:52.250
about the hugging face is that you had the victim
00:38:52.250 --> 00:38:54.570
being the reporter, and that's trustworthy. And
00:38:54.570 --> 00:38:56.349
that's what we really need to believe a story.
00:38:57.590 --> 00:38:59.409
About that executive order, Sunil, that's hot.
00:39:00.630 --> 00:39:02.530
So I forget if these things have numbers or not.
00:39:02.650 --> 00:39:04.550
Maybe you want to say it was like 99, actually.
00:39:05.170 --> 00:39:08.289
But expanding capabilities to combat. combat
00:39:08.289 --> 00:39:10.369
trans, I'm saying it kind of loud because it's
00:39:10.369 --> 00:39:13.070
all caps, to combat transnational cyber enabled
00:39:13.070 --> 00:39:17.949
crime. Give us the quick TLDR on what's in this
00:39:17.949 --> 00:39:22.530
EL please Sunil. Yeah, so this is a piece of
00:39:22.530 --> 00:39:24.769
policy that's been debating, been debated for
00:39:24.769 --> 00:39:28.010
a long time. It got a little bit of a heads up
00:39:28.010 --> 00:39:30.630
and the executive order from, I think it was
00:39:30.630 --> 00:39:33.869
March timeframe around basically enabling hack
00:39:33.869 --> 00:39:38.989
back or enabling commercial entities to, Do active
00:39:38.989 --> 00:39:41.690
cyber operations against adversaries and specifically
00:39:41.690 --> 00:39:46.389
here? criminal organizations Actually specifically
00:39:46.389 --> 00:39:49.610
a transnational criminal organizations. I want
00:39:49.610 --> 00:39:53.489
to emphasize that for a moment because There's
00:39:53.489 --> 00:39:58.050
a lot of very specific Mentions in here around
00:39:58.050 --> 00:40:02.730
this is not against us persons This is not against
00:40:02.730 --> 00:40:05.670
us assets and such. So so there are some concerns
00:40:05.670 --> 00:40:11.280
around can Canada authoritarian leader Apply
00:40:11.280 --> 00:40:14.159
this towards US person that persons and so on
00:40:14.159 --> 00:40:16.760
so forth There's some very specific guardrails
00:40:16.760 --> 00:40:19.639
against that thankfully in in this executive
00:40:19.639 --> 00:40:22.559
order But anyway, it's all about the hack back
00:40:22.559 --> 00:40:26.280
and is what we allow it There's there's a lot
00:40:26.280 --> 00:40:28.340
of concerns around this. I know it's been discussed
00:40:28.340 --> 00:40:30.039
for some time but what's interesting on this
00:40:30.039 --> 00:40:34.159
is that the that the overturn window of acceptability
00:40:34.159 --> 00:40:37.380
of this type of Action has now gotten to the
00:40:37.380 --> 00:40:40.360
point where it is considered acceptable at least
00:40:40.360 --> 00:40:43.219
to the point where it's now part of policy I
00:40:43.219 --> 00:40:45.860
think there are some other interesting Perspectives
00:40:45.860 --> 00:40:48.480
their perspectives I have on this that go beyond
00:40:48.480 --> 00:40:53.280
the specifics of this order So a lot of people
00:40:53.280 --> 00:40:56.239
have compared this to the to the letters of mark
00:40:56.239 --> 00:41:01.800
letters or mark is when the US Deputized I guess
00:41:01.800 --> 00:41:06.130
privateers to go do piracy on the seas on behalf
00:41:06.130 --> 00:41:08.590
of the United States. But what's interesting,
00:41:08.690 --> 00:41:10.849
what's notable about this is it's written into
00:41:10.849 --> 00:41:15.030
the US constitution that only Congress can issue
00:41:15.030 --> 00:41:17.829
letters of mark. So there is a broader constitutional
00:41:17.829 --> 00:41:22.389
question here of can the president, can you put
00:41:22.389 --> 00:41:24.449
a executive order that puts forth essentially
00:41:24.449 --> 00:41:27.130
the equivalent of letters of mark here. So there's
00:41:27.130 --> 00:41:30.070
gonna be a constitutional debate here, or there
00:41:30.070 --> 00:41:32.630
should be. Yeah, have you heard any rumblings
00:41:32.630 --> 00:41:36.429
on that yet? Not from Congress But then again,
00:41:36.510 --> 00:41:38.829
you know, you know how this current administration
00:41:38.829 --> 00:41:42.349
and Congress are so But that this is a this is
00:41:42.349 --> 00:41:44.690
a I imagine at some point There's gonna be a
00:41:44.690 --> 00:41:46.650
lawsuit that's gonna be put forth to say hey,
00:41:46.789 --> 00:41:48.869
that's the car Does the president even have a
00:41:48.869 --> 00:41:50.690
constitutional authority to do this and the answer
00:41:50.690 --> 00:41:53.630
right now is no they don't So is this the equivalent
00:41:53.630 --> 00:41:57.829
of a letters of mark? Is for us though, I'm sorry,
00:41:57.969 --> 00:41:59.969
go ahead go ahead And let me just want to know
00:41:59.969 --> 00:42:01.630
one other thing that out that it's worth noting
00:42:01.630 --> 00:42:04.429
and this this is going back to our financial
00:42:04.429 --> 00:42:07.130
services days But there is a degree to which
00:42:07.130 --> 00:42:09.929
there when banking regulation got put in there
00:42:09.929 --> 00:42:12.389
was a point where And Jerry you have to remind
00:42:12.389 --> 00:42:14.050
me of this, you know this better than I will
00:42:14.050 --> 00:42:17.389
but we separated out investment banks from Yep,
00:42:18.110 --> 00:42:22.590
normal banks. Okay So right now not anymore not
00:42:22.590 --> 00:42:24.789
anymore because we supposed to have different
00:42:24.789 --> 00:42:26.829
guardrails in between. But consider the cybersecurity
00:42:26.829 --> 00:42:29.969
industry for a moment. We have threat Intel providers
00:42:29.969 --> 00:42:35.150
who are also doing office on file, who can potentially
00:42:35.150 --> 00:42:38.889
do offensive operations. Okay. So you have essentially
00:42:38.889 --> 00:42:42.389
a perverse incentive to create threat Intel to
00:42:42.389 --> 00:42:46.730
conduct more offensive operations. Should we
00:42:46.730 --> 00:42:50.190
consider having that be more separated out? It
00:42:50.190 --> 00:42:52.250
would seem to me that there should be some discussion
00:42:52.250 --> 00:42:55.900
about Potential is similar to what we did. I
00:42:55.900 --> 00:42:59.300
forget the exact It's a seagull act or something
00:42:59.300 --> 00:43:03.139
like that back in the The depression days that
00:43:03.139 --> 00:43:05.380
we put in some sort of guardrail between them.
