1
00:00:00,000 --> 00:00:12,800
Welcome to Logically Speaking, where we discuss latest trends and challenges in the cybersecurity
2
00:00:12,800 --> 00:00:15,520
arena with top experts in their field.
3
00:00:15,520 --> 00:00:19,000
Today you're going to learn how to keep your data safe, your operations sound, and your
4
00:00:19,000 --> 00:00:21,400
business is ready for whatever comes next.
5
00:00:21,400 --> 00:00:23,400
This is Logically Speaking.
6
00:00:23,400 --> 00:00:29,920
Today we're speaking with Caleb Barlow, who comes with a plethora of experience and some
7
00:00:29,920 --> 00:00:30,920
really cool stories.
8
00:00:30,920 --> 00:00:34,720
So I'm going to ask Caleb to introduce himself.
9
00:00:34,720 --> 00:00:38,280
And our listeners are going to be at being for a great treat today.
10
00:00:38,280 --> 00:00:40,120
Caleb, could you introduce yourself, please?
11
00:00:40,120 --> 00:00:41,120
Sure.
12
00:00:41,120 --> 00:00:44,640
So full disclosure, Steve and I are buddies and we've worked together before, too.
13
00:00:44,640 --> 00:00:45,960
We should probably note.
14
00:00:45,960 --> 00:00:50,640
So there may be a little back and forth there.
15
00:00:50,640 --> 00:00:54,520
But hey, I've been in the cybersecurity industry for a long time.
16
00:00:54,520 --> 00:01:01,240
I ran Thread Intelligence and is a response at IBM, rebuilding the IBM X-Force.
17
00:01:01,240 --> 00:01:07,960
I've also run a working with Steve, a public company focused on compliance and the healthcare
18
00:01:07,960 --> 00:01:10,640
and for DOD contractors.
19
00:01:10,640 --> 00:01:17,320
And more recently, I do a lot of private equity work, all focused on cyber as well.
20
00:01:17,320 --> 00:01:18,320
That's fantastic.
21
00:01:18,320 --> 00:01:21,040
Well, thanks for taking some time to join us today.
22
00:01:21,040 --> 00:01:27,080
I really wanted to start out specifically talking about the mid-market and how the mid-market
23
00:01:27,080 --> 00:01:31,640
is handling the ever-changing cybersecurity landscape.
24
00:01:31,640 --> 00:01:38,160
So could you share in your opinion how that market addresses it or needs to address it?
25
00:01:38,160 --> 00:01:41,720
Well, I think mid-market is really tough, right?
26
00:01:41,720 --> 00:01:47,400
Because if we look at the broader landscape and then work our way down, if we were talking
27
00:01:47,400 --> 00:01:54,280
about large global banks, these are heavily regulated industries where even where there's
28
00:01:54,280 --> 00:02:00,280
not regulation, there's going to be expectations of how you protect someone's information
29
00:02:00,280 --> 00:02:03,400
and the privacy.
30
00:02:03,400 --> 00:02:08,080
But as we move down into the mid-market, two things happen.
31
00:02:08,080 --> 00:02:10,160
It's not that regulations aren't there.
32
00:02:10,160 --> 00:02:14,400
I mean, there's 52 different priest disclosure laws across the US.
33
00:02:14,400 --> 00:02:17,640
But they're far less applicable.
34
00:02:17,640 --> 00:02:20,600
They're very unlikely to be enforced, interestingly enough.
35
00:02:20,600 --> 00:02:28,480
We have all these disclosure laws and expectations on cybersecurity in the US and even more so
36
00:02:28,480 --> 00:02:29,480
around the world.
37
00:02:29,480 --> 00:02:36,000
But rarely do you ever see a case of someone paying a fine that's in any way substantial.
38
00:02:36,000 --> 00:02:40,720
But also, the challenge you run into in the mid-market is I think we were all working
39
00:02:40,720 --> 00:02:41,920
on the adage for years.
40
00:02:41,920 --> 00:02:47,960
In fact, I said this countless times, a cybersecurity incident is kind of like a bear attack.
41
00:02:47,960 --> 00:02:51,520
You don't need to, you don't necessarily need to outrun the bear.
42
00:02:51,520 --> 00:02:54,000
I just need to outrun you, Steve.
43
00:02:54,000 --> 00:02:57,400
That's good way to put it.
44
00:02:57,400 --> 00:02:58,720
But that's part of the problem, right?
45
00:02:58,720 --> 00:03:03,600
I can't tell you how many times that I would be in a boardroom when we'd be reading out
46
00:03:03,600 --> 00:03:06,320
an assessment.
47
00:03:06,320 --> 00:03:09,560
It might be a horrifically bad assessment.
48
00:03:09,560 --> 00:03:15,160
Your cybersecurity posture is just barely above having anything.
49
00:03:15,160 --> 00:03:20,080
And the only question you would get would be, well, how do I compare to my peers?
50
00:03:20,080 --> 00:03:23,760
And I think that has been the trend in the mid-market for a lot of time and for good
51
00:03:23,760 --> 00:03:30,200
reason because honestly, that's kind of what mattered at the time was as long as your defense
52
00:03:30,200 --> 00:03:32,280
is a little bit better than everybody else.
53
00:03:32,280 --> 00:03:37,800
Well, now enter AI, now enter the ability to scan for vulnerabilities anywhere on the
54
00:03:37,800 --> 00:03:39,080
internet.
55
00:03:39,080 --> 00:03:44,800
And it really doesn't matter because, you know, Nair DeWells have automated these attacks.
56
00:03:44,800 --> 00:03:50,000
They don't care if you're a big bank or you're a tiny real estate agent.
57
00:03:50,000 --> 00:03:54,040
If they can get money out of you, it's equal pickings.
58
00:03:54,040 --> 00:04:01,200
So I think what that, what this really changes to is a model where whether you are a small
59
00:04:01,200 --> 00:04:06,760
mid-market company doing, you know, real estate or a law firm or a bank, you know, small
60
00:04:06,760 --> 00:04:12,040
regional bank, you have to have the same security posture as the big guys.
61
00:04:12,040 --> 00:04:17,920
And you know, now the good news in all of this is that the way you're going to do that
62
00:04:17,920 --> 00:04:20,960
is through leveraging cloud environments and outsourcing some of this.
63
00:04:20,960 --> 00:04:25,960
And so it's, it is very attainable, which it wasn't probably five or 10 years ago, but
64
00:04:25,960 --> 00:04:28,240
you're going to have to pay attention to it.
65
00:04:28,240 --> 00:04:31,280
No, that's really good.
66
00:04:31,280 --> 00:04:36,720
Which industries do you still believe needs kind of, you know, there's industry segments
67
00:04:36,720 --> 00:04:43,600
that still needs that kind of catch up and prepare for the inevitable?
68
00:04:43,600 --> 00:04:46,000
I mean, what industries are most vulnerable in your opinion?
69
00:04:46,000 --> 00:04:48,640
Well, I don't even think it's so much most vulnerable.
70
00:04:48,640 --> 00:04:51,280
It's about where are people paying attention and where are people putting money at this
71
00:04:51,280 --> 00:04:52,280
problem?
72
00:04:52,280 --> 00:04:53,280
Right?
73
00:04:53,280 --> 00:04:55,920
In a lot of ways, I think everybody's vulnerable.
74
00:04:55,920 --> 00:05:01,440
If you move money in any way, shape or form, if you have goods that are of value, then
75
00:05:01,440 --> 00:05:03,760
yes, you're vulnerable, right?
76
00:05:03,760 --> 00:05:08,760
So I don't even think it's so much the targeting anymore.
77
00:05:08,760 --> 00:05:11,200
It's who's actually investing.
78
00:05:11,200 --> 00:05:16,320
And there are a few industries where this is very problematic, you know, probably the
79
00:05:16,320 --> 00:05:20,080
worst of which, which you and I have worked in is healthcare.
80
00:05:20,080 --> 00:05:22,400
And it is for a couple of reasons, right?
81
00:05:22,400 --> 00:05:27,200
One, a cybersecurity incident is not the worst thing that happens in a hospital on an idle
82
00:05:27,200 --> 00:05:28,200
Tuesday, right?
83
00:05:28,200 --> 00:05:32,360
I mean, all kidding aside, it is not the top priority.
84
00:05:32,360 --> 00:05:35,280
There are far worse things that can happen in a hospital.
85
00:05:35,280 --> 00:05:38,880
We just lived through two years of COVID, right?
86
00:05:38,880 --> 00:05:42,680
The second thing is a hospital is a distributed environment, right?
87
00:05:42,680 --> 00:05:46,720
The, you know, sometimes you have academic medical centers.
88
00:05:46,720 --> 00:05:51,360
You might have a situation where the doctor's practice operating the hospital is a totally
89
00:05:51,360 --> 00:05:52,800
different company, right?
90
00:05:52,800 --> 00:05:56,080
With totally different IT that runs on the same network.
91
00:05:56,080 --> 00:05:59,800
So there's a really good example of where things are really difficult for a whole lot
92
00:05:59,800 --> 00:06:01,760
of reasons.
93
00:06:01,760 --> 00:06:08,320
But also if we look at critical infrastructure, you know, I think people assume, okay, if
94
00:06:08,320 --> 00:06:12,080
you're an energy company, you need to have really robust security.
95
00:06:12,080 --> 00:06:15,880
Well, what if you're the supplier to that energy company?
96
00:06:15,880 --> 00:06:19,760
And that's, that's I think where, you know, people's eyes are really starting to open
97
00:06:19,760 --> 00:06:23,760
up is to recognize that it's not just about what you do.
98
00:06:23,760 --> 00:06:29,080
It's about what the people in your supply chain do that really also becomes deterministic
99
00:06:29,080 --> 00:06:30,080
in this.
100
00:06:30,080 --> 00:06:34,960
So, you know, I think the, the other challenge in this, and this is particularly applicable
101
00:06:34,960 --> 00:06:41,120
to the mid market is not so much looking at your company, you know, so I'm going to change
102
00:06:41,120 --> 00:06:45,440
your question here a little bit, Steve, but really looking at your supply chain.
103
00:06:45,440 --> 00:06:48,920
Who in your supply chain is vulnerable?
104
00:06:48,920 --> 00:06:53,800
And you know, let's face it here in the US, we love small businesses.
105
00:06:53,800 --> 00:06:55,200
We love the mid market.
106
00:06:55,200 --> 00:07:01,240
We love the idea of buying that difficult part from a small family owned business.
107
00:07:01,240 --> 00:07:02,640
That's great.
108
00:07:02,640 --> 00:07:07,320
But if that small family owned business isn't, you know, is your weakest link to a cybersecurity
109
00:07:07,320 --> 00:07:12,080
incident, then you know, that becomes really problematic.
110
00:07:12,080 --> 00:07:18,040
You mentioned supply chain and I know that you and I worked a lot with regards to like
111
00:07:18,040 --> 00:07:29,040
CMMC and the DOD supply chain, why is that taken so long for the DOD to kind of put that
112
00:07:29,040 --> 00:07:35,880
stake in the ground and say, this is what we're going to do to the 300 some odd thousand
113
00:07:35,880 --> 00:07:37,560
suppliers to the government.
114
00:07:37,560 --> 00:07:38,560
I mean,
115
00:07:38,560 --> 00:07:41,800
Well, I mean, the short answer to that is, you know, like anything government, it got
116
00:07:41,800 --> 00:07:48,880
mired in politics, so, you know, but I think in fairness, we all knew this going in, right?
117
00:07:48,880 --> 00:07:51,120
Anything that's a government issue, it's going to be slow.
118
00:07:51,120 --> 00:07:54,880
It's going to get recast three or four times.
119
00:07:54,880 --> 00:07:57,200
I don't think that's so much to what to look at.
120
00:07:57,200 --> 00:08:01,240
What's to look at is the momentum and the momentum behind this is something's going
121
00:08:01,240 --> 00:08:03,320
to happen.
122
00:08:03,320 --> 00:08:06,680
Even if it is a fraction of what people wanted to start.
123
00:08:06,680 --> 00:08:13,200
The difference is if you look at almost every regulation out there today, they got get all
124
00:08:13,200 --> 00:08:18,200
wishy washy on things like what exactly do you need to have in place?
125
00:08:18,200 --> 00:08:22,720
What is great about CMMC and frankly, where I think other regulations are headed is we
126
00:08:22,720 --> 00:08:26,680
start to get fairly prescriptive about what you need to have in place.
127
00:08:26,680 --> 00:08:33,160
I mean, five, 10 years ago, people were always scared to say, oh, you need to have certain
128
00:08:33,160 --> 00:08:37,280
capabilities because technology changed much faster than regulations.
129
00:08:37,280 --> 00:08:39,480
I think we're past that now.
130
00:08:39,480 --> 00:08:45,520
I think that if you don't have endpoint detection in place, if you don't have multi-factor on
131
00:08:45,520 --> 00:08:52,640
everything, if you don't have your network segmented, it is flat out negligence at this
132
00:08:52,640 --> 00:08:53,640
point.
133
00:08:53,640 --> 00:08:57,280
Like this is not the case of, oh, the bad guys broke in.
134
00:08:57,280 --> 00:08:59,280
It was a sophisticated attack.
135
00:08:59,280 --> 00:09:05,240
This is a case of owning a building and not having sprinklers and fire alarms.
136
00:09:05,240 --> 00:09:10,400
That's where regulations are starting to shift is there are some minimum expectations you
137
00:09:10,400 --> 00:09:11,400
need to have in place.
138
00:09:11,400 --> 00:09:16,000
Again, EDR segmentation multi-factor.
139
00:09:16,000 --> 00:09:18,240
You don't have those things in place.
140
00:09:18,240 --> 00:09:22,440
Don't cry when you get breached.
141
00:09:22,440 --> 00:09:24,400
You bring up a great point.
142
00:09:24,400 --> 00:09:31,040
This is something that we see, and I want to ask you your opinion on cyber insurance
143
00:09:31,040 --> 00:09:38,200
and whether or not at some point cyber insurers will stop pushing down these countermeasures
144
00:09:38,200 --> 00:09:41,600
as you lay them out and just go, I'm getting out of this business.