00:43:05.760 --> 00:43:07.539
I envision that we probably need to have some
00:43:07.539 --> 00:43:11.260
sort of I was gonna say Chinese firewall, but
00:43:11.260 --> 00:43:12.800
maybe Chinese firewall is the right term here
00:43:12.800 --> 00:43:16.099
a firewall between the threatened towel side
00:43:16.099 --> 00:43:19.139
of the shop and the the threat operations side
00:43:19.139 --> 00:43:22.099
of the shot. Before we jump into Jerry, can we
00:43:22.099 --> 00:43:25.159
just clarify this for everybody who hasn't read
00:43:25.159 --> 00:43:28.280
this document or is as well versus Neil? Okay.
00:43:28.579 --> 00:43:32.860
So I got the right to attack you if you attack
00:43:32.860 --> 00:43:36.639
me. I'm simplifying it. But the right to attack
00:43:36.639 --> 00:43:38.659
means, I mean, last time I looked at this thing,
00:43:38.920 --> 00:43:41.940
you have to apply, right? Isn't it like you can't
00:43:41.940 --> 00:43:44.579
just carte blanc, hey, you freaking hit me, I'm
00:43:44.579 --> 00:43:46.940
going to hit you back kind of company. It's actually
00:43:47.230 --> 00:43:50.230
Some specialized companies who can attack back
00:43:50.230 --> 00:43:53.070
on rehab, correct? Yeah. And by the way, it wouldn't
00:43:53.070 --> 00:43:57.230
be, I'm going to use. Just clarify, right? It's
00:43:57.230 --> 00:43:58.389
not going to be Bank of America that's going
00:43:58.389 --> 00:44:00.230
to do the attack. It's Bank of America that will
00:44:00.230 --> 00:44:02.530
then contract out with some other company to
00:44:02.530 --> 00:44:06.690
say, Hey, do an offensive operation on my behalf
00:44:06.690 --> 00:44:09.789
to retrieve my content, to get the key to whatever.
00:44:11.530 --> 00:44:16.380
So the company would be the attacker. Right,
00:44:16.920 --> 00:44:19.980
and those are sanctioned entities, or sorry,
00:44:20.400 --> 00:44:22.760
they are blessed entities in the sense of they've
00:44:22.760 --> 00:44:24.940
gone through the appropriate process. But I don't
00:44:24.940 --> 00:44:27.219
envision that most corporate entities, normal
00:44:27.219 --> 00:44:29.559
corporate entities would be part of that. So
00:44:29.559 --> 00:44:31.679
they're like bounty hunters, and I don't mean
00:44:31.679 --> 00:44:34.179
bounty hunters. Mercenaries. Right, mercenaries,
00:44:34.440 --> 00:44:37.380
exactly. Hey, I got a contract. I want you to
00:44:37.380 --> 00:44:39.420
go beat up this attacker. I'm going to give you
00:44:39.420 --> 00:44:43.039
a million bitcoins, whatever. That's a lot of
00:44:43.039 --> 00:44:44.829
money. That's, I know it's a lot of money. I'm
00:44:44.829 --> 00:44:46.429
just saying that's kind of what you're talking
00:44:46.429 --> 00:44:48.570
about, right? So then what happens is the government
00:44:48.570 --> 00:44:51.710
is going to assess who is a good player. I mean,
00:44:51.710 --> 00:44:53.429
I'm already thinking like, it's going to be the
00:44:53.429 --> 00:44:57.170
traditional, you know, the former man D and C
00:44:57.170 --> 00:44:59.250
or anybody associated with the government who
00:44:59.250 --> 00:45:01.550
makes money, gives them back money to. Well,
00:45:01.550 --> 00:45:04.130
it is different because I mean, there are much
00:45:04.130 --> 00:45:09.050
of the. So I used to be Booz Allen as well. And.
00:45:09.989 --> 00:45:13.110
On the. offensive operations side of the world.
00:45:14.510 --> 00:45:17.730
We of course had lots of contract labor to assist
00:45:17.730 --> 00:45:21.269
in the offensive operations, but there was a
00:45:21.269 --> 00:45:25.409
very specific title 10, title 50, title 18, I
00:45:25.409 --> 00:45:29.130
forget the exact titles, authorities that one
00:45:29.130 --> 00:45:31.369
had to have to be able to press the actual enter
00:45:31.369 --> 00:45:36.309
button to perform the attack. And so this is
00:45:36.309 --> 00:45:39.090
now a situation where a corporate entity, a non
00:45:39.090 --> 00:45:41.610
-government entity, a non -Title 10, Title 50,
00:45:41.610 --> 00:45:44.170
Title 18 person can actually press enter. There
00:45:44.170 --> 00:45:46.289
you go. But Sunil, are the people behind this
00:45:46.289 --> 00:45:49.289
thing, are they legitimate, real, thoughtful
00:45:49.289 --> 00:45:52.610
people? Or is this just another macho, wannabe
00:45:52.610 --> 00:45:54.869
macho kind of thing? Hey, I'm going to, you punch
00:45:54.869 --> 00:45:57.010
me, I'm going to punch you back, I'll hire somebody.
00:45:57.469 --> 00:46:01.289
Is it legit? Right, Jerry? TBD, yeah. Well, I
00:46:01.289 --> 00:46:04.280
mean, look, the way I look at this is... Anybody
00:46:04.280 --> 00:46:05.940
could always try to attack anybody, whatever.
00:46:06.139 --> 00:46:07.880
The only needle that can be moved and what's
00:46:07.880 --> 00:46:11.239
moved by the EO is the legality of it. And so
00:46:11.239 --> 00:46:13.760
what this is saying is there's a path for companies
00:46:13.760 --> 00:46:15.619
that want to market that and go in a commercial
00:46:15.619 --> 00:46:18.440
endeavor of being able to attack. And I don't
00:46:18.440 --> 00:46:20.059
know, the undertone of this is that those would
00:46:20.059 --> 00:46:23.519
also be force multipliers whenever there's a
00:46:23.519 --> 00:46:26.219
USG need to attack somewhere. And hey, by the
00:46:26.219 --> 00:46:28.679
way, now we have this group. You know, for years
00:46:28.679 --> 00:46:31.579
now, especially with Russia specifically, but
00:46:31.579 --> 00:46:34.019
with a number of nations, The general idea has
00:46:34.019 --> 00:46:38.019
been that there has been the kind of blind acquiescence
00:46:38.019 --> 00:46:40.300
of the private sector from the government of,
00:46:40.519 --> 00:46:42.739
OK, we know these entities are scamming people
00:46:42.739 --> 00:46:45.500
and that the government would be aware of them
00:46:45.500 --> 00:46:48.840
and maybe they have some quid pro quo. And in
00:46:48.840 --> 00:46:50.599
the US, the argument is always, well, that wouldn't
00:46:50.599 --> 00:46:52.940
happen in the US because we have rules and that's
00:46:52.940 --> 00:46:55.639
not allowed. So you can't turn a blind eye. You
00:46:55.639 --> 00:46:57.639
could have civil actions and so on. And we have
00:46:57.639 --> 00:46:59.679
rules around this. So you can't have companies
00:46:59.679 --> 00:47:03.039
that are just operating. And this is almost leapfrogging
00:47:03.039 --> 00:47:05.360
that it's saying, we're not going to turn a blind
00:47:05.360 --> 00:47:08.059
eye. We're going to have a certification program.
00:47:08.599 --> 00:47:09.920
And by the way, we didn't mention part of it
00:47:09.920 --> 00:47:12.880
as a it's so it seems so awful to me to use a
00:47:12.880 --> 00:47:14.860
static number in an executive order when it comes
00:47:14.860 --> 00:47:17.440
to dollars. But there's a one million million
00:47:17.440 --> 00:47:21.139
dollar bond. Yes. That will be adjusted for this.
00:47:21.219 --> 00:47:23.420
I don't know. But there's a one million dollar
00:47:23.420 --> 00:47:25.820
bond that you have to post. But look, if you
00:47:25.820 --> 00:47:29.239
do this, if you go in and you hack some organization.
00:47:31.269 --> 00:47:32.789
And everybody in the company is like, well, hold
00:47:32.789 --> 00:47:33.829
on. That sounds like we're going to get in a
00:47:33.829 --> 00:47:35.409
lot of trouble. No, no, no. There's a new thing.
00:47:35.530 --> 00:47:36.929
And we are participating in a company. We got
00:47:36.929 --> 00:47:39.789
blessed and all of that. If something goes bad,
00:47:40.309 --> 00:47:42.650
I don't think that if you could just forfeit
00:47:42.650 --> 00:47:44.769
the million dollar bond and then get out of jail,
00:47:45.550 --> 00:47:47.550
great. Sign me up. Everybody's ready to do that.
00:47:47.690 --> 00:47:50.570
That's not how it's going to work. That million
00:47:50.570 --> 00:47:52.630
dollar bond is going to be put towards the first
00:47:52.630 --> 00:47:55.909
million dollars of legal fees. But the problem
00:47:55.909 --> 00:47:59.000
is going to be jail. You know, I mean, if you
00:47:59.000 --> 00:48:02.239
think about what could go wrong here, if somebody
00:48:02.239 --> 00:48:08.360
takes out a power plant in Moldova and they're
00:48:08.360 --> 00:48:10.920
a participating company and there's a cause of
00:48:10.920 --> 00:48:13.119
action, so there's some kind of damage and some
00:48:13.119 --> 00:48:15.619
ambassador is complaining about it. The type
00:48:15.619 --> 00:48:17.539
of trouble that that entity could get into is
00:48:17.539 --> 00:48:19.699
not going to be relieved at all by a million
00:48:19.699 --> 00:48:23.199
dollar bond. And also if this thing gets challenged
00:48:23.199 --> 00:48:25.179
and thrown out and you're in the middle of an
00:48:25.179 --> 00:48:27.119
operation and the whole damn thing gets blown
00:48:27.119 --> 00:48:30.599
up. Or a new administration comes along and just
00:48:30.599 --> 00:48:33.920
changes tenor on it Like I don't feel like these
00:48:33.920 --> 00:48:35.900
things are ones that you could build a 20 -year
00:48:35.900 --> 00:48:38.579
program around with any certainty right now I
00:48:38.579 --> 00:48:40.460
think it's also ridiculous because like most
00:48:40.460 --> 00:48:42.440
of the attacks. I mean the attackers are not
00:48:42.440 --> 00:48:44.719
gonna come from your house, dude All right, like
00:48:44.719 --> 00:48:47.440
they're okay. Yeah, they will. Okay. So Neils.
00:48:47.780 --> 00:48:51.179
Yes residential proxy is anyone I get that but
00:48:51.179 --> 00:48:54.239
but if you're gonna be If you're not going to
00:48:54.239 --> 00:48:56.960
be a doofus as an attacker, okay, let's, let's
00:48:56.960 --> 00:48:59.579
be quite honest here. You're going to hop from
00:48:59.579 --> 00:49:02.360
a machine that you own or from a bunch of mules
00:49:02.360 --> 00:49:04.440
you have out there that you've already, you know.