145
00:09:41,600 --> 00:09:44,920
It's too risky.
146
00:09:44,920 --> 00:09:47,920
I know you don't have a crystal ball, but what are your thoughts on that?
147
00:09:47,920 --> 00:09:55,720
I'm starting to see cyber insurance premiums go up by a factor of five, six times.
148
00:09:55,720 --> 00:09:57,800
That's how they make it not risky, Steve.
149
00:09:57,800 --> 00:10:00,400
It just charges a fortune.
150
00:10:00,400 --> 00:10:05,600
I mean, seriously, there are two fundamental things to recognize with cyber insurance.
151
00:10:05,600 --> 00:10:08,600
It is risky, so it's going to cost a lot.
152
00:10:08,600 --> 00:10:13,080
That's how they're managing their underwriting risk.
153
00:10:13,080 --> 00:10:22,960
The second thing to recognize with this is that they still need to sell the insurance.
154
00:10:22,960 --> 00:10:29,080
There is a definite balance between, thou shall have these capabilities in place or
155
00:10:29,080 --> 00:10:34,520
you're uninsurable and realizing that, hey, I still want to make a buck selling insurance,
156
00:10:34,520 --> 00:10:36,480
so I've got to take some risk.
157
00:10:36,480 --> 00:10:43,800
In a lot of ways, that industry is self-balancing, if you will.
158
00:10:43,800 --> 00:10:47,360
The challenge on cyber insurance is it's unregulated.
159
00:10:47,360 --> 00:10:50,680
It's not like auto insurance, which is regulated in most states.
160
00:10:50,680 --> 00:10:53,880
It's a little bit of the wild west.
161
00:10:53,880 --> 00:10:55,960
Again, I don't know if that's a problem.
162
00:10:55,960 --> 00:11:00,800
You could argue that as a problem or an opportunity.
163
00:11:00,800 --> 00:11:06,120
The other thing to recognize in all of this is the reason why cyber insurance is so expensive
164
00:11:06,120 --> 00:11:09,840
is because we keep paying the damn ransoms.
165
00:11:09,840 --> 00:11:12,760
I mean, hard stop.
166
00:11:12,760 --> 00:11:18,800
At some point, we've got to snap the chalk line down and stop paying ransoms.
167
00:11:18,800 --> 00:11:23,960
What's happening in this is that entire supply chain is making a ton of money off of this,
168
00:11:23,960 --> 00:11:28,280
not just the bad guys that get the ransom or might get the ransom, but the companies
169
00:11:28,280 --> 00:11:32,160
that facilitate those payments.
170
00:11:32,160 --> 00:11:37,720
There's an awful lot of money going out the door because we're paying ransoms, and in
171
00:11:37,720 --> 00:11:44,320
almost every case, it's because we didn't have the security basics in place.
172
00:11:44,320 --> 00:11:51,120
The optimistic side of me says that what's going to happen here is defenses are going
173
00:11:51,120 --> 00:11:56,800
to improve because if you don't have, again, key things like endpoint, multi-factor, and
174
00:11:56,800 --> 00:12:00,120
a segment of network, you're going to be uninsurable.
175
00:12:00,120 --> 00:12:05,960
On the other hand, the more negative way to look at this is maybe we should ban ransomware
176
00:12:05,960 --> 00:12:10,160
payments, which is something that gets kicked around every year or two.
177
00:12:10,160 --> 00:12:13,480
There's always the inevitable critical company that would go down and you wouldn't get your
178
00:12:13,480 --> 00:12:16,000
data back and nobody likes that.
179
00:12:16,000 --> 00:12:20,920
It's a really tough call, but what we have to recognize is this is a, cyber crime is
180
00:12:20,920 --> 00:12:25,680
now a trillion dollar market.
181
00:12:25,680 --> 00:12:34,400
It's bigger than the GDP of most, if not almost all European countries.
182
00:12:34,400 --> 00:12:38,880
At some point here, if we want to fix this problem, we've got to be willing to suffer
183
00:12:38,880 --> 00:12:45,400
a little bit, make it unprofitable, and if it's unprofitable, it goes away.
184
00:12:45,400 --> 00:12:50,200
You bring up an interesting question just popped into my head.
185
00:12:50,200 --> 00:13:00,120
What do you think should governments role be in this addressing this?
186
00:13:00,120 --> 00:13:05,000
Or should the government not be involved at all and leave it to the private sector?
187
00:13:05,000 --> 00:13:06,400
What are your thoughts on that?
188
00:13:06,400 --> 00:13:09,760
Well, every governor around the world has a different approach, but let's talk about
189
00:13:09,760 --> 00:13:15,800
this from a US-centric standpoint, just because that's where we're having this conversation.
190
00:13:15,800 --> 00:13:23,680
I think what we've historically done is we've defined our enemies as nation states, and
191
00:13:23,680 --> 00:13:25,200
we all know who those are.
192
00:13:25,200 --> 00:13:31,480
In addition to that, we've defined our critical infrastructure off of a World War II mentality.
193
00:13:31,480 --> 00:13:39,200
If you think of critical infrastructure, we think of water, power, dams, healthcare,
194
00:13:39,200 --> 00:13:40,200
that type of thing.
195
00:13:40,200 --> 00:13:46,240
I don't know about you, but in the dark days of COVID, that wasn't my critical infrastructure.
196
00:13:46,240 --> 00:13:56,680
My critical infrastructure was Amazon, Zoom, and Comcast.
197
00:13:56,680 --> 00:13:57,680
Those are not...
198
00:13:57,680 --> 00:14:01,640
Well, Comcast might be considered critical infrastructure, but Zoom and Amazon definitely
199
00:14:01,640 --> 00:14:02,640
are not.
200
00:14:02,640 --> 00:14:09,120
We've got to first of all really rethink what we depend on as a society now and reboot our
201
00:14:09,120 --> 00:14:15,400
thinking there, because if you don't have a robust internet nowadays, it gets really
202
00:14:15,400 --> 00:14:18,680
dark during days of COVID and things like that.
203
00:14:18,680 --> 00:14:23,280
I think the second thing to think about in all of this is government needs to really
204
00:14:23,280 --> 00:14:25,560
rethink who's the enemy in this.
205
00:14:25,560 --> 00:14:32,360
It's not just nation states, it's also organized crime.
206
00:14:32,360 --> 00:14:35,520
Espionage is an accepted international practice.
207
00:14:35,520 --> 00:14:39,520
It's been going on since the start of time, it will go on for millennia.
208
00:14:39,520 --> 00:14:45,360
There is limited things you can do when you bring politics into this.
209
00:14:45,360 --> 00:14:47,480
There's always...
210
00:14:47,480 --> 00:14:52,280
Cyber security is going to be an element of the battlefield from here forward, but there's
211
00:14:52,280 --> 00:14:58,040
a lot we can do, working even with nations that we may not get along with well on the
212
00:14:58,040 --> 00:15:00,720
organized crime side of this.
213
00:15:00,720 --> 00:15:06,400
I think that's one of the areas we really have to pivot dramatically is to think about
214
00:15:06,400 --> 00:15:12,480
the organized crime side of this and use that as the playground to develop cyber norms.
215
00:15:12,480 --> 00:15:17,200
I'll emphasize the word playground here, because you've got to run experiments, you've got
216
00:15:17,200 --> 00:15:20,280
to try things, you've got to see what works.
217
00:15:20,280 --> 00:15:26,720
There's a lot we can do on the cyber crime side without causing all kinds of political
218
00:15:26,720 --> 00:15:32,080
challenges and I think our governments need to get a little more active there.
219
00:15:32,080 --> 00:15:33,080
Yeah.
220
00:15:33,080 --> 00:15:37,720
I just want to clarify, did you actually say Amazon was now critical infrastructure?
221
00:15:37,720 --> 00:15:39,400
It is just in my opinion.
222
00:15:39,400 --> 00:15:42,720
I mean, think about it.
223
00:15:42,720 --> 00:15:53,040
But in all honesty, if you did not have Amazon, life changes dramatically.
224
00:15:53,040 --> 00:15:58,240
If you can't, well actually, let me be even more focused.
225
00:15:58,240 --> 00:16:02,880
If you don't have the ability to order goods online, have them delivered.
226
00:16:02,880 --> 00:16:05,560
There's a lot of stuff you just can't get now.
227
00:16:05,560 --> 00:16:06,560
Yeah.
228
00:16:06,560 --> 00:16:13,200
And there's a lot of businesses that start to have really significant supply chain issues.
229
00:16:13,200 --> 00:16:16,480
No, at the Rivera household, it was, yeah.
230
00:16:16,480 --> 00:16:18,880
I mean, put it another way.
231
00:16:18,880 --> 00:16:21,920
Could you work now without Zoom or its equivalents?
232
00:16:21,920 --> 00:16:23,280
Not at all.
233
00:16:23,280 --> 00:16:26,240
No, if we sit really here for the absolute right.
234
00:16:26,240 --> 00:16:27,240
Yeah.
235
00:16:27,240 --> 00:16:31,400
I mean, what would happen if we all had to go into the office next week?
236
00:16:31,400 --> 00:16:32,400
It would get ugly.
237
00:16:32,400 --> 00:16:34,800
I don't think I'd have an office to go into.
238
00:16:34,800 --> 00:16:35,800
Exactly.
239
00:16:35,800 --> 00:16:36,800
But all right.
240
00:16:36,800 --> 00:16:40,320
So what about like cyber warfare?
241
00:16:40,320 --> 00:16:48,440
I mean, how do you define that and how do you see that evolving?
242
00:16:48,440 --> 00:16:52,760
Because you mentioned it, right, because nation states and I mean, we've even seen recently
243
00:16:52,760 --> 00:16:57,640
with the conflict in the Ukraine that there's an aspect of that that's cyber related.
244
00:16:57,640 --> 00:17:00,280
I mean, you've been on the forefront of some of this.
245
00:17:00,280 --> 00:17:05,240
Can you talk a little bit about like how you see this evolving even further?
246
00:17:05,240 --> 00:17:09,880
Well, I think the conflict in Ukraine causes to learn something really interesting that
247
00:17:09,880 --> 00:17:11,920
we kind of weren't expecting, right?
248
00:17:11,920 --> 00:17:15,760
You know, I can't tell you how many times I've been asked like by reporters, like, is
249
00:17:15,760 --> 00:17:18,640
there a cyber armageddon coming, right?
250
00:17:18,640 --> 00:17:22,320
And you know, or a cyber 9-11 event, those types of things.
251
00:17:22,320 --> 00:17:25,720
And you know, the answer is always, of course, that's in the art of the possible.
252
00:17:25,720 --> 00:17:32,480
But I think we learned something really interesting in the conflict in Ukraine because in the
253
00:17:32,480 --> 00:17:37,440
role up to that, everybody was talking and worried about large scale cyber incidents
254
00:17:37,440 --> 00:17:43,280
because, you know, Russia, you know, Ukraine was Russia's playground for trying out various
255
00:17:43,280 --> 00:17:47,480
forms of cyber attacks for the last decade.
256
00:17:47,480 --> 00:17:52,600
But one of the things we learned is once actual kinetic bombs start flying, what do you need
257
00:17:52,600 --> 00:17:54,080
a cyber incident for?
258
00:17:54,080 --> 00:17:55,080
Right?
259
00:17:55,080 --> 00:18:00,080
Like, do you know, what's the point of breaking into the critical infrastructure if you're
260
00:18:00,080 --> 00:18:03,480
just going to blow it up with a kinetic bomb?
261
00:18:03,480 --> 00:18:07,160
You know, and as horrible as that sounds, it's kind of interesting because a lot of this
262
00:18:07,160 --> 00:18:09,320
stuff actually backed off.
263
00:18:09,320 --> 00:18:16,080
You know, the other interesting thing we saw is that various forms of cyber incidents
264
00:18:16,080 --> 00:18:22,880
kind of took a backseat because the last thing nations want to do is cause further opportunities
265
00:18:22,880 --> 00:18:26,960
for escalation while actual kinetic bombs are flying.
266
00:18:26,960 --> 00:18:33,400
So in a lot of ways, you know, we saw cyber take a step back in all of this.
267
00:18:33,400 --> 00:18:40,040
And my conclusion is that in a lot of ways, cybersecurity has kind of a new definition.
268
00:18:40,040 --> 00:18:45,040
You know, in the U.S., if we're unhappy with something that another nation does, that we
269
00:18:45,040 --> 00:18:50,600
don't want to get into a full scale armed conflict, you know, we use economic sanctions
270
00:18:50,600 --> 00:18:57,280
as our weapon of choice, if you will, to really kind of try to change and influence what another
271
00:18:57,280 --> 00:18:59,400
country might do.
272
00:18:59,400 --> 00:19:05,640
I think what we've started to see is that same level of response from companies that
273
00:19:05,640 --> 00:19:09,120
maybe don't have the ability to execute economic sanctions.
274
00:19:09,120 --> 00:19:15,280
When they get agitated, they lean towards cybersecurity as kind of their means of flexing
275
00:19:15,280 --> 00:19:17,040
their muscles.
276
00:19:17,040 --> 00:19:21,560
We've seen this both with the theft of intellectual property.
277
00:19:21,560 --> 00:19:28,880
We've seen this with responses to various actions that people may not like.
278
00:19:28,880 --> 00:19:32,840
And we've seen this in the opportunity to influence, you know, various forms of influence
279
00:19:32,840 --> 00:19:35,560
operations, misinformation, things like that.
280
00:19:35,560 --> 00:19:40,440
So my conclusion out of this, and this is just kind of a gut feel, not necessarily based
281
00:19:40,440 --> 00:19:49,000
on fact or research, is that cybersecurity is becoming the go-to tool for countries
282
00:19:49,000 --> 00:19:55,720
that are disgruntled at the West, where the West's go-to tool is oftentimes economic sanctions.