00:49:04.579 --> 00:49:05.739
But you don't have to anymore. That's the whole
00:49:05.739 --> 00:49:07.320
point. I mean, and you do that if you're trying
00:49:07.320 --> 00:49:09.039
to be clandestine and not make money off this,
00:49:09.099 --> 00:49:11.599
but now it's saying like, Hey, you can be. No,
00:49:11.699 --> 00:49:13.539
I'm talking about the attacker unit. No, but
00:49:13.539 --> 00:49:15.989
you didn't retaliate. So you hire these companies
00:49:15.989 --> 00:49:18.429
to go retaliate. What are they going to retaliate
00:49:18.429 --> 00:49:21.849
against? The attack? Where are you going to find
00:49:21.849 --> 00:49:23.969
those guys? No, so let's let's let's talk about
00:49:23.969 --> 00:49:27.369
the nature of the underlying constraint. So if
00:49:27.369 --> 00:49:29.869
I'm a corporate entity and I get attacked, I'm
00:49:29.869 --> 00:49:33.369
like, hey, I I've done my own threat intelligence
00:49:33.369 --> 00:49:36.230
and I know where it's coming from. I don't really
00:49:36.230 --> 00:49:38.449
have a great mechanism to be able to send that
00:49:38.449 --> 00:49:40.110
to the government and say, hey, government attack
00:49:40.110 --> 00:49:43.840
on my behalf. I can give I can give you a complete
00:49:43.840 --> 00:49:46.880
attack package and the government like okay Thanks,
00:49:46.880 --> 00:49:50.500
and then don't know what happens after that Heard
00:49:50.500 --> 00:49:52.699
that now to a corporate entity who's actually
00:49:52.699 --> 00:49:55.340
doing wants to do business with me and says okay
00:49:55.340 --> 00:49:59.280
Hey, I'm one of those approved entities who can
00:49:59.280 --> 00:50:03.320
operate on behalf of that that's been Blast by
00:50:03.320 --> 00:50:06.269
the US government to do something like this do
00:50:06.269 --> 00:50:08.710
business with me, give me your attack package,
00:50:09.210 --> 00:50:10.869
we'll go vet it and make sure that it's correct
00:50:10.869 --> 00:50:13.869
and then do our offensive operations based on
00:50:13.869 --> 00:50:17.289
that. I'm pretty sure this isn't gonna be like,
00:50:17.389 --> 00:50:20.070
oh, let me see if blowing up this is gonna have
00:50:20.070 --> 00:50:22.250
an effect. It's gonna be a much more targeted
00:50:22.250 --> 00:50:24.929
operation. And it includes surveillance, to be
00:50:24.929 --> 00:50:27.090
clear. It includes green lighting, the ability
00:50:27.090 --> 00:50:29.809
to surveil, which is where you go from the, which
00:50:29.809 --> 00:50:31.690
you solve the Mario problem, like to be able
00:50:31.690 --> 00:50:33.670
to figure out what's going on. So you're gonna
00:50:33.670 --> 00:50:37.090
go and try to figure out who the authors of DS
00:50:37.090 --> 00:50:39.650
Hack were, you're gonna go in, you know, go to
00:50:39.650 --> 00:50:42.889
the dark bars out there and say, hey, Sunil,
00:50:43.130 --> 00:50:45.369
that guy is the guy who did it. No, no, you're
00:50:45.369 --> 00:50:47.789
gonna pop Telegram. You're gonna back to our
00:50:47.789 --> 00:50:49.449
platform. You know the problem is most of these
00:50:49.449 --> 00:50:51.309
people, the same attackers are also gonna be
00:50:51.309 --> 00:50:53.289
the ones that they're playing. Well, there's
00:50:53.289 --> 00:50:55.989
minimum standards. I mean, certainly there are
00:50:55.989 --> 00:50:59.449
many players in the law enforcement space and
00:50:59.449 --> 00:51:01.130
the threat intel space that are operating on
00:51:01.130 --> 00:51:03.449
Telegram because they wanna, you know, look like
00:51:03.449 --> 00:51:06.230
they're part of the part of the group right so
00:51:06.230 --> 00:51:08.829
um and by the way i want i should mention the
00:51:08.829 --> 00:51:12.150
part of the whole the executive order calls out
00:51:12.150 --> 00:51:14.469
and making sure that there's tight integration
00:51:14.469 --> 00:51:18.070
with law enforcement law enforcement is always
00:51:18.070 --> 00:51:21.250
pissed when when some cyber operation that's
00:51:21.250 --> 00:51:23.030
conducted by some other part of the government
00:51:23.030 --> 00:51:27.010
or some commercial entity disrupts their There
00:51:27.010 --> 00:51:29.190
are law enforcement actions ongoing an investigation.
00:51:29.190 --> 00:51:31.650
I personally liked it when it was the FBI and
00:51:31.650 --> 00:51:33.849
the NSA I don't know what it is. Call me old
00:51:33.849 --> 00:51:36.329
-fashioned or even even Microsoft I mean Microsoft
00:51:36.329 --> 00:51:39.429
has been very aggressive I've been very good
00:51:39.429 --> 00:51:42.489
at trying to use the judicial system to do takedowns
00:51:42.489 --> 00:51:44.929
And when they do a takedown guess who it disrupts
00:51:44.929 --> 00:51:48.610
as well. It disrupts an FBI investigation. Yeah
00:51:48.610 --> 00:51:52.769
Well, we'll see look one of the other things
00:51:52.769 --> 00:51:56.150
that popped up so on the heels of of Black Hat
00:51:56.150 --> 00:51:59.190
and specifically DEFCON. There was that little
00:51:59.190 --> 00:52:02.110
thing about someone putting up a rogue SSID on
00:52:02.110 --> 00:52:06.929
a Delta flight back to Atlanta and in my mind
00:52:06.929 --> 00:52:10.449
getting quickly discovered and outed and you
00:52:10.449 --> 00:52:13.650
know, what I didn't get about that story was
00:52:13.650 --> 00:52:15.369
that they said that they did like a de -auth
00:52:15.369 --> 00:52:18.369
against the Delta Wi -Fi and then they put up
00:52:18.369 --> 00:52:21.190
something that said like Delta Wi -Fi fast and
00:52:21.190 --> 00:52:24.190
they got people on the flight to log into it.
00:52:24.349 --> 00:52:26.670
But if you read all the transcript from it, it
00:52:26.670 --> 00:52:30.110
kind of sounded like they put up this SSID and
00:52:30.110 --> 00:52:32.429
they might have not had anything at all actually
00:52:32.429 --> 00:52:36.389
happen. And now they're going to jail over that.
00:52:37.409 --> 00:52:40.389
To me, it just seemed like really stupid. Doesn't
00:52:40.389 --> 00:52:42.409
change the threat profile. It's not threat intel
00:52:42.409 --> 00:52:44.769
that's actionable anybody. It's not really that
00:52:44.769 --> 00:52:46.690
interesting, but it's just going to grab a few
00:52:46.690 --> 00:52:49.710
headlines for Jerry. The first thing I thought
00:52:49.710 --> 00:52:55.989
was this is Jerry. Jerry did come on And then
00:52:55.989 --> 00:52:57.489
he's just trying to show the whole world how
00:52:57.489 --> 00:53:01.389
dumb this idea is and he's just gonna do Just
00:53:01.389 --> 00:53:04.369
to prove that I could get no data. Yeah, exactly
00:53:04.369 --> 00:53:10.210
Yeah, yeah. Well, so there are things that are
00:53:10.210 --> 00:53:12.869
Not really that interesting like, you know Wi
00:53:12.869 --> 00:53:18.530
-Fi hotspots or Bluetooth speakers that that
00:53:18.530 --> 00:53:22.559
broadcast the word bomb Those are those are things
00:53:22.559 --> 00:53:25.800
that presumably one would hope that you given
00:53:25.800 --> 00:53:29.900
how much exposure there is to the public and
00:53:29.900 --> 00:53:34.059
meaning that the that anybody who's Given the
00:53:34.059 --> 00:53:36.480
attack surface is so exposed you would think
00:53:36.480 --> 00:53:40.179
that none of that should matter right and For
00:53:40.179 --> 00:53:43.239
the most part, I believe that's the case There
00:53:43.239 --> 00:53:47.980
was of course one incident with a friend of mine
00:53:47.980 --> 00:53:50.900
Chris Roberts who? showed that there were some
00:53:50.900 --> 00:53:54.780
other issues, some exposures that needed to be
00:53:54.780 --> 00:53:59.179
fixed. But aside from that issue, the one that
00:53:59.179 --> 00:54:01.719
actually disturbs me more was one that was recently
00:54:01.719 --> 00:54:04.199
discovered where you can, if you have external
00:54:04.199 --> 00:54:07.519
access to the plane, you can drop in like a coin
00:54:07.519 --> 00:54:12.960
sized. I wanted those raspberry pie kind of thing.
00:54:13.219 --> 00:54:16.820
Not a raspberry pie, but it's equivalent to a
00:54:16.820 --> 00:54:19.880
small little that will then allow you to actually
00:54:19.880 --> 00:54:22.019
take over flight operations. So that's a bit
00:54:22.019 --> 00:54:24.019
more, that's a real concern, right? But you need
00:54:24.019 --> 00:54:25.059
to have - Wow, I missed that headline. Yeah,
00:54:25.059 --> 00:54:27.880
like a flipper. Yeah. Yes, it's smaller than
00:54:27.880 --> 00:54:31.980
a flipper, but it inserts into this communication
00:54:31.980 --> 00:54:34.159
support that you can access from outside the
00:54:34.159 --> 00:54:35.780
plane. Okay, okay, it's actually on the port.
00:54:35.960 --> 00:54:39.159
It's not YRF. Yeah, so a passenger can access
00:54:39.159 --> 00:54:42.019
it directly, but anybody outside any of the -
00:54:42.019 --> 00:54:44.019
Like that Gremlin in the Twilight Zone episode.
00:54:44.480 --> 00:54:47.340
Yes. Yes. Yeah, so the accessibility of this
00:54:47.340 --> 00:54:50.940
port was demonstrated, and it was a real issue.
00:54:51.199 --> 00:54:53.800
Boeing started to take action against it, and
00:54:53.800 --> 00:54:56.519
it was recently discussed. Risk register entry.
00:54:56.820 --> 00:54:59.119
But that's a real issue, right? Because you can
00:54:59.119 --> 00:55:01.679
actually mess up. But it was also with the premise
00:55:01.679 --> 00:55:06.539
of a passenger just can't walk outside the plane
00:55:06.539 --> 00:55:08.159
and insert that in. For a lot of good reasons,
00:55:08.260 --> 00:55:11.769
yeah. For a lot of good reasons. But anyway,
00:55:12.150 --> 00:55:14.829
but as it relates to Wi -Fi the infotainment
00:55:14.829 --> 00:55:17.449
center all that kind of stuff You would hope
00:55:17.449 --> 00:55:19.789
and think and at this point I would generally
00:55:19.789 --> 00:55:23.250
believe that those are not Going to be a problem
00:55:23.250 --> 00:55:26.449
That's it. You know the organ these planes and
00:55:26.449 --> 00:55:33.869
and the public are very Over indexing on the
00:55:33.869 --> 00:55:36.829
potential concerns around passenger safety, so
00:55:36.829 --> 00:55:39.170
you know maybe rightfully they'll take more aggressive
00:55:39.170 --> 00:55:41.429
actions when something stupid like this happens
00:55:41.429 --> 00:55:44.530
but but practically speaking it has zero effect
00:55:44.530 --> 00:55:50.090
on actual safety wait so do you guys use wi -fi
00:55:50.090 --> 00:55:53.869
on when you're flying yeah of course starlink
00:55:53.869 --> 00:55:57.929
all the way baby you know honestly this is the
00:55:57.929 --> 00:56:01.030
i i usually just shut off my internet access
00:56:01.030 --> 00:56:03.869
and that's now bullpucky and i just read an old
00:56:03.869 --> 00:56:08.219
-fashioned book security reasons, right? No,
00:56:08.440 --> 00:56:11.679
it gives me an excuse to unplug. Come on, people
00:56:11.679 --> 00:56:14.820
unplug. You don't need to be online. That's actually
00:56:14.820 --> 00:56:17.159
some of my best plugged time, you know, is to
00:56:17.159 --> 00:56:18.659
be able to sit there and work on a project or
00:56:18.659 --> 00:56:21.599
do something on my laptop. Yeah, I mean, sometimes
00:56:21.599 --> 00:56:23.659
I'm like, how am I ever going to get to this?
00:56:23.719 --> 00:56:25.760
Oh, good. I've got a three hour flight on Thursday.
00:56:26.329 --> 00:56:29.769
That's sorted. Exactly. I mean, for online time,
00:56:29.929 --> 00:56:31.849
that's for like getting into doing some work.
00:56:32.250 --> 00:56:34.349
Yeah. It's like deep work at that point. I mean,
00:56:34.409 --> 00:56:36.769
you can actually log in on the internet and actually
00:56:36.769 --> 00:56:39.010
do all that stuff. Yeah, yeah, yeah, yeah. Totally.