283
00:19:55,720 --> 00:19:58,320
And that's probably where these things are going to settle.
284
00:19:58,320 --> 00:20:04,960
The one exception to that is there are a few countries, you know, mainly North Korea is
285
00:20:04,960 --> 00:20:09,080
an example that are using cybersecurity actually generate revenue.
286
00:20:09,080 --> 00:20:14,000
But those are kind of singular in orientation.
287
00:20:14,000 --> 00:20:21,560
So and I appreciate those insights because those are very, you know, at the highest level,
288
00:20:21,560 --> 00:20:22,560
right?
289
00:20:22,560 --> 00:20:25,520
All companies operate in this global economy.
290
00:20:25,520 --> 00:20:30,000
And these things have these geopolitical issues have cascading effects.
291
00:20:30,000 --> 00:20:33,360
So I appreciate you bringing that up and mentioning that.
292
00:20:33,360 --> 00:20:40,240
So how do you think the cybersecurity landscape will change over the next five to 10 years?
293
00:20:40,240 --> 00:20:46,760
If you indeed had a crystal ball, what do you think the mid-market specifically will
294
00:20:46,760 --> 00:20:48,760
have to face over the next decade?
295
00:20:48,760 --> 00:20:54,120
Well, I think the biggest thing that we've got to recognize, if we look at ransomware
296
00:20:54,120 --> 00:20:59,280
as a attack pattern is, you know, when someone initiates a ransomware incident, they've got
297
00:20:59,280 --> 00:21:01,040
access to your systems, right?
298
00:21:01,040 --> 00:21:02,520
They can access your data.
299
00:21:02,520 --> 00:21:06,800
Otherwise, it would be really difficult to lock it up.
300
00:21:06,800 --> 00:21:10,640
You know, one of the things we're going to have to deal with at some point is Nairdwell
301
00:21:10,640 --> 00:21:15,600
is realizing that rather than locking up the data, it's far more efficient for them to
302
00:21:15,600 --> 00:21:17,360
change the data.
303
00:21:17,360 --> 00:21:22,800
And you know, when you have an incident where someone has changed data and you can't trust
304
00:21:22,800 --> 00:21:27,000
what's in your systems, that can be far, far more devastating.
305
00:21:27,000 --> 00:21:30,120
So I think one of the things we're going to really have to deal with over the next few
306
00:21:30,120 --> 00:21:32,720
years is kind of data integrity events.
307
00:21:32,720 --> 00:21:38,280
Now, again, imagine things like a supply chain or pharmaceuticals or things like that, where
308
00:21:38,280 --> 00:21:42,360
all someone has to do is allege and prove that they can change your data and now you
309
00:21:42,360 --> 00:21:44,960
can't trust anything.
310
00:21:44,960 --> 00:21:46,840
So that can be far more devastating.
311
00:21:46,840 --> 00:21:50,520
I think the second thing we're all going to have to deal with this is AI.
312
00:21:50,520 --> 00:21:53,600
And you know, we really don't know what that's going to look like yet.
313
00:21:53,600 --> 00:21:59,480
The most fascinating thing about AI is the pace of innovation is not measured in years,
314
00:21:59,480 --> 00:22:04,600
which is what, you know, we're all used to new technologies coming out that pace is measured
315
00:22:04,600 --> 00:22:10,800
in kind of years in terms of how fast things innovate, how fast you see new releases.
316
00:22:10,800 --> 00:22:16,640
In this AI world, we're seeing new innovations literally every three or four days.
317
00:22:16,640 --> 00:22:22,120
So, you know, I think what everybody's a little bit spooked about there is there's a lot that
318
00:22:22,120 --> 00:22:24,560
could go wrong with AI.
319
00:22:24,560 --> 00:22:28,400
There's certainly a lot that can go wrong from a privacy and security standpoint.
320
00:22:28,400 --> 00:22:33,160
And we're just moving so fast that we really don't know where this is going to land.
321
00:22:33,160 --> 00:22:38,600
Now, on the positive side of this, I think what we're also seeing as models that are
322
00:22:38,600 --> 00:22:42,400
going to be capable of solving some of the problems people haven't been able to solve.
323
00:22:42,400 --> 00:22:46,480
I mean, an average SOC nowadays receives more than a million events a day.
324
00:22:46,480 --> 00:22:49,440
There are SOCs out there that get several billion events a day.
325
00:22:49,440 --> 00:22:52,520
There's no way you're getting through that with human beings.
326
00:22:52,520 --> 00:22:57,000
So you know, the promise that people have been talking about for years where a, you
327
00:22:57,000 --> 00:23:02,320
know, intelligent agent could go through and really resolve a lot of these issues, find
328
00:23:02,320 --> 00:23:08,680
that needle in a stack of needles, likely starts to become true in some cases.
329
00:23:08,680 --> 00:23:13,480
But you know, again, it's a little too early to see how these things unfold.
330
00:23:13,480 --> 00:23:18,600
And the other thing is, although in the fullness of time, I'm sure we'll end up in the right
331
00:23:18,600 --> 00:23:19,600
spot.
332
00:23:19,600 --> 00:23:23,760
We don't know which is going to, you know, we don't know which is going to innovate faster.
333
00:23:23,760 --> 00:23:27,320
The bad ideas are the good ideas to protect them with AI.
334
00:23:27,320 --> 00:23:32,720
It's funny that you mentioned that because I'm thinking, you know, in our industry in
335
00:23:32,720 --> 00:23:38,520
cybersecurity, we're always playing that cat and mouse, you know, kind of reactive.
336
00:23:38,520 --> 00:23:45,880
And so I think that the bad actors are going to leverage AI and we're going to have to
337
00:23:45,880 --> 00:23:49,880
respond to it unless we leapfrog there.
338
00:23:49,880 --> 00:23:51,160
And I just don't see that happening.
339
00:23:51,160 --> 00:23:54,200
I just always see where maybe you can comment it.
340
00:23:54,200 --> 00:23:55,200
I personally.
341
00:23:55,200 --> 00:23:57,560
Well, here's the one thing we know for sure.
342
00:23:57,560 --> 00:24:04,000
If that giant sucking sound you hear right now is all of the money leaving the cybersecurity
343
00:24:04,000 --> 00:24:10,560
startups that have been the, you know, the coolest thing to invest in and all go into
344
00:24:10,560 --> 00:24:11,560
AI, right?
345
00:24:11,560 --> 00:24:16,840
I mean, you know, we've got RSA coming up here in another couple of weeks, at least one
346
00:24:16,840 --> 00:24:21,560
of recording this, I'm imagining every single vendor on that show floor is going to be talking
347
00:24:21,560 --> 00:24:25,640
about their AI solution, even if it's not real.
348
00:24:25,640 --> 00:24:28,640
So you know, on one hand, hey, that's great.
349
00:24:28,640 --> 00:24:29,640
That's exciting.
350
00:24:29,640 --> 00:24:32,960
But it's definitely going to change the dynamic.
351
00:24:32,960 --> 00:24:39,520
I think the other thing that's going to happen here is that, you know, today we all view
352
00:24:39,520 --> 00:24:45,520
ourselves as security professionals and kind of have a fairly well understood definition
353
00:24:45,520 --> 00:24:47,320
of what that means.
354
00:24:47,320 --> 00:24:53,760
I think trust and safety are really going to start to enter our lexicon in a very robust
355
00:24:53,760 --> 00:24:58,480
way where historically kind of trust and safety positions were really things that were reserved
356
00:24:58,480 --> 00:25:02,240
for companies like Amazon and Google and Microsoft.
357
00:25:02,240 --> 00:25:06,480
I think that's going to be a dynamic that lots of companies are going to be thinking
358
00:25:06,480 --> 00:25:12,600
about because, you know, when you start turning your operations or your systems or your supply
359
00:25:12,600 --> 00:25:18,040
chain or your plan over to AI systems, you know, you're going to need a robust trust
360
00:25:18,040 --> 00:25:21,520
and safety component to that because you're going to need to know how those algorithms
361
00:25:21,520 --> 00:25:23,800
think and what their boundaries are.
362
00:25:23,800 --> 00:25:25,160
Yeah.
363
00:25:25,160 --> 00:25:33,560
No one wants to run into a cyberdyne system launching AI that becomes self aware.
364
00:25:33,560 --> 00:25:37,840
Well, I mean, there it is utterly fast.
365
00:25:37,840 --> 00:25:41,760
You know, and I guess for the uninitiative, you have not played around with some of these
366
00:25:41,760 --> 00:25:43,280
solutions, you're missing out.
367
00:25:43,280 --> 00:25:48,160
Like some of what they can do is astounding.
368
00:25:48,160 --> 00:25:53,320
And but, you know, again, in the same front, some of what they can do is I mean, you can
369
00:25:53,320 --> 00:25:57,520
write a phishing email with chat GPT that there is no way you wouldn't click on.
370
00:25:57,520 --> 00:26:00,520
It's just too good.
371
00:26:00,520 --> 00:26:04,400
And I don't know how you put, you know, they like obviously if you prompt it, can you write
372
00:26:04,400 --> 00:26:06,920
me a phishing email for Steve Rivera?
373
00:26:06,920 --> 00:26:08,960
It's obviously going to say no.
374
00:26:08,960 --> 00:26:14,000
But if if I, on the other hand, put in a couple of your interests that I get off of, you know,
375
00:26:14,000 --> 00:26:18,080
your Facebook page, it's going to write a phishing email that's so good, there's no way
376
00:26:18,080 --> 00:26:19,760
you're not going to click on it.
377
00:26:19,760 --> 00:26:20,760
Yeah.
378
00:26:20,760 --> 00:26:28,480
And we used to chat GPT recently for an exercise to come up with a slogan for our company.
379
00:26:28,480 --> 00:26:32,960
And we we inputted a bunch of information and it came back with something pretty slick.
380
00:26:32,960 --> 00:26:40,400
And I thought, why are we spending all this money with a company to tell us what our marketing
381
00:26:40,400 --> 00:26:43,000
slogan should be our rally cry.
382
00:26:43,000 --> 00:26:44,760
And we were all pretty impressed.
383
00:26:44,760 --> 00:26:45,760
We didn't go with it.
384
00:26:45,760 --> 00:26:47,480
But but yeah, you're right.
385
00:26:47,480 --> 00:26:54,920
The AI engines are becoming astoundingly good at providing some of that information that's
386
00:26:54,920 --> 00:26:58,240
taken people, you know, humans a long, long time.
387
00:26:58,240 --> 00:27:02,440
But that's the other side of this, right, is there are entire jobs that are going to
388
00:27:02,440 --> 00:27:06,040
get disrupted, industries that are going to get disrupted.
389
00:27:06,040 --> 00:27:10,320
But the difference is that's not what we're used to, you know, we're used to scenarios
390
00:27:10,320 --> 00:27:15,920
that when a particular profession gets disrupted, it takes a course of like five years for that
391
00:27:15,920 --> 00:27:17,880
to occur.
392
00:27:17,880 --> 00:27:20,560
This is going to happen in weeks.
393
00:27:20,560 --> 00:27:24,240
I mean, I'll give you an example.
394
00:27:24,240 --> 00:27:27,560
Just because I was recently going through this in our family, you know, my daughter's
395
00:27:27,560 --> 00:27:30,600
been off applying to colleges and all that stuff.
396
00:27:30,600 --> 00:27:33,600
The college essay is done.
397
00:27:33,600 --> 00:27:35,600
Absolutely done.
398
00:27:35,600 --> 00:27:41,560
There is, I mean, we'll see how many colleges ask for an essay next year.
399
00:27:41,560 --> 00:27:42,560
But it's useless.
400
00:27:42,560 --> 00:27:47,400
I mean, every one of those essays is going to be put through a chat bot and it's going
401
00:27:47,400 --> 00:27:51,760
to be absolutely perfect tiered for her next year.
402
00:27:51,760 --> 00:27:53,840
So why are you wasting your time?
403
00:27:53,840 --> 00:27:57,920
Now I'm guessing most schools will probably still ask for them next year.
404
00:27:57,920 --> 00:28:04,240
But I literally think my daughter's generation is the last to actually put pen to paper and
405
00:28:04,240 --> 00:28:05,240
write an essay.
406
00:28:05,240 --> 00:28:08,880
And, you know, a perfect example of this.
407
00:28:08,880 --> 00:28:14,200
So, you know, all of her applications had to be done around like that October, November,
408
00:28:14,200 --> 00:28:17,280
timeframe, right as all this stuff was coming out, right?
409
00:28:17,280 --> 00:28:22,160
So she actually literally wrote all this stuff and it took weeks to do it.
410
00:28:22,160 --> 00:28:26,000
And we're driving in the, she's driving in the car.
411
00:28:26,000 --> 00:28:28,960
And I'm like, what was the toughest essay you had to write?
412
00:28:28,960 --> 00:28:31,000
And I'm like, what did they ask you to do?
413
00:28:31,000 --> 00:28:33,680
And I'm putting this stuff into chat GPT.
414
00:28:33,680 --> 00:28:35,440
And I read her what it wrote.
415
00:28:35,440 --> 00:28:37,120
She almost drove off the road.
416
00:28:37,120 --> 00:28:43,320
She's like, dad, that is so much better than anything I could have written or anybody else.
417
00:28:43,320 --> 00:28:44,320
How did you do that?
418
00:28:44,320 --> 00:28:46,040
I mean, it's done, right?
419
00:28:46,040 --> 00:28:50,040
But I show that as one example as security professionals that we're going to have to
420
00:28:50,040 --> 00:28:57,200
deal with is, you know, anytime there's disruption, there's opportunities for various security
421
00:28:57,200 --> 00:29:00,200
or trust and safety issues.
422
00:29:00,200 --> 00:29:03,840
But this isn't going to happen over a couple of years.
423
00:29:03,840 --> 00:29:07,160
Some of this stuff is going to happen nearly instantaneously.
424
00:29:07,160 --> 00:29:11,400
And that's going to be part of the problem is we've got to be ready to jump on this
425
00:29:11,400 --> 00:29:17,320
stuff really quickly, which means we've got to really be paying attention to it.