00:56:39.389 --> 00:56:42.989
Yeah, yeah. No, I once, I forget what it was.
00:56:42.989 --> 00:56:46.150
Oh, I built a whole company website and app and
00:56:46.150 --> 00:56:47.949
all of that during a flight. By the time I landed,
00:56:48.110 --> 00:56:50.949
it was production. It felt awesome. And it was
00:56:50.949 --> 00:56:53.699
like found time to make a flight. Yeah. It's
00:56:53.699 --> 00:56:55.440
a good time for deep work because no one else
00:56:55.440 --> 00:56:57.599
is bothering you. Deep work. Yeah, man. You could
00:56:57.599 --> 00:57:01.320
do deep work. But I'm sorry, deep work doesn't
00:57:01.320 --> 00:57:03.639
mean going on the internet and surfing the internet
00:57:03.639 --> 00:57:06.239
and watching blah, blah, blah. The temptation
00:57:06.239 --> 00:57:09.739
is too much. Just grab a pad or have your computer,
00:57:09.739 --> 00:57:12.940
but don't connect it. Jerry, I'm not saying it's
00:57:12.940 --> 00:57:14.980
less secure or not. I'm just saying it's good
00:57:14.980 --> 00:57:17.659
for your mind. Just unplug once in a while. The
00:57:17.659 --> 00:57:19.639
only other time I do deep work and I unplug is
00:57:19.639 --> 00:57:25.170
when I go scuba diving. I have a feeling you're
00:57:25.170 --> 00:57:29.610
not kidding. And by the way, unplug the electricity,
00:57:29.690 --> 00:57:32.510
not the air. Oh, yeah, yeah, that's a good idea.
00:57:33.449 --> 00:57:34.909
Hey, one last thing I want to make sure that
00:57:34.909 --> 00:57:39.130
we cover during this is the AI red teaming whole
00:57:39.130 --> 00:57:42.090
wave. So I actually, we were talking about this
00:57:42.090 --> 00:57:44.210
earlier, but I didn't mention it's like when
00:57:44.210 --> 00:57:45.949
we went into the last recording, I was saying
00:57:45.949 --> 00:57:48.389
I had some like draft blog post and I wanted
00:57:48.389 --> 00:57:50.860
to. bang some ideas off you guys live on the
00:57:50.860 --> 00:57:52.659
air and then use that to make sure I didn't feel
00:57:52.659 --> 00:57:55.159
stupid about writing something. And so I did
00:57:55.159 --> 00:57:57.500
that. And then I published this thing about like,
00:57:57.639 --> 00:57:59.139
where we're headed in the trajectory. And I was
00:57:59.139 --> 00:58:01.260
basically saying the future cybersecurity is
00:58:01.260 --> 00:58:04.780
in a lot of AI red teaming and automated remediation.
00:58:05.280 --> 00:58:08.440
And that it's, you know, the AI defense investment
00:58:08.440 --> 00:58:10.960
isn't about better detections and Sam and all
00:58:10.960 --> 00:58:12.599
that, because that's just always been theatric.
00:58:12.920 --> 00:58:16.139
It's about Testing yourself trying to hack yourself
00:58:16.139 --> 00:58:18.539
and raising the token count the threshold that
00:58:18.539 --> 00:58:20.559
it will take to compromise yourself to an acceptable
00:58:20.559 --> 00:58:22.900
level As long as you're fixing all the stuff
00:58:22.900 --> 00:58:25.380
that you discover along the way So Mario you
00:58:25.380 --> 00:58:27.639
were asking about that earlier about like internal
00:58:27.639 --> 00:58:29.679
and pen testing and when you're shopping today
00:58:29.679 --> 00:58:34.300
what the market is like I've definitely talked
00:58:34.300 --> 00:58:36.960
to some people that are Totally into that and
00:58:36.960 --> 00:58:39.260
we're talking about like mythos private private
00:58:39.260 --> 00:58:41.440
mythos available to everybody these types of
00:58:41.440 --> 00:58:45.360
companies How mass market is that and is that
00:58:45.360 --> 00:58:47.420
taking over and are people actually using it
00:58:47.420 --> 00:58:49.539
and is it cost effective yet? Are you guys hearing
00:58:49.539 --> 00:58:53.719
any anecdotes? Well, I mean I would ask you guys
00:58:53.719 --> 00:58:58.280
as well in that in the same vein that Our customers
00:58:58.280 --> 00:59:01.079
asking you for this are asking you know your
00:59:01.079 --> 00:59:04.159
customers asking should be But but they say hey
00:59:04.280 --> 00:59:07.900
Show me a pen test on your AI agents that you've
00:59:07.900 --> 00:59:10.179
implemented. Tell me what kind of well, that's
00:59:10.179 --> 00:59:12.320
a different thing No, I mean, that's a different
00:59:12.320 --> 00:59:14.639
thing like testing your AI functionality is very
00:59:14.639 --> 00:59:16.239
different I'm talking about using a model and
00:59:16.239 --> 00:59:18.400
saying hack into the company and it may come
00:59:18.400 --> 00:59:21.880
in through an MCP or it may come in through dialing
00:59:21.880 --> 00:59:25.000
the help desk with an automated call whatever
00:59:25.000 --> 00:59:28.900
like true AI based red teaming like my take is
00:59:28.900 --> 00:59:31.099
if you have it like a section 9 Fermi and designated
00:59:31.099 --> 00:59:33.980
critical infrastructure and they first got in
00:59:33.980 --> 00:59:36.199
the project glass wing and got a taste of this
00:59:36.199 --> 00:59:38.519
and it forces them to come up with a harness
00:59:38.519 --> 00:59:41.039
for testing and they used mythos and it's great
00:59:41.039 --> 00:59:43.820
and they like the way it tasted and Now they're
00:59:43.820 --> 00:59:45.619
contracting with these private firms to test
00:59:45.619 --> 00:59:48.699
themselves this way. Okay, red team exercise
00:59:48.699 --> 00:59:51.260
continuous all the time Let us know feed the
00:59:51.260 --> 00:59:52.940
risk register. We keep fixing stuff. Keep on
00:59:52.940 --> 00:59:56.199
going. That's great Now they have you as a vendor
00:59:56.199 --> 00:59:59.360
and you do something that could, and by the way,
00:59:59.420 --> 01:00:01.780
the threat profile of vendors has changed a bit
01:00:01.780 --> 01:00:04.920
because if you're an agentic adversary going
01:00:04.920 --> 01:00:08.119
after a section nine firm, now the companies,
01:00:08.480 --> 01:00:10.800
the vendors that you want to compromise are ones
01:00:10.800 --> 01:00:13.440
that have the CMDB, ones that have infrastructure
01:00:13.440 --> 01:00:14.659
and folks. These are all things that will be
01:00:14.659 --> 01:00:17.739
helpful to use an agentic attacker. How can you
01:00:17.739 --> 01:00:20.280
be spending millions of dollars a year on automated
01:00:20.280 --> 01:00:22.769
red teaming against yourself and all that? And
01:00:22.769 --> 01:00:25.190
then your law firm, you're happy with a questionnaire.
01:00:26.449 --> 01:00:29.429
So that's like, I'm saying bring them under the
01:00:29.429 --> 01:00:32.769
kimono. I think they should say, hey, you're
01:00:32.769 --> 01:00:35.210
a serious vendor, good news, we're gonna pay,
01:00:35.269 --> 01:00:37.590
we're gonna foot the bill. But if you wanna work
01:00:37.590 --> 01:00:40.510
with us, we're gonna bring you in for a two month
01:00:40.510 --> 01:00:45.150
stint before we sign any contracts. And our testing,
01:00:45.369 --> 01:00:47.469
our big expensive vendor is gonna hit you too.
01:00:47.840 --> 01:00:49.820
And you're gonna have to fix the big stuff if
01:00:49.820 --> 01:00:51.659
you wanna play ball with us. I think that's the
01:00:51.659 --> 01:00:56.159
future. So you're saying I'm the vendor, I'm
01:00:56.159 --> 01:00:58.139
trying to earn your business, you the client
01:00:58.139 --> 01:01:02.179
tells me I'll do business with you only and only
01:01:02.179 --> 01:01:06.679
if you let me give you this third party company
01:01:06.679 --> 01:01:10.500
to do X on your environment. I'll take it. I
01:01:10.500 --> 01:01:12.659
think that's the future of TPRM. I take it. Me
01:01:12.659 --> 01:01:14.980
too, I'm sorry. I think it's a startup advantage.
01:01:15.619 --> 01:01:18.860
Okay, if your service now and someone asks for
01:01:18.860 --> 01:01:21.980
that lawyers are gonna panic under dime under
01:01:21.980 --> 01:01:23.920
dime the clients know it's not about the dime
01:01:23.920 --> 01:01:26.059
It's just what are they gonna find and someone
01:01:26.059 --> 01:01:27.960
else gonna find out and what are the contractual
01:01:27.960 --> 01:01:30.400
provisions? And what about all these 45 ,000?
01:01:30.699 --> 01:01:33.500
thing Contracts we had with JP Morgan that technically
01:01:33.500 --> 01:01:35.260
we get triggered by this because something was
01:01:35.260 --> 01:01:36.739
found and now I'm supposed to notify them and
01:01:36.739 --> 01:01:39.440
who's gone through the paperwork and I Think
01:01:39.440 --> 01:01:42.440
that would just paralyze the the old SAS orgs
01:01:42.440 --> 01:01:43.679
and they wouldn't be able to comply with that
01:01:43.900 --> 01:01:46.400
So I have a slightly different take on all this.
01:01:47.300 --> 01:01:52.480
One is that the constant red teaming and fixing
01:01:52.480 --> 01:01:59.639
ultimately will result in some inefficiencies
01:01:59.639 --> 01:02:02.099
around building up defenses around things that
01:02:02.099 --> 01:02:06.139
really don't need defending. We see this actually
01:02:06.139 --> 01:02:10.730
with insects and with biological things. You
01:02:10.730 --> 01:02:13.269
end up with these insects that fight other insects,
01:02:13.309 --> 01:02:15.329
and they end up with these defensive measures
01:02:15.329 --> 01:02:18.309
that don't really help them survive as much as
01:02:18.309 --> 01:02:21.949
just defend against each other. And so you have
01:02:21.949 --> 01:02:23.989
these heavy shells and whatever that just, you
01:02:23.989 --> 01:02:27.670
know, just encumber them and make them less mobile.
01:02:27.889 --> 01:02:29.929
You mean a bird just comes out and just destroy,
01:02:30.050 --> 01:02:32.550
just eats him and it's... You weren't expecting
01:02:32.550 --> 01:02:35.429
that bird coming in. That doesn't work for that
01:02:35.429 --> 01:02:39.780
bird. That's right. So that's one model. And
01:02:39.780 --> 01:02:42.139
certainly if you have a lot at risk, you may
01:02:42.139 --> 01:02:44.739
end up with a lot more defensive covering, so
01:02:44.739 --> 01:02:47.940
to speak. The other perspective is to be a lot
01:02:47.940 --> 01:02:51.239
more light and agile. And it really depends,
01:02:51.239 --> 01:02:55.480
I guess, ultimately on what sort of type of organization
01:02:55.480 --> 01:02:57.940
you're in and how much you have at risk. But
01:02:57.940 --> 01:03:01.000
I would say as much as you can, if you can shed
01:03:01.000 --> 01:03:04.079
things that don't require defending, you're going
01:03:04.079 --> 01:03:06.179
to end up being potentially in a better position.