426
00:29:17,320 --> 00:29:28,920
So you paid a picture that is both exciting and frightening at the same time.
427
00:29:28,920 --> 00:29:35,760
How can organizations prepare themselves for that onslaught of AI driven fishing, spear
428
00:29:35,760 --> 00:29:41,440
fishing attacks that are going to invariably kind of attack their systems?
429
00:29:41,440 --> 00:29:42,440
What do you?
430
00:29:42,440 --> 00:29:45,600
Well, I mean, I think I do think there's some things we've really got to think about
431
00:29:45,600 --> 00:29:47,480
that we know about now, right?
432
00:29:47,480 --> 00:29:51,240
So, you know, if you ask me this question two weeks from now, I'm going to have a different
433
00:29:51,240 --> 00:29:54,800
answer and two weeks after that, I'm going to have a different answer, right?
434
00:29:54,800 --> 00:30:00,000
So, you know, and that's part of the point of answering this is that, you know, this
435
00:30:00,000 --> 00:30:01,000
is a cat and mouse game.
436
00:30:01,000 --> 00:30:02,800
We're going to be thinking about this constantly.
437
00:30:02,800 --> 00:30:06,880
So what I'm telling people right now is two things you need to think about.
438
00:30:06,880 --> 00:30:13,040
One, your company likely has very strong controls around its intellectual property and confidentiality.
439
00:30:13,040 --> 00:30:17,360
You know, you probably when you joined your company signed a confidentiality agreement,
440
00:30:17,360 --> 00:30:22,160
those things need to be immediately updated to talk about, are you allowed to put confidential
441
00:30:22,160 --> 00:30:24,880
information into a chatbot or an AI engine?
442
00:30:24,880 --> 00:30:30,960
Because remember, the difference is if I'm using something like Word to, you know, write
443
00:30:30,960 --> 00:30:35,160
a confidential document, big deal, Microsoft Word isn't learning anything from what I'm
444
00:30:35,160 --> 00:30:36,160
putting in there.
445
00:30:36,160 --> 00:30:43,400
On the other hand, if I'm uploading the secret formula into a chatbot, the chatbot is absolutely
446
00:30:43,400 --> 00:30:46,800
learning from what I'm putting in it.
447
00:30:46,800 --> 00:30:51,200
And you know, different chatbots, different algorithms are going to have different expectations
448
00:30:51,200 --> 00:30:53,440
around intellectual property.
449
00:30:53,440 --> 00:30:58,800
But I think companies need a strong policy on what is acceptable use.
450
00:30:58,800 --> 00:31:02,520
And the answer is it don't put anything in a chatbot because that's just not going to
451
00:31:02,520 --> 00:31:04,200
happen, right?
452
00:31:04,200 --> 00:31:11,000
But I do think, you know, there are some very sound ideas on what you should and shouldn't
453
00:31:11,000 --> 00:31:12,320
be putting in a chatbot.
454
00:31:12,320 --> 00:31:14,560
Okay, so that's one.
455
00:31:14,560 --> 00:31:21,440
The second thing is that, you know, we have to recognize that our incoming email is very
456
00:31:21,440 --> 00:31:24,080
rapidly going to be written by a chatbot.
457
00:31:24,080 --> 00:31:30,080
I mean, anybody in a sales position is using this thing for writing every email they write
458
00:31:30,080 --> 00:31:32,560
now, because it's just so good.
459
00:31:32,560 --> 00:31:37,320
And you know, what that means is that the historical mantra that you open every email
460
00:31:37,320 --> 00:31:44,200
and you read it, that probably has to go away, particularly at high executive levels, because
461
00:31:44,200 --> 00:31:49,360
the level of detail in there is likely going to cause you to click on things to open things.
462
00:31:49,360 --> 00:31:52,040
And what you've got to do is really change policy.
463
00:31:52,040 --> 00:31:56,760
In particular, you probably shouldn't be opening any attachment that doesn't come from a known
464
00:31:56,760 --> 00:31:58,720
source hard stop.
465
00:31:58,720 --> 00:32:03,680
I don't know what we do with things like recruiting, where there are lots of documents that are
466
00:32:03,680 --> 00:32:05,440
exchanged over email.
467
00:32:05,440 --> 00:32:12,960
I mean, you know, the opportunity to use a recruiter to get access into your company
468
00:32:12,960 --> 00:32:17,520
is just so easy right now, because you know, you're sending around resumes and people are
469
00:32:17,520 --> 00:32:19,480
loading and things like that.
470
00:32:19,480 --> 00:32:24,480
So you know, there are a few areas where if you move large amounts of documents, you've
471
00:32:24,480 --> 00:32:28,320
really got to get some tight controls in place because the opportunity for phishing is just
472
00:32:28,320 --> 00:32:29,320
too large.
473
00:32:29,320 --> 00:32:34,000
Yeah, I read an article this morning about a Samsung engineer who had put sensitive
474
00:32:34,000 --> 00:32:41,520
information at GPT and I thought, yeah, what you said is absolutely happening.
475
00:32:41,520 --> 00:32:47,240
There needs to be controls and needs to be policies because it's happening.
476
00:32:47,240 --> 00:32:48,240
Yeah.
477
00:32:48,240 --> 00:32:49,240
Unbeknownst to them.
478
00:32:49,240 --> 00:32:50,240
Well, and I think there's some common sense.
479
00:32:50,240 --> 00:32:55,800
Like for example, I've used it a couple of times for a document that would be quote unquote
480
00:32:55,800 --> 00:32:58,960
confidential if you knew who I was talking about.
481
00:32:58,960 --> 00:33:01,840
But if you didn't know who I was talking about is totally benign.
482
00:33:01,840 --> 00:33:07,080
So you know, I just changed the company names because I wanted to use chat GPT to help me
483
00:33:07,080 --> 00:33:08,480
get a point across.
484
00:33:08,480 --> 00:33:11,120
And it was fantastic at doing that.
485
00:33:11,120 --> 00:33:14,920
And I just didn't want it to know like who I was working with.
486
00:33:14,920 --> 00:33:18,920
So you know, there's a really simple thing you can do as an example to kind of clean
487
00:33:18,920 --> 00:33:19,920
that up.
488
00:33:19,920 --> 00:33:27,440
On the other hand, if you have some incredibly unique piece of code that no one in the world
489
00:33:27,440 --> 00:33:32,480
knows about, I would not be loading it up into a chatbot.
490
00:33:32,480 --> 00:33:35,400
Yeah, that's very true.
491
00:33:35,400 --> 00:33:36,600
That's good advice.
492
00:33:36,600 --> 00:33:42,840
I want to pivot me and something more recent with I'm sure you are well aware of the Pentagon
493
00:33:42,840 --> 00:33:43,840
leak, right?
494
00:33:43,840 --> 00:33:44,840
It's all over the news.
495
00:33:44,840 --> 00:33:50,440
The 24 year old had access to these classified documents.
496
00:33:50,440 --> 00:33:55,040
You know, the Justice Department is still kind of looking at how sensitive government
497
00:33:55,040 --> 00:33:57,520
secrets were shared like in a chat room, right?
498
00:33:57,520 --> 00:33:59,960
He was using what was it?
499
00:33:59,960 --> 00:34:03,480
My God, it was a discord or something like that.
500
00:34:03,480 --> 00:34:09,080
It was basically like a gaming fraud, right?
501
00:34:09,080 --> 00:34:14,720
So I mean, you know, some of the data he had access to was Ukrainian troop movements,
502
00:34:14,720 --> 00:34:19,320
whether or not Putin would use and when, what scenarios he would use, nuclear weapons.
503
00:34:19,320 --> 00:34:30,680
I mean, this type of data leak, the insider threat, I mean, how is this still possible
504
00:34:30,680 --> 00:34:33,040
in the environment that we live in?
505
00:34:33,040 --> 00:34:34,480
What are your thoughts on that?
506
00:34:34,480 --> 00:34:36,160
I mean, do you have any insights, any thoughts?
507
00:34:36,160 --> 00:34:39,200
Well, I mean, so we've got to look at it in terms of categories of stuff.
508
00:34:39,200 --> 00:34:43,120
Like, so first of all, insider threat is a really hard thing to protect against.
509
00:34:43,120 --> 00:34:48,960
I mean, you know, on the most basic and somewhat benign level, what salesperson has ever left
510
00:34:48,960 --> 00:34:52,920
company A to go to company B and not brought their contact list with them, right?
511
00:34:52,920 --> 00:34:56,560
I mean, you know, you know, that's happening.
512
00:34:56,560 --> 00:34:59,600
On the other hand, we're not dealing with sales contacts here, right?
513
00:34:59,600 --> 00:35:05,600
We're dealing with highly sensitive classified information that in theory shouldn't even
514
00:35:05,600 --> 00:35:11,200
have the ability to be easily copied onto a private network.
515
00:35:11,200 --> 00:35:15,680
So there's a couple of things that strike me that are a bit interesting about this.
516
00:35:15,680 --> 00:35:20,400
One is that it appears like these documents were photographed.
517
00:35:20,400 --> 00:35:22,840
So there's obviously some location.
518
00:35:22,840 --> 00:35:27,120
I mean, you know, you can't just take confidential information home with you, right?
519
00:35:27,120 --> 00:35:31,480
So or classified information, I should say, not confidential.
520
00:35:31,480 --> 00:35:37,680
So some aware somehow this individual is able to get a, you know, a phone into a skiff or
521
00:35:37,680 --> 00:35:40,120
wherever else they were using these documents.
522
00:35:40,120 --> 00:35:42,960
You know, the second thing that comes up, which we don't know much about, but I think
523
00:35:42,960 --> 00:35:47,400
is a good learning moment in the private sector, is it sounds like more than a thousand people
524
00:35:47,400 --> 00:35:50,040
had access to this classified information.
525
00:35:50,040 --> 00:35:53,680
You know, same thing to think about in your company, how many people have access to your
526
00:35:53,680 --> 00:35:56,640
crown jewels and they don't do they all really need access?
527
00:35:56,640 --> 00:36:02,520
I mean, I can't tell you how many times, especially like during an acquisition, I would go look
528
00:36:02,520 --> 00:36:09,200
at who has access to the entire code repository and nine times out of 10, it's every developer.
529
00:36:09,200 --> 00:36:11,440
That's utterly ridiculous, right?
530
00:36:11,440 --> 00:36:16,040
You know, even in the smallest of companies, you really only probably need three or four
531
00:36:16,040 --> 00:36:18,560
people that have access to the entire repository.
532
00:36:18,560 --> 00:36:19,560
Right.
533
00:36:19,560 --> 00:36:22,520
You know, otherwise people only need access to what they're working on.
534
00:36:22,520 --> 00:36:27,400
So really controlling that access of who's got access to what is a great thing to think
535
00:36:27,400 --> 00:36:28,400
about.
536
00:36:28,400 --> 00:36:33,560
Um, you know, the other thing is, you know, kind of pivoting off the whole fact that this
537
00:36:33,560 --> 00:36:38,440
was, you know, posted up in a gaming forum, just like the government needs to be looking
538
00:36:38,440 --> 00:36:39,960
everywhere for their stuff.
539
00:36:39,960 --> 00:36:41,120
So do companies.
540
00:36:41,120 --> 00:36:47,080
And the great thing nowadays is great automated tools that can help you find your information
541
00:36:47,080 --> 00:36:49,800
on the dark web, on the open web.
542
00:36:49,800 --> 00:36:54,780
And you know, if you've got any type of sensitive information of any size, you want to be looking
543
00:36:54,780 --> 00:36:56,880
for this stuff constantly.
544
00:36:56,880 --> 00:37:03,120
And it's not even just the highly sensitive government classified information.
545
00:37:03,120 --> 00:37:04,600
Sometimes it's even more benign stuff.
546
00:37:04,600 --> 00:37:08,920
I mean, I remember an incident a couple of years ago when I was working at IBM, I had
547
00:37:08,920 --> 00:37:14,440
this internal strategy presentation of, you know, what we were going to do over the next
548
00:37:14,440 --> 00:37:15,640
two years.
549
00:37:15,640 --> 00:37:18,800
And I showed it at a sale, an internal sales conference.
550
00:37:18,800 --> 00:37:22,720
And the next thing I know, those slides are posted openly on the internet, right?
551
00:37:22,720 --> 00:37:25,720
Now, I mean, I got it taken down.
552
00:37:25,720 --> 00:37:30,840
But if you're not looking for this stuff out there, how are you going to know?
553
00:37:30,840 --> 00:37:35,800
And you know, in the example I was using, it was just, you know, a little bit of education
554
00:37:35,800 --> 00:37:40,440
that was required of an employee, but also some education on my part of being a little
555
00:37:40,440 --> 00:37:44,600
more sensitive about where I talked about these things, right?
556
00:37:44,600 --> 00:37:47,400
So you know, there's learning opportunities there are bound, but I think there's a lot
557
00:37:47,400 --> 00:37:52,000
that can be learned from this incident is not that these things are never going to happen.
558
00:37:52,000 --> 00:37:53,840
It's doing two things.
559
00:37:53,840 --> 00:37:58,040
One, putting the right safeguards in place to limit how often it's going to happen.
560
00:37:58,040 --> 00:38:02,360
But more importantly, putting the safeguards in place to limit the blast radius of what
561
00:38:02,360 --> 00:38:03,640
gets relayed out there.
562
00:38:03,640 --> 00:38:08,160
I mean, if we go back to the Snowden incident as a similar example, look at all the stuff
563
00:38:08,160 --> 00:38:09,920
that guy had access to.
564
00:38:09,920 --> 00:38:13,000
Why does one individual need access to all of that?
565
00:38:13,000 --> 00:38:15,720
Yeah, that's a great point.
566
00:38:15,720 --> 00:38:16,720
It's a great point.
567
00:38:16,720 --> 00:38:20,000
So just in wrapping up, look, we talked about a lot of great topics.
568
00:38:20,000 --> 00:38:25,360
I appreciate, you know, we talked about AI and the speed of the speed that that's bringing
569
00:38:25,360 --> 00:38:27,240
and it's increasing.
570
00:38:27,240 --> 00:38:30,960
We don't track it in years anymore, the rate of innovation.
571
00:38:30,960 --> 00:38:32,720
It's a matter of days.
572
00:38:32,720 --> 00:38:37,600
We talked about nation state actors, the importance of an integrity of data and how that's kind
573
00:38:37,600 --> 00:38:42,680
of a threat vector that we really haven't, you know, when you talk about the triad of
574
00:38:42,680 --> 00:38:47,840
CIA, right, the integrity is probably the last frontier that that that we're going to
575
00:38:47,840 --> 00:38:49,880
start seeing some things take place.
576
00:38:49,880 --> 00:38:52,120
And we've talked about the changing infrastructure, right?
577
00:38:52,120 --> 00:38:55,720
I'm sure Jeff Bezos was happy to hear about your comments there.
578
00:38:55,720 --> 00:38:56,720
But maybe not.
579
00:38:56,720 --> 00:39:03,120
If he becomes a regulated critical infrastructure, he might not be too happy about it.
580
00:39:03,120 --> 00:39:08,960
So, so my question is, in closing, what are the two or three things you would advise our
581
00:39:08,960 --> 00:39:14,760
listeners that they should do today, keeping in mind our listeners are probably from that
582
00:39:14,760 --> 00:39:17,440
mid-market, you know, what are what are the two or three things?
583
00:39:17,440 --> 00:39:24,680
Yeah, so I think first and foremost, right, get an outside security assessment, right?
584
00:39:24,680 --> 00:39:26,120
It doesn't need to be expensive.
585
00:39:26,120 --> 00:39:30,640
It doesn't need to be overly complex, but get a third party to look at what you're doing.
586
00:39:30,640 --> 00:39:35,600
Because if you're in the mid-market, you may or may not even have a CISO, you know, which
587
00:39:35,600 --> 00:39:38,920
is fine, but you really need an hour, or even if you do, you still need to get a third party
588
00:39:38,920 --> 00:39:39,920
to look at what you're doing.
589
00:39:39,920 --> 00:39:44,600
You still need an outside opinion on, you know, how robust is your security posture?
590
00:39:44,600 --> 00:39:50,200
And once you get that assessment, you've really got to look at, you know, am I doing the basics
591
00:39:50,200 --> 00:39:51,200
or not?
592
00:39:51,200 --> 00:39:54,080
And if you're not doing the basics, then frankly, you need to invest.
593
00:39:54,080 --> 00:40:00,720
You know, this stuff, unfortunately, is not necessarily inexpensive, but it is, you know,
594
00:40:00,720 --> 00:40:03,280
one of the things you've got to do nowadays to do business.
595
00:40:03,280 --> 00:40:07,680
It isn't any different than paying for insurance or the sprinkler system in your building.
596
00:40:07,680 --> 00:40:11,280
It's just one of those things now you've got to do to be successful in business.
597
00:40:11,280 --> 00:40:14,760
And if you're not, it's not a question of if it's a question of when.
598
00:40:14,760 --> 00:40:18,080
And I can assure you from everyone that's ever been breached, they really wish they
599
00:40:18,080 --> 00:40:21,400
had made the investment to prevent it.
600
00:40:21,400 --> 00:40:22,400
That's really great.
601
00:40:22,400 --> 00:40:28,760
Caleb, I just want to thank you for your time for the very insightful and lively conversation.
602
00:40:28,760 --> 00:40:31,840
I appreciated everything that you shared.
603
00:40:31,840 --> 00:40:33,320
That's all for this episode.
604
00:40:33,320 --> 00:40:38,280
Make sure you tune in next time to Logically Speaking and stay cyber first and future ready.
00:00:00,000 --> 00:00:12,800
Welcome to Logically Speaking, where we discuss latest trends and challenges in the cybersecurity
2
00:00:12,800 --> 00:00:15,520
arena with top experts in their field.
3
00:00:15,520 --> 00:00:19,000
Today you're going to learn how to keep your data safe, your operations sound, and your
4
00:00:19,000 --> 00:00:21,400
business is ready for whatever comes next.
5
00:00:21,400 --> 00:00:23,400
This is Logically Speaking.
6
00:00:23,400 --> 00:00:29,920
Today we're speaking with Caleb Barlow, who comes with a plethora of experience and some
7
00:00:29,920 --> 00:00:30,920
really cool stories.
8
00:00:30,920 --> 00:00:34,720
So I'm going to ask Caleb to introduce himself.
9
00:00:34,720 --> 00:00:38,280
And our listeners are going to be at being for a great treat today.
10
00:00:38,280 --> 00:00:40,120
Caleb, could you introduce yourself, please?
11
00:00:40,120 --> 00:00:41,120
Sure.
12
00:00:41,120 --> 00:00:44,640
So full disclosure, Steve and I are buddies and we've worked together before, too.
13
00:00:44,640 --> 00:00:45,960
We should probably note.
14
00:00:45,960 --> 00:00:50,640
So there may be a little back and forth there.
15
00:00:50,640 --> 00:00:54,520
But hey, I've been in the cybersecurity industry for a long time.
16
00:00:54,520 --> 00:01:01,240
I ran Thread Intelligence and is a response at IBM, rebuilding the IBM X-Force.
17
00:01:01,240 --> 00:01:07,960
I've also run a working with Steve, a public company focused on compliance and the healthcare
18
00:01:07,960 --> 00:01:10,640
and for DOD contractors.
19
00:01:10,640 --> 00:01:17,320
And more recently, I do a lot of private equity work, all focused on cyber as well.
20
00:01:17,320 --> 00:01:18,320
That's fantastic.
21
00:01:18,320 --> 00:01:21,040
Well, thanks for taking some time to join us today.
22
00:01:21,040 --> 00:01:27,080
I really wanted to start out specifically talking about the mid-market and how the mid-market
23
00:01:27,080 --> 00:01:31,640
is handling the ever-changing cybersecurity landscape.
24
00:01:31,640 --> 00:01:38,160
So could you share in your opinion how that market addresses it or needs to address it?
25
00:01:38,160 --> 00:01:41,720
Well, I think mid-market is really tough, right?
26
00:01:41,720 --> 00:01:47,400
Because if we look at the broader landscape and then work our way down, if we were talking
27
00:01:47,400 --> 00:01:54,280
about large global banks, these are heavily regulated industries where even where there's
28
00:01:54,280 --> 00:02:00,280
not regulation, there's going to be expectations of how you protect someone's information
29
00:02:00,280 --> 00:02:03,400
and the privacy.
30
00:02:03,400 --> 00:02:08,080
But as we move down into the mid-market, two things happen.
31
00:02:08,080 --> 00:02:10,160
It's not that regulations aren't there.
32
00:02:10,160 --> 00:02:14,400
I mean, there's 52 different priest disclosure laws across the US.
33
00:02:14,400 --> 00:02:17,640
But they're far less applicable.
34
00:02:17,640 --> 00:02:20,600
They're very unlikely to be enforced, interestingly enough.
35
00:02:20,600 --> 00:02:28,480
We have all these disclosure laws and expectations on cybersecurity in the US and even more so
36
00:02:28,480 --> 00:02:29,480
around the world.
37
00:02:29,480 --> 00:02:36,000
But rarely do you ever see a case of someone paying a fine that's in any way substantial.
38
00:02:36,000 --> 00:02:40,720
But also, the challenge you run into in the mid-market is I think we were all working
39
00:02:40,720 --> 00:02:41,920
on the adage for years.
40
00:02:41,920 --> 00:02:47,960
In fact, I said this countless times, a cybersecurity incident is kind of like a bear attack.
41
00:02:47,960 --> 00:02:51,520
You don't need to, you don't necessarily need to outrun the bear.
42
00:02:51,520 --> 00:02:54,000
I just need to outrun you, Steve.
43
00:02:54,000 --> 00:02:57,400
That's good way to put it.
44
00:02:57,400 --> 00:02:58,720
But that's part of the problem, right?
45
00:02:58,720 --> 00:03:03,600
I can't tell you how many times that I would be in a boardroom when we'd be reading out
46
00:03:03,600 --> 00:03:06,320
an assessment.
47
00:03:06,320 --> 00:03:09,560
It might be a horrifically bad assessment.
48
00:03:09,560 --> 00:03:15,160
Your cybersecurity posture is just barely above having anything.
49
00:03:15,160 --> 00:03:20,080
And the only question you would get would be, well, how do I compare to my peers?
50
00:03:20,080 --> 00:03:23,760
And I think that has been the trend in the mid-market for a lot of time and for good
51
00:03:23,760 --> 00:03:30,200
reason because honestly, that's kind of what mattered at the time was as long as your defense
52
00:03:30,200 --> 00:03:32,280
is a little bit better than everybody else.
53
00:03:32,280 --> 00:03:37,800
Well, now enter AI, now enter the ability to scan for vulnerabilities anywhere on the
54
00:03:37,800 --> 00:03:39,080
internet.
55
00:03:39,080 --> 00:03:44,800
And it really doesn't matter because, you know, Nair DeWells have automated these attacks.
56
00:03:44,800 --> 00:03:50,000
They don't care if you're a big bank or you're a tiny real estate agent.
57
00:03:50,000 --> 00:03:54,040
If they can get money out of you, it's equal pickings.
58
00:03:54,040 --> 00:04:01,200
So I think what that, what this really changes to is a model where whether you are a small
59
00:04:01,200 --> 00:04:06,760
mid-market company doing, you know, real estate or a law firm or a bank, you know, small
60
00:04:06,760 --> 00:04:12,040
regional bank, you have to have the same security posture as the big guys.
61
00:04:12,040 --> 00:04:17,920
And you know, now the good news in all of this is that the way you're going to do that
62
00:04:17,920 --> 00:04:20,960
is through leveraging cloud environments and outsourcing some of this.
63
00:04:20,960 --> 00:04:25,960
And so it's, it is very attainable, which it wasn't probably five or 10 years ago, but
64
00:04:25,960 --> 00:04:28,240
you're going to have to pay attention to it.
65
00:04:28,240 --> 00:04:31,280
No, that's really good.
66
00:04:31,280 --> 00:04:36,720
Which industries do you still believe needs kind of, you know, there's industry segments
67
00:04:36,720 --> 00:04:43,600
that still needs that kind of catch up and prepare for the inevitable?
68
00:04:43,600 --> 00:04:46,000
I mean, what industries are most vulnerable in your opinion?
69
00:04:46,000 --> 00:04:48,640
Well, I don't even think it's so much most vulnerable.
70
00:04:48,640 --> 00:04:51,280
It's about where are people paying attention and where are people putting money at this
71
00:04:51,280 --> 00:04:52,280
problem?
72
00:04:52,280 --> 00:04:53,280
Right?
73
00:04:53,280 --> 00:04:55,920
In a lot of ways, I think everybody's vulnerable.
74
00:04:55,920 --> 00:05:01,440
If you move money in any way, shape or form, if you have goods that are of value, then
75
00:05:01,440 --> 00:05:03,760
yes, you're vulnerable, right?
76
00:05:03,760 --> 00:05:08,760
So I don't even think it's so much the targeting anymore.
77
00:05:08,760 --> 00:05:11,200
It's who's actually investing.
78
00:05:11,200 --> 00:05:16,320
And there are a few industries where this is very problematic, you know, probably the
79
00:05:16,320 --> 00:05:20,080
worst of which, which you and I have worked in is healthcare.
80
00:05:20,080 --> 00:05:22,400
And it is for a couple of reasons, right?
81
00:05:22,400 --> 00:05:27,200
One, a cybersecurity incident is not the worst thing that happens in a hospital on an idle
82
00:05:27,200 --> 00:05:28,200
Tuesday, right?
83
00:05:28,200 --> 00:05:32,360
I mean, all kidding aside, it is not the top priority.
84
00:05:32,360 --> 00:05:35,280
There are far worse things that can happen in a hospital.
85
00:05:35,280 --> 00:05:38,880
We just lived through two years of COVID, right?
86
00:05:38,880 --> 00:05:42,680
The second thing is a hospital is a distributed environment, right?
87
00:05:42,680 --> 00:05:46,720
The, you know, sometimes you have academic medical centers.
88
00:05:46,720 --> 00:05:51,360
You might have a situation where the doctor's practice operating the hospital is a totally
89
00:05:51,360 --> 00:05:52,800
different company, right?
90
00:05:52,800 --> 00:05:56,080
With totally different IT that runs on the same network.
91
00:05:56,080 --> 00:05:59,800
So there's a really good example of where things are really difficult for a whole lot
92
00:05:59,800 --> 00:06:01,760
of reasons.
93
00:06:01,760 --> 00:06:08,320
But also if we look at critical infrastructure, you know, I think people assume, okay, if
94
00:06:08,320 --> 00:06:12,080
you're an energy company, you need to have really robust security.
95
00:06:12,080 --> 00:06:15,880
Well, what if you're the supplier to that energy company?
96
00:06:15,880 --> 00:06:19,760
And that's, that's I think where, you know, people's eyes are really starting to open
97
00:06:19,760 --> 00:06:23,760
up is to recognize that it's not just about what you do.
98
00:06:23,760 --> 00:06:29,080
It's about what the people in your supply chain do that really also becomes deterministic
99
00:06:29,080 --> 00:06:30,080
in this.
100
00:06:30,080 --> 00:06:34,960
So, you know, I think the, the other challenge in this, and this is particularly applicable
101
00:06:34,960 --> 00:06:41,120
to the mid market is not so much looking at your company, you know, so I'm going to change
102
00:06:41,120 --> 00:06:45,440
your question here a little bit, Steve, but really looking at your supply chain.
103
00:06:45,440 --> 00:06:48,920
Who in your supply chain is vulnerable?
104
00:06:48,920 --> 00:06:53,800
And you know, let's face it here in the US, we love small businesses.