01:03:07.019 --> 01:03:09.480
So when we go through and do the red teaming,
01:03:09.940 --> 01:03:11.500
the first thing that people should really be
01:03:11.500 --> 01:03:13.539
asking themselves is not necessarily how do we
01:03:13.539 --> 01:03:16.800
fix this or how do we prevent the red team from
01:03:16.800 --> 01:03:19.360
getting in, but rather do we even need this at
01:03:19.360 --> 01:03:22.099
all? Can we get rid of it? And by getting rid
01:03:22.099 --> 01:03:24.119
of it, you no longer have that attack surface
01:03:24.119 --> 01:03:28.139
at all. But I think in a common modern major
01:03:28.139 --> 01:03:30.739
enterprise, like the organizational behavior
01:03:30.739 --> 01:03:33.239
and so on, the only way to figure out the things
01:03:33.239 --> 01:03:35.880
that you need to decom and so on are to do the
01:03:35.880 --> 01:03:38.530
red teaming. Right. And the red team can add
01:03:38.530 --> 01:03:40.829
objective is something that matters to you. So
01:03:40.829 --> 01:03:43.809
if you're a big agricultural firm, it's see if
01:03:43.809 --> 01:03:46.489
you could cause production machines to go offline
01:03:46.489 --> 01:03:49.210
or to bypass some checks or whatever. And the
01:03:49.210 --> 01:03:51.590
red team is able to accomplish that. Now you've
01:03:51.590 --> 01:03:53.789
got a risk register full of the findings, like
01:03:53.789 --> 01:03:56.929
all of the chain, the things that enabled that.
01:03:57.309 --> 01:03:59.570
Now how you solve those, that's where you get
01:03:59.570 --> 01:04:01.889
into what you're saying. You can either invest
01:04:01.889 --> 01:04:05.909
a fortune at armoring up the stupid API connection
01:04:05.909 --> 01:04:08.349
with the local U -Haul provider that you established,
01:04:08.349 --> 01:04:10.750
you know, 30 years ago, or you could turn it
01:04:10.750 --> 01:04:13.210
off. Like, I think the reactions are where you
01:04:13.210 --> 01:04:16.250
have a whole spectrum of costs and benefit, and
01:04:16.250 --> 01:04:18.250
naturally you need to be smart about it. But
01:04:18.250 --> 01:04:21.769
I also think that the remediation half, the IT
01:04:21.769 --> 01:04:25.829
industry, completely apart from cybersecurity,
01:04:26.530 --> 01:04:29.969
is racing towards agentic remediation of things.
01:04:30.630 --> 01:04:32.650
And I don't think cyber should be trying to solve
01:04:32.650 --> 01:04:34.670
that problem. I think it's going to be too expensive
01:04:34.670 --> 01:04:36.409
for cyber to do it. Right. The worst thing that
01:04:36.409 --> 01:04:38.070
you can do to remediate is to remediate your
01:04:38.070 --> 01:04:40.489
on -premise exchange server. Well, exactly. So
01:04:40.489 --> 01:04:42.809
you just need a smart enough agent that says,
01:04:43.489 --> 01:04:45.809
here are the top three options. I recommend number
01:04:45.809 --> 01:04:48.989
one. And just turn everything off. Turn it off
01:04:48.989 --> 01:04:51.199
if you'd like to turn it off. It's your point
01:04:51.199 --> 01:04:52.980
that, like, if you think about it, like, I have
01:04:52.980 --> 01:04:54.679
a company website, let's say, for example, and
01:04:54.679 --> 01:04:57.500
the company website is associated in a different
01:04:57.500 --> 01:05:00.079
party. It doesn't use the same credentials that
01:05:00.079 --> 01:05:02.659
I have. No way of compromise. If it were to be
01:05:02.659 --> 01:05:05.139
compromised, there's no way to connect to your
01:05:05.139 --> 01:05:08.000
production environment, to your SDLC, end of
01:05:08.000 --> 01:05:10.119
story, blah, blah, blah, blah. You say, it says
01:05:10.119 --> 01:05:12.460
you. Go on. Right. But OK, well, I mean, I'm
01:05:12.460 --> 01:05:14.960
just saying so. So I mean, I've seen it where
01:05:14.960 --> 01:05:17.639
we do this pen test is like not me, but you hire
01:05:17.639 --> 01:05:19.559
these people are like, OK, do you? You're attacking
01:05:19.559 --> 01:05:21.920
my website. I told you not to attack the website.
01:05:21.980 --> 01:05:24.679
That's not I mean, I'm showing you how you can
01:05:24.679 --> 01:05:27.380
access it or not access it. In fact, we're not
01:05:27.380 --> 01:05:29.420
even managing that website. It's entirely managed
01:05:29.420 --> 01:05:32.079
by somebody else. That's a pen test. And that's
01:05:32.079 --> 01:05:35.619
because the results say SSRF on this blog. Who
01:05:35.619 --> 01:05:37.940
gives a damn about that? A red team, the objective
01:05:37.940 --> 01:05:39.840
is take all the money. And if they took all the
01:05:39.840 --> 01:05:42.119
money and they went through that thing, then
01:05:42.119 --> 01:05:44.280
I'm so glad I didn't take Mario's word for it.
01:05:44.679 --> 01:05:46.480
You're sounding like Sunil now, Jerry, you're
01:05:46.480 --> 01:05:48.480
learning the difference between a pen test and
01:05:48.480 --> 01:05:52.079
a red team. Yeah, exactly. And that's what needs
01:05:52.079 --> 01:05:54.280
to be agentic, right? The ends justify the means.
01:05:54.400 --> 01:05:56.599
And then if they got through, then the blue holes
01:05:56.599 --> 01:06:00.360
in all of this, all the cover story. I think
01:06:00.360 --> 01:06:03.710
it's, I don't know. Talk to at least one firm
01:06:03.710 --> 01:06:06.269
who has just entered into a contract for this.
01:06:06.489 --> 01:06:09.769
It's like production ready. It's it's going the
01:06:09.769 --> 01:06:13.070
AI based red teaming and being like a first class
01:06:13.070 --> 01:06:16.710
function. I just think that's going to be the
01:06:16.710 --> 01:06:19.170
majority or should be the majority of cyber spend
01:06:19.170 --> 01:06:21.730
if you're going to be able to defend against
01:06:21.730 --> 01:06:25.429
agentic adversaries. That's the contention. We'll
01:06:25.429 --> 01:06:28.829
see. All right, guys, we've run over an hour.
01:06:28.869 --> 01:06:31.389
This has been fun as always. We talked about
01:06:31.389 --> 01:06:33.250
a ton of AI, but it wasn't just because of buzz,
01:06:33.369 --> 01:06:35.889
it's just because it's happening. It was great
01:06:35.889 --> 01:06:38.070
talking to you guys. I'm looking forward to catching
01:06:38.070 --> 01:06:41.550
up in a couple of weeks here. And hopefully we'll
01:06:41.550 --> 01:06:42.469
have nothing to talk about.