105
00:06:53,800 --> 00:06:55,200
We love the mid market.
106
00:06:55,200 --> 00:07:01,240
We love the idea of buying that difficult part from a small family owned business.
107
00:07:01,240 --> 00:07:02,640
That's great.
108
00:07:02,640 --> 00:07:07,320
But if that small family owned business isn't, you know, is your weakest link to a cybersecurity
109
00:07:07,320 --> 00:07:12,080
incident, then you know, that becomes really problematic.
110
00:07:12,080 --> 00:07:18,040
You mentioned supply chain and I know that you and I worked a lot with regards to like
111
00:07:18,040 --> 00:07:29,040
CMMC and the DOD supply chain, why is that taken so long for the DOD to kind of put that
112
00:07:29,040 --> 00:07:35,880
stake in the ground and say, this is what we're going to do to the 300 some odd thousand
113
00:07:35,880 --> 00:07:37,560
suppliers to the government.
114
00:07:37,560 --> 00:07:38,560
I mean,
115
00:07:38,560 --> 00:07:41,800
Well, I mean, the short answer to that is, you know, like anything government, it got
116
00:07:41,800 --> 00:07:48,880
mired in politics, so, you know, but I think in fairness, we all knew this going in, right?
117
00:07:48,880 --> 00:07:51,120
Anything that's a government issue, it's going to be slow.
118
00:07:51,120 --> 00:07:54,880
It's going to get recast three or four times.
119
00:07:54,880 --> 00:07:57,200
I don't think that's so much to what to look at.
120
00:07:57,200 --> 00:08:01,240
What's to look at is the momentum and the momentum behind this is something's going
121
00:08:01,240 --> 00:08:03,320
to happen.
122
00:08:03,320 --> 00:08:06,680
Even if it is a fraction of what people wanted to start.
123
00:08:06,680 --> 00:08:13,200
The difference is if you look at almost every regulation out there today, they got get all
124
00:08:13,200 --> 00:08:18,200
wishy washy on things like what exactly do you need to have in place?
125
00:08:18,200 --> 00:08:22,720
What is great about CMMC and frankly, where I think other regulations are headed is we
126
00:08:22,720 --> 00:08:26,680
start to get fairly prescriptive about what you need to have in place.
127
00:08:26,680 --> 00:08:33,160
I mean, five, 10 years ago, people were always scared to say, oh, you need to have certain
128
00:08:33,160 --> 00:08:37,280
capabilities because technology changed much faster than regulations.
129
00:08:37,280 --> 00:08:39,480
I think we're past that now.
130
00:08:39,480 --> 00:08:45,520
I think that if you don't have endpoint detection in place, if you don't have multi-factor on
131
00:08:45,520 --> 00:08:52,640
everything, if you don't have your network segmented, it is flat out negligence at this
132
00:08:52,640 --> 00:08:53,640
point.
133
00:08:53,640 --> 00:08:57,280
Like this is not the case of, oh, the bad guys broke in.
134
00:08:57,280 --> 00:08:59,280
It was a sophisticated attack.
135
00:08:59,280 --> 00:09:05,240
This is a case of owning a building and not having sprinklers and fire alarms.
136
00:09:05,240 --> 00:09:10,400
That's where regulations are starting to shift is there are some minimum expectations you
137
00:09:10,400 --> 00:09:11,400
need to have in place.
138
00:09:11,400 --> 00:09:16,000
Again, EDR segmentation multi-factor.
139
00:09:16,000 --> 00:09:18,240
You don't have those things in place.
140
00:09:18,240 --> 00:09:22,440
Don't cry when you get breached.
141
00:09:22,440 --> 00:09:24,400
You bring up a great point.
142
00:09:24,400 --> 00:09:31,040
This is something that we see, and I want to ask you your opinion on cyber insurance
143
00:09:31,040 --> 00:09:38,200
and whether or not at some point cyber insurers will stop pushing down these countermeasures
144
00:09:38,200 --> 00:09:41,600
as you lay them out and just go, I'm getting out of this business.
145
00:09:41,600 --> 00:09:44,920
It's too risky.
146
00:09:44,920 --> 00:09:47,920
I know you don't have a crystal ball, but what are your thoughts on that?
147
00:09:47,920 --> 00:09:55,720
I'm starting to see cyber insurance premiums go up by a factor of five, six times.
148
00:09:55,720 --> 00:09:57,800
That's how they make it not risky, Steve.
149
00:09:57,800 --> 00:10:00,400
It just charges a fortune.
150
00:10:00,400 --> 00:10:05,600
I mean, seriously, there are two fundamental things to recognize with cyber insurance.
151
00:10:05,600 --> 00:10:08,600
It is risky, so it's going to cost a lot.
152
00:10:08,600 --> 00:10:13,080
That's how they're managing their underwriting risk.
153
00:10:13,080 --> 00:10:22,960
The second thing to recognize with this is that they still need to sell the insurance.
154
00:10:22,960 --> 00:10:29,080
There is a definite balance between, thou shall have these capabilities in place or
155
00:10:29,080 --> 00:10:34,520
you're uninsurable and realizing that, hey, I still want to make a buck selling insurance,
156
00:10:34,520 --> 00:10:36,480
so I've got to take some risk.
157
00:10:36,480 --> 00:10:43,800
In a lot of ways, that industry is self-balancing, if you will.
158
00:10:43,800 --> 00:10:47,360
The challenge on cyber insurance is it's unregulated.
159
00:10:47,360 --> 00:10:50,680
It's not like auto insurance, which is regulated in most states.
160
00:10:50,680 --> 00:10:53,880
It's a little bit of the wild west.
161
00:10:53,880 --> 00:10:55,960
Again, I don't know if that's a problem.
162
00:10:55,960 --> 00:11:00,800
You could argue that as a problem or an opportunity.
163
00:11:00,800 --> 00:11:06,120
The other thing to recognize in all of this is the reason why cyber insurance is so expensive
164
00:11:06,120 --> 00:11:09,840
is because we keep paying the damn ransoms.
165
00:11:09,840 --> 00:11:12,760
I mean, hard stop.
166
00:11:12,760 --> 00:11:18,800
At some point, we've got to snap the chalk line down and stop paying ransoms.
167
00:11:18,800 --> 00:11:23,960
What's happening in this is that entire supply chain is making a ton of money off of this,
168
00:11:23,960 --> 00:11:28,280
not just the bad guys that get the ransom or might get the ransom, but the companies
169
00:11:28,280 --> 00:11:32,160
that facilitate those payments.
170
00:11:32,160 --> 00:11:37,720
There's an awful lot of money going out the door because we're paying ransoms, and in
171
00:11:37,720 --> 00:11:44,320
almost every case, it's because we didn't have the security basics in place.
172
00:11:44,320 --> 00:11:51,120
The optimistic side of me says that what's going to happen here is defenses are going
173
00:11:51,120 --> 00:11:56,800
to improve because if you don't have, again, key things like endpoint, multi-factor, and
174
00:11:56,800 --> 00:12:00,120
a segment of network, you're going to be uninsurable.
175
00:12:00,120 --> 00:12:05,960
On the other hand, the more negative way to look at this is maybe we should ban ransomware
176
00:12:05,960 --> 00:12:10,160
payments, which is something that gets kicked around every year or two.
177
00:12:10,160 --> 00:12:13,480
There's always the inevitable critical company that would go down and you wouldn't get your
178
00:12:13,480 --> 00:12:16,000
data back and nobody likes that.
179
00:12:16,000 --> 00:12:20,920
It's a really tough call, but what we have to recognize is this is a, cyber crime is
180
00:12:20,920 --> 00:12:25,680
now a trillion dollar market.
181
00:12:25,680 --> 00:12:34,400
It's bigger than the GDP of most, if not almost all European countries.
182
00:12:34,400 --> 00:12:38,880
At some point here, if we want to fix this problem, we've got to be willing to suffer
183
00:12:38,880 --> 00:12:45,400
a little bit, make it unprofitable, and if it's unprofitable, it goes away.
184
00:12:45,400 --> 00:12:50,200
You bring up an interesting question just popped into my head.
185
00:12:50,200 --> 00:13:00,120
What do you think should governments role be in this addressing this?
186
00:13:00,120 --> 00:13:05,000
Or should the government not be involved at all and leave it to the private sector?
187
00:13:05,000 --> 00:13:06,400
What are your thoughts on that?
188
00:13:06,400 --> 00:13:09,760
Well, every governor around the world has a different approach, but let's talk about
189
00:13:09,760 --> 00:13:15,800
this from a US-centric standpoint, just because that's where we're having this conversation.
190
00:13:15,800 --> 00:13:23,680
I think what we've historically done is we've defined our enemies as nation states, and
191
00:13:23,680 --> 00:13:25,200
we all know who those are.
192
00:13:25,200 --> 00:13:31,480
In addition to that, we've defined our critical infrastructure off of a World War II mentality.
193
00:13:31,480 --> 00:13:39,200
If you think of critical infrastructure, we think of water, power, dams, healthcare,
194
00:13:39,200 --> 00:13:40,200
that type of thing.
195
00:13:40,200 --> 00:13:46,240
I don't know about you, but in the dark days of COVID, that wasn't my critical infrastructure.
196
00:13:46,240 --> 00:13:56,680
My critical infrastructure was Amazon, Zoom, and Comcast.
197
00:13:56,680 --> 00:13:57,680
Those are not...
198
00:13:57,680 --> 00:14:01,640
Well, Comcast might be considered critical infrastructure, but Zoom and Amazon definitely
199
00:14:01,640 --> 00:14:02,640
are not.
200
00:14:02,640 --> 00:14:09,120
We've got to first of all really rethink what we depend on as a society now and reboot our
201
00:14:09,120 --> 00:14:15,400
thinking there, because if you don't have a robust internet nowadays, it gets really
202
00:14:15,400 --> 00:14:18,680
dark during days of COVID and things like that.
203
00:14:18,680 --> 00:14:23,280
I think the second thing to think about in all of this is government needs to really
204
00:14:23,280 --> 00:14:25,560
rethink who's the enemy in this.
205
00:14:25,560 --> 00:14:32,360
It's not just nation states, it's also organized crime.
206
00:14:32,360 --> 00:14:35,520
Espionage is an accepted international practice.
207
00:14:35,520 --> 00:14:39,520
It's been going on since the start of time, it will go on for millennia.
208
00:14:39,520 --> 00:14:45,360
There is limited things you can do when you bring politics into this.
209
00:14:45,360 --> 00:14:47,480
There's always...
210
00:14:47,480 --> 00:14:52,280
Cyber security is going to be an element of the battlefield from here forward, but there's
211
00:14:52,280 --> 00:14:58,040
a lot we can do, working even with nations that we may not get along with well on the
212
00:14:58,040 --> 00:15:00,720
organized crime side of this.
213
00:15:00,720 --> 00:15:06,400
I think that's one of the areas we really have to pivot dramatically is to think about
214
00:15:06,400 --> 00:15:12,480
the organized crime side of this and use that as the playground to develop cyber norms.
215
00:15:12,480 --> 00:15:17,200
I'll emphasize the word playground here, because you've got to run experiments, you've got
216
00:15:17,200 --> 00:15:20,280
to try things, you've got to see what works.
217
00:15:20,280 --> 00:15:26,720
There's a lot we can do on the cyber crime side without causing all kinds of political
218
00:15:26,720 --> 00:15:32,080
challenges and I think our governments need to get a little more active there.
219
00:15:32,080 --> 00:15:33,080
Yeah.
220
00:15:33,080 --> 00:15:37,720
I just want to clarify, did you actually say Amazon was now critical infrastructure?
221
00:15:37,720 --> 00:15:39,400
It is just in my opinion.
222
00:15:39,400 --> 00:15:42,720
I mean, think about it.
223
00:15:42,720 --> 00:15:53,040
But in all honesty, if you did not have Amazon, life changes dramatically.
224
00:15:53,040 --> 00:15:58,240
If you can't, well actually, let me be even more focused.
225
00:15:58,240 --> 00:16:02,880
If you don't have the ability to order goods online, have them delivered.
226
00:16:02,880 --> 00:16:05,560
There's a lot of stuff you just can't get now.
227
00:16:05,560 --> 00:16:06,560
Yeah.
228
00:16:06,560 --> 00:16:13,200
And there's a lot of businesses that start to have really significant supply chain issues.
229
00:16:13,200 --> 00:16:16,480
No, at the Rivera household, it was, yeah.
230
00:16:16,480 --> 00:16:18,880
I mean, put it another way.
231
00:16:18,880 --> 00:16:21,920
Could you work now without Zoom or its equivalents?
232
00:16:21,920 --> 00:16:23,280
Not at all.
233
00:16:23,280 --> 00:16:26,240
No, if we sit really here for the absolute right.
234
00:16:26,240 --> 00:16:27,240
Yeah.
235
00:16:27,240 --> 00:16:31,400
I mean, what would happen if we all had to go into the office next week?
236
00:16:31,400 --> 00:16:32,400
It would get ugly.
237
00:16:32,400 --> 00:16:34,800
I don't think I'd have an office to go into.
238
00:16:34,800 --> 00:16:35,800
Exactly.
239
00:16:35,800 --> 00:16:36,800
But all right.
240
00:16:36,800 --> 00:16:40,320
So what about like cyber warfare?
241
00:16:40,320 --> 00:16:48,440
I mean, how do you define that and how do you see that evolving?
242
00:16:48,440 --> 00:16:52,760
Because you mentioned it, right, because nation states and I mean, we've even seen recently
243
00:16:52,760 --> 00:16:57,640
with the conflict in the Ukraine that there's an aspect of that that's cyber related.
244
00:16:57,640 --> 00:17:00,280
I mean, you've been on the forefront of some of this.
245
00:17:00,280 --> 00:17:05,240
Can you talk a little bit about like how you see this evolving even further?
246
00:17:05,240 --> 00:17:09,880
Well, I think the conflict in Ukraine causes to learn something really interesting that
247
00:17:09,880 --> 00:17:11,920
we kind of weren't expecting, right?
248
00:17:11,920 --> 00:17:15,760
You know, I can't tell you how many times I've been asked like by reporters, like, is
249
00:17:15,760 --> 00:17:18,640
there a cyber armageddon coming, right?
250
00:17:18,640 --> 00:17:22,320
And you know, or a cyber 9-11 event, those types of things.
251
00:17:22,320 --> 00:17:25,720
And you know, the answer is always, of course, that's in the art of the possible.
252
00:17:25,720 --> 00:17:32,480
But I think we learned something really interesting in the conflict in Ukraine because in the
253
00:17:32,480 --> 00:17:37,440
role up to that, everybody was talking and worried about large scale cyber incidents
254
00:17:37,440 --> 00:17:43,280
because, you know, Russia, you know, Ukraine was Russia's playground for trying out various
255
00:17:43,280 --> 00:17:47,480
forms of cyber attacks for the last decade.
256
00:17:47,480 --> 00:17:52,600
But one of the things we learned is once actual kinetic bombs start flying, what do you need
257
00:17:52,600 --> 00:17:54,080
a cyber incident for?
258
00:17:54,080 --> 00:17:55,080
Right?
259
00:17:55,080 --> 00:18:00,080
Like, do you know, what's the point of breaking into the critical infrastructure if you're
260
00:18:00,080 --> 00:18:03,480
just going to blow it up with a kinetic bomb?
261
00:18:03,480 --> 00:18:07,160
You know, and as horrible as that sounds, it's kind of interesting because a lot of this
262
00:18:07,160 --> 00:18:09,320
stuff actually backed off.
263
00:18:09,320 --> 00:18:16,080
You know, the other interesting thing we saw is that various forms of cyber incidents
264
00:18:16,080 --> 00:18:22,880
kind of took a backseat because the last thing nations want to do is cause further opportunities
265
00:18:22,880 --> 00:18:26,960
for escalation while actual kinetic bombs are flying.
266
00:18:26,960 --> 00:18:33,400
So in a lot of ways, you know, we saw cyber take a step back in all of this.
267
00:18:33,400 --> 00:18:40,040
And my conclusion is that in a lot of ways, cybersecurity has kind of a new definition.
268
00:18:40,040 --> 00:18:45,040
You know, in the U.S., if we're unhappy with something that another nation does, that we
269
00:18:45,040 --> 00:18:50,600
don't want to get into a full scale armed conflict, you know, we use economic sanctions
270
00:18:50,600 --> 00:18:57,280
as our weapon of choice, if you will, to really kind of try to change and influence what another
271
00:18:57,280 --> 00:18:59,400
country might do.
272
00:18:59,400 --> 00:19:05,640
I think what we've started to see is that same level of response from companies that
273
00:19:05,640 --> 00:19:09,120
maybe don't have the ability to execute economic sanctions.
274
00:19:09,120 --> 00:19:15,280
When they get agitated, they lean towards cybersecurity as kind of their means of flexing
275
00:19:15,280 --> 00:19:17,040
their muscles.
276
00:19:17,040 --> 00:19:21,560
We've seen this both with the theft of intellectual property.
277
00:19:21,560 --> 00:19:28,880
We've seen this with responses to various actions that people may not like.
278
00:19:28,880 --> 00:19:32,840
And we've seen this in the opportunity to influence, you know, various forms of influence
279
00:19:32,840 --> 00:19:35,560
operations, misinformation, things like that.
280
00:19:35,560 --> 00:19:40,440
So my conclusion out of this, and this is just kind of a gut feel, not necessarily based
281
00:19:40,440 --> 00:19:49,000
on fact or research, is that cybersecurity is becoming the go-to tool for countries
282
00:19:49,000 --> 00:19:55,720
that are disgruntled at the West, where the West's go-to tool is oftentimes economic sanctions.
283
00:19:55,720 --> 00:19:58,320
And that's probably where these things are going to settle.
284
00:19:58,320 --> 00:20:04,960
The one exception to that is there are a few countries, you know, mainly North Korea is
285
00:20:04,960 --> 00:20:09,080
an example that are using cybersecurity actually generate revenue.
286
00:20:09,080 --> 00:20:14,000
But those are kind of singular in orientation.
287
00:20:14,000 --> 00:20:21,560
So and I appreciate those insights because those are very, you know, at the highest level,
288
00:20:21,560 --> 00:20:22,560
right?
289
00:20:22,560 --> 00:20:25,520
All companies operate in this global economy.
290
00:20:25,520 --> 00:20:30,000
And these things have these geopolitical issues have cascading effects.
291
00:20:30,000 --> 00:20:33,360
So I appreciate you bringing that up and mentioning that.
292
00:20:33,360 --> 00:20:40,240
So how do you think the cybersecurity landscape will change over the next five to 10 years?
293
00:20:40,240 --> 00:20:46,760
If you indeed had a crystal ball, what do you think the mid-market specifically will
294
00:20:46,760 --> 00:20:48,760
have to face over the next decade?
295
00:20:48,760 --> 00:20:54,120
Well, I think the biggest thing that we've got to recognize, if we look at ransomware
296
00:20:54,120 --> 00:20:59,280
as a attack pattern is, you know, when someone initiates a ransomware incident, they've got
297
00:20:59,280 --> 00:21:01,040
access to your systems, right?
298
00:21:01,040 --> 00:21:02,520
They can access your data.
299
00:21:02,520 --> 00:21:06,800
Otherwise, it would be really difficult to lock it up.
300
00:21:06,800 --> 00:21:10,640
You know, one of the things we're going to have to deal with at some point is Nairdwell
301
00:21:10,640 --> 00:21:15,600
is realizing that rather than locking up the data, it's far more efficient for them to
302
00:21:15,600 --> 00:21:17,360
change the data.
303
00:21:17,360 --> 00:21:22,800
And you know, when you have an incident where someone has changed data and you can't trust
304
00:21:22,800 --> 00:21:27,000
what's in your systems, that can be far, far more devastating.
305
00:21:27,000 --> 00:21:30,120
So I think one of the things we're going to really have to deal with over the next few
306
00:21:30,120 --> 00:21:32,720
years is kind of data integrity events.
307
00:21:32,720 --> 00:21:38,280
Now, again, imagine things like a supply chain or pharmaceuticals or things like that, where
308
00:21:38,280 --> 00:21:42,360
all someone has to do is allege and prove that they can change your data and now you
309
00:21:42,360 --> 00:21:44,960
can't trust anything.
310
00:21:44,960 --> 00:21:46,840
So that can be far more devastating.
311
00:21:46,840 --> 00:21:50,520
I think the second thing we're all going to have to deal with this is AI.
312
00:21:50,520 --> 00:21:53,600
And you know, we really don't know what that's going to look like yet.
313
00:21:53,600 --> 00:21:59,480
The most fascinating thing about AI is the pace of innovation is not measured in years,
314
00:21:59,480 --> 00:22:04,600
which is what, you know, we're all used to new technologies coming out that pace is measured
315
00:22:04,600 --> 00:22:10,800
in kind of years in terms of how fast things innovate, how fast you see new releases.
316
00:22:10,800 --> 00:22:16,640
In this AI world, we're seeing new innovations literally every three or four days.
317
00:22:16,640 --> 00:22:22,120
So, you know, I think what everybody's a little bit spooked about there is there's a lot that
318
00:22:22,120 --> 00:22:24,560
could go wrong with AI.
319
00:22:24,560 --> 00:22:28,400
There's certainly a lot that can go wrong from a privacy and security standpoint.
320
00:22:28,400 --> 00:22:33,160
And we're just moving so fast that we really don't know where this is going to land.
321
00:22:33,160 --> 00:22:38,600
Now, on the positive side of this, I think what we're also seeing as models that are
322
00:22:38,600 --> 00:22:42,400
going to be capable of solving some of the problems people haven't been able to solve.
323
00:22:42,400 --> 00:22:46,480
I mean, an average SOC nowadays receives more than a million events a day.
324
00:22:46,480 --> 00:22:49,440
There are SOCs out there that get several billion events a day.
325
00:22:49,440 --> 00:22:52,520
There's no way you're getting through that with human beings.
326
00:22:52,520 --> 00:22:57,000
So you know, the promise that people have been talking about for years where a, you
327
00:22:57,000 --> 00:23:02,320
know, intelligent agent could go through and really resolve a lot of these issues, find
328
00:23:02,320 --> 00:23:08,680
that needle in a stack of needles, likely starts to become true in some cases.
329
00:23:08,680 --> 00:23:13,480
But you know, again, it's a little too early to see how these things unfold.
330
00:23:13,480 --> 00:23:18,600
And the other thing is, although in the fullness of time, I'm sure we'll end up in the right
331
00:23:18,600 --> 00:23:19,600
spot.
332
00:23:19,600 --> 00:23:23,760
We don't know which is going to, you know, we don't know which is going to innovate faster.
333
00:23:23,760 --> 00:23:27,320
The bad ideas are the good ideas to protect them with AI.
334
00:23:27,320 --> 00:23:32,720
It's funny that you mentioned that because I'm thinking, you know, in our industry in
335
00:23:32,720 --> 00:23:38,520
cybersecurity, we're always playing that cat and mouse, you know, kind of reactive.
336
00:23:38,520 --> 00:23:45,880
And so I think that the bad actors are going to leverage AI and we're going to have to
337
00:23:45,880 --> 00:23:49,880
respond to it unless we leapfrog there.
338
00:23:49,880 --> 00:23:51,160
And I just don't see that happening.
339
00:23:51,160 --> 00:23:54,200
I just always see where maybe you can comment it.
340
00:23:54,200 --> 00:23:55,200
I personally.
341
00:23:55,200 --> 00:23:57,560
Well, here's the one thing we know for sure.
342
00:23:57,560 --> 00:24:04,000
If that giant sucking sound you hear right now is all of the money leaving the cybersecurity
343
00:24:04,000 --> 00:24:10,560
startups that have been the, you know, the coolest thing to invest in and all go into
344
00:24:10,560 --> 00:24:11,560
AI, right?
345
00:24:11,560 --> 00:24:16,840
I mean, you know, we've got RSA coming up here in another couple of weeks, at least one
346
00:24:16,840 --> 00:24:21,560
of recording this, I'm imagining every single vendor on that show floor is going to be talking
347
00:24:21,560 --> 00:24:25,640
about their AI solution, even if it's not real.
348
00:24:25,640 --> 00:24:28,640
So you know, on one hand, hey, that's great.
349
00:24:28,640 --> 00:24:29,640
That's exciting.
350
00:24:29,640 --> 00:24:32,960
But it's definitely going to change the dynamic.
351
00:24:32,960 --> 00:24:39,520
I think the other thing that's going to happen here is that, you know, today we all view
352
00:24:39,520 --> 00:24:45,520
ourselves as security professionals and kind of have a fairly well understood definition
353
00:24:45,520 --> 00:24:47,320
of what that means.
354
00:24:47,320 --> 00:24:53,760
I think trust and safety are really going to start to enter our lexicon in a very robust
355
00:24:53,760 --> 00:24:58,480
way where historically kind of trust and safety positions were really things that were reserved
356
00:24:58,480 --> 00:25:02,240
for companies like Amazon and Google and Microsoft.
357
00:25:02,240 --> 00:25:06,480
I think that's going to be a dynamic that lots of companies are going to be thinking
358
00:25:06,480 --> 00:25:12,600
about because, you know, when you start turning your operations or your systems or your supply
359
00:25:12,600 --> 00:25:18,040
chain or your plan over to AI systems, you know, you're going to need a robust trust
360
00:25:18,040 --> 00:25:21,520
and safety component to that because you're going to need to know how those algorithms
361
00:25:21,520 --> 00:25:23,800
think and what their boundaries are.
362
00:25:23,800 --> 00:25:25,160
Yeah.
363
00:25:25,160 --> 00:25:33,560
No one wants to run into a cyberdyne system launching AI that becomes self aware.
364
00:25:33,560 --> 00:25:37,840
Well, I mean, there it is utterly fast.
365
00:25:37,840 --> 00:25:41,760
You know, and I guess for the uninitiative, you have not played around with some of these
366
00:25:41,760 --> 00:25:43,280
solutions, you're missing out.
367
00:25:43,280 --> 00:25:48,160
Like some of what they can do is astounding.
368
00:25:48,160 --> 00:25:53,320
And but, you know, again, in the same front, some of what they can do is I mean, you can
369
00:25:53,320 --> 00:25:57,520
write a phishing email with chat GPT that there is no way you wouldn't click on.
370
00:25:57,520 --> 00:26:00,520
It's just too good.
371
00:26:00,520 --> 00:26:04,400
And I don't know how you put, you know, they like obviously if you prompt it, can you write
372
00:26:04,400 --> 00:26:06,920
me a phishing email for Steve Rivera?
373
00:26:06,920 --> 00:26:08,960
It's obviously going to say no.
374
00:26:08,960 --> 00:26:14,000
But if if I, on the other hand, put in a couple of your interests that I get off of, you know,
375
00:26:14,000 --> 00:26:18,080
your Facebook page, it's going to write a phishing email that's so good, there's no way
376
00:26:18,080 --> 00:26:19,760
you're not going to click on it.
377
00:26:19,760 --> 00:26:20,760
Yeah.
378
00:26:20,760 --> 00:26:28,480
And we used to chat GPT recently for an exercise to come up with a slogan for our company.
379
00:26:28,480 --> 00:26:32,960
And we we inputted a bunch of information and it came back with something pretty slick.
380
00:26:32,960 --> 00:26:40,400
And I thought, why are we spending all this money with a company to tell us what our marketing
381
00:26:40,400 --> 00:26:43,000
slogan should be our rally cry.
382
00:26:43,000 --> 00:26:44,760
And we were all pretty impressed.
383
00:26:44,760 --> 00:26:45,760
We didn't go with it.
384
00:26:45,760 --> 00:26:47,480
But but yeah, you're right.
385
00:26:47,480 --> 00:26:54,920
The AI engines are becoming astoundingly good at providing some of that information that's
386
00:26:54,920 --> 00:26:58,240
taken people, you know, humans a long, long time.
387
00:26:58,240 --> 00:27:02,440
But that's the other side of this, right, is there are entire jobs that are going to
388
00:27:02,440 --> 00:27:06,040
get disrupted, industries that are going to get disrupted.
389
00:27:06,040 --> 00:27:10,320
But the difference is that's not what we're used to, you know, we're used to scenarios
390
00:27:10,320 --> 00:27:15,920
that when a particular profession gets disrupted, it takes a course of like five years for that
391
00:27:15,920 --> 00:27:17,880
to occur.
392
00:27:17,880 --> 00:27:20,560
This is going to happen in weeks.
393
00:27:20,560 --> 00:27:24,240
I mean, I'll give you an example.
394
00:27:24,240 --> 00:27:27,560
Just because I was recently going through this in our family, you know, my daughter's
395
00:27:27,560 --> 00:27:30,600
been off applying to colleges and all that stuff.
396
00:27:30,600 --> 00:27:33,600
The college essay is done.
397
00:27:33,600 --> 00:27:35,600
Absolutely done.
398
00:27:35,600 --> 00:27:41,560
There is, I mean, we'll see how many colleges ask for an essay next year.
399
00:27:41,560 --> 00:27:42,560
But it's useless.
400
00:27:42,560 --> 00:27:47,400
I mean, every one of those essays is going to be put through a chat bot and it's going
401
00:27:47,400 --> 00:27:51,760
to be absolutely perfect tiered for her next year.
402
00:27:51,760 --> 00:27:53,840
So why are you wasting your time?
403
00:27:53,840 --> 00:27:57,920
Now I'm guessing most schools will probably still ask for them next year.
404
00:27:57,920 --> 00:28:04,240
But I literally think my daughter's generation is the last to actually put pen to paper and
405
00:28:04,240 --> 00:28:05,240
write an essay.
406
00:28:05,240 --> 00:28:08,880
And, you know, a perfect example of this.
407
00:28:08,880 --> 00:28:14,200
So, you know, all of her applications had to be done around like that October, November,
408
00:28:14,200 --> 00:28:17,280
timeframe, right as all this stuff was coming out, right?
409
00:28:17,280 --> 00:28:22,160
So she actually literally wrote all this stuff and it took weeks to do it.
410
00:28:22,160 --> 00:28:26,000
And we're driving in the, she's driving in the car.
411
00:28:26,000 --> 00:28:28,960
And I'm like, what was the toughest essay you had to write?
412
00:28:28,960 --> 00:28:31,000
And I'm like, what did they ask you to do?
413
00:28:31,000 --> 00:28:33,680
And I'm putting this stuff into chat GPT.
414
00:28:33,680 --> 00:28:35,440
And I read her what it wrote.
415
00:28:35,440 --> 00:28:37,120
She almost drove off the road.
416
00:28:37,120 --> 00:28:43,320
She's like, dad, that is so much better than anything I could have written or anybody else.
417
00:28:43,320 --> 00:28:44,320
How did you do that?
418
00:28:44,320 --> 00:28:46,040
I mean, it's done, right?
419
00:28:46,040 --> 00:28:50,040
But I show that as one example as security professionals that we're going to have to
420
00:28:50,040 --> 00:28:57,200
deal with is, you know, anytime there's disruption, there's opportunities for various security
421
00:28:57,200 --> 00:29:00,200
or trust and safety issues.
422
00:29:00,200 --> 00:29:03,840
But this isn't going to happen over a couple of years.
423
00:29:03,840 --> 00:29:07,160
Some of this stuff is going to happen nearly instantaneously.
424
00:29:07,160 --> 00:29:11,400
And that's going to be part of the problem is we've got to be ready to jump on this
425
00:29:11,400 --> 00:29:17,320
stuff really quickly, which means we've got to really be paying attention to it.
426
00:29:17,320 --> 00:29:28,920
So you paid a picture that is both exciting and frightening at the same time.
427
00:29:28,920 --> 00:29:35,760
How can organizations prepare themselves for that onslaught of AI driven fishing, spear
428
00:29:35,760 --> 00:29:41,440
fishing attacks that are going to invariably kind of attack their systems?
429
00:29:41,440 --> 00:29:42,440
What do you?
430
00:29:42,440 --> 00:29:45,600
Well, I mean, I think I do think there's some things we've really got to think about
431
00:29:45,600 --> 00:29:47,480
that we know about now, right?
432
00:29:47,480 --> 00:29:51,240
So, you know, if you ask me this question two weeks from now, I'm going to have a different
433
00:29:51,240 --> 00:29:54,800
answer and two weeks after that, I'm going to have a different answer, right?
434
00:29:54,800 --> 00:30:00,000
So, you know, and that's part of the point of answering this is that, you know, this
435
00:30:00,000 --> 00:30:01,000
is a cat and mouse game.
436
00:30:01,000 --> 00:30:02,800
We're going to be thinking about this constantly.
437
00:30:02,800 --> 00:30:06,880
So what I'm telling people right now is two things you need to think about.
438
00:30:06,880 --> 00:30:13,040
One, your company likely has very strong controls around its intellectual property and confidentiality.
439
00:30:13,040 --> 00:30:17,360
You know, you probably when you joined your company signed a confidentiality agreement,
440
00:30:17,360 --> 00:30:22,160
those things need to be immediately updated to talk about, are you allowed to put confidential
441
00:30:22,160 --> 00:30:24,880
information into a chatbot or an AI engine?
442
00:30:24,880 --> 00:30:30,960
Because remember, the difference is if I'm using something like Word to, you know, write
443
00:30:30,960 --> 00:30:35,160
a confidential document, big deal, Microsoft Word isn't learning anything from what I'm
444
00:30:35,160 --> 00:30:36,160
putting in there.
445
00:30:36,160 --> 00:30:43,400
On the other hand, if I'm uploading the secret formula into a chatbot, the chatbot is absolutely
446
00:30:43,400 --> 00:30:46,800
learning from what I'm putting in it.
447
00:30:46,800 --> 00:30:51,200
And you know, different chatbots, different algorithms are going to have different expectations
448
00:30:51,200 --> 00:30:53,440
around intellectual property.
449
00:30:53,440 --> 00:30:58,800
But I think companies need a strong policy on what is acceptable use.
450
00:30:58,800 --> 00:31:02,520
And the answer is it don't put anything in a chatbot because that's just not going to
451
00:31:02,520 --> 00:31:04,200
happen, right?
452
00:31:04,200 --> 00:31:11,000
But I do think, you know, there are some very sound ideas on what you should and shouldn't
453
00:31:11,000 --> 00:31:12,320
be putting in a chatbot.
454
00:31:12,320 --> 00:31:14,560
Okay, so that's one.
455
00:31:14,560 --> 00:31:21,440
The second thing is that, you know, we have to recognize that our incoming email is very
456
00:31:21,440 --> 00:31:24,080
rapidly going to be written by a chatbot.
457
00:31:24,080 --> 00:31:30,080
I mean, anybody in a sales position is using this thing for writing every email they write
458
00:31:30,080 --> 00:31:32,560
now, because it's just so good.
459
00:31:32,560 --> 00:31:37,320
And you know, what that means is that the historical mantra that you open every email
460
00:31:37,320 --> 00:31:44,200
and you read it, that probably has to go away, particularly at high executive levels, because
461
00:31:44,200 --> 00:31:49,360
the level of detail in there is likely going to cause you to click on things to open things.
462
00:31:49,360 --> 00:31:52,040
And what you've got to do is really change policy.
463
00:31:52,040 --> 00:31:56,760
In particular, you probably shouldn't be opening any attachment that doesn't come from a known
464
00:31:56,760 --> 00:31:58,720
source hard stop.
465
00:31:58,720 --> 00:32:03,680
I don't know what we do with things like recruiting, where there are lots of documents that are
466
00:32:03,680 --> 00:32:05,440
exchanged over email.
467
00:32:05,440 --> 00:32:12,960
I mean, you know, the opportunity to use a recruiter to get access into your company
468
00:32:12,960 --> 00:32:17,520
is just so easy right now, because you know, you're sending around resumes and people are
469
00:32:17,520 --> 00:32:19,480
loading and things like that.
470
00:32:19,480 --> 00:32:24,480
So you know, there are a few areas where if you move large amounts of documents, you've
471
00:32:24,480 --> 00:32:28,320
really got to get some tight controls in place because the opportunity for phishing is just
472
00:32:28,320 --> 00:32:29,320
too large.
473
00:32:29,320 --> 00:32:34,000
Yeah, I read an article this morning about a Samsung engineer who had put sensitive
474
00:32:34,000 --> 00:32:41,520
information at GPT and I thought, yeah, what you said is absolutely happening.
475
00:32:41,520 --> 00:32:47,240
There needs to be controls and needs to be policies because it's happening.
476
00:32:47,240 --> 00:32:48,240
Yeah.
477
00:32:48,240 --> 00:32:49,240
Unbeknownst to them.
478
00:32:49,240 --> 00:32:50,240
Well, and I think there's some common sense.
479
00:32:50,240 --> 00:32:55,800
Like for example, I've used it a couple of times for a document that would be quote unquote
480
00:32:55,800 --> 00:32:58,960
confidential if you knew who I was talking about.
481
00:32:58,960 --> 00:33:01,840
But if you didn't know who I was talking about is totally benign.
482
00:33:01,840 --> 00:33:07,080
So you know, I just changed the company names because I wanted to use chat GPT to help me
483
00:33:07,080 --> 00:33:08,480
get a point across.
484
00:33:08,480 --> 00:33:11,120
And it was fantastic at doing that.
485
00:33:11,120 --> 00:33:14,920
And I just didn't want it to know like who I was working with.
486
00:33:14,920 --> 00:33:18,920
So you know, there's a really simple thing you can do as an example to kind of clean
487
00:33:18,920 --> 00:33:19,920
that up.
488
00:33:19,920 --> 00:33:27,440
On the other hand, if you have some incredibly unique piece of code that no one in the world
489
00:33:27,440 --> 00:33:32,480
knows about, I would not be loading it up into a chatbot.
490
00:33:32,480 --> 00:33:35,400
Yeah, that's very true.
491
00:33:35,400 --> 00:33:36,600
That's good advice.
492
00:33:36,600 --> 00:33:42,840
I want to pivot me and something more recent with I'm sure you are well aware of the Pentagon
493
00:33:42,840 --> 00:33:43,840
leak, right?
494
00:33:43,840 --> 00:33:44,840
It's all over the news.
495
00:33:44,840 --> 00:33:50,440
The 24 year old had access to these classified documents.
496
00:33:50,440 --> 00:33:55,040
You know, the Justice Department is still kind of looking at how sensitive government
497
00:33:55,040 --> 00:33:57,520
secrets were shared like in a chat room, right?
498
00:33:57,520 --> 00:33:59,960
He was using what was it?
499
00:33:59,960 --> 00:34:03,480
My God, it was a discord or something like that.
500
00:34:03,480 --> 00:34:09,080
It was basically like a gaming fraud, right?
501
00:34:09,080 --> 00:34:14,720
So I mean, you know, some of the data he had access to was Ukrainian troop movements,
502
00:34:14,720 --> 00:34:19,320
whether or not Putin would use and when, what scenarios he would use, nuclear weapons.
503
00:34:19,320 --> 00:34:30,680
I mean, this type of data leak, the insider threat, I mean, how is this still possible
504
00:34:30,680 --> 00:34:33,040
in the environment that we live in?
505
00:34:33,040 --> 00:34:34,480
What are your thoughts on that?
506
00:34:34,480 --> 00:34:36,160
I mean, do you have any insights, any thoughts?
507
00:34:36,160 --> 00:34:39,200
Well, I mean, so we've got to look at it in terms of categories of stuff.
508
00:34:39,200 --> 00:34:43,120
Like, so first of all, insider threat is a really hard thing to protect against.
509
00:34:43,120 --> 00:34:48,960
I mean, you know, on the most basic and somewhat benign level, what salesperson has ever left
510
00:34:48,960 --> 00:34:52,920
company A to go to company B and not brought their contact list with them, right?
511
00:34:52,920 --> 00:34:56,560
I mean, you know, you know, that's happening.
512
00:34:56,560 --> 00:34:59,600
On the other hand, we're not dealing with sales contacts here, right?
513
00:34:59,600 --> 00:35:05,600
We're dealing with highly sensitive classified information that in theory shouldn't even
514
00:35:05,600 --> 00:35:11,200
have the ability to be easily copied onto a private network.
515
00:35:11,200 --> 00:35:15,680
So there's a couple of things that strike me that are a bit interesting about this.
516
00:35:15,680 --> 00:35:20,400
One is that it appears like these documents were photographed.
517
00:35:20,400 --> 00:35:22,840
So there's obviously some location.
518
00:35:22,840 --> 00:35:27,120
I mean, you know, you can't just take confidential information home with you, right?
519
00:35:27,120 --> 00:35:31,480
So or classified information, I should say, not confidential.
520
00:35:31,480 --> 00:35:37,680
So some aware somehow this individual is able to get a, you know, a phone into a skiff or
521
00:35:37,680 --> 00:35:40,120
wherever else they were using these documents.
522
00:35:40,120 --> 00:35:42,960
You know, the second thing that comes up, which we don't know much about, but I think
523
00:35:42,960 --> 00:35:47,400
is a good learning moment in the private sector, is it sounds like more than a thousand people
524
00:35:47,400 --> 00:35:50,040
had access to this classified information.
525
00:35:50,040 --> 00:35:53,680
You know, same thing to think about in your company, how many people have access to your
526
00:35:53,680 --> 00:35:56,640
crown jewels and they don't do they all really need access?
527
00:35:56,640 --> 00:36:02,520
I mean, I can't tell you how many times, especially like during an acquisition, I would go look
528
00:36:02,520 --> 00:36:09,200
at who has access to the entire code repository and nine times out of 10, it's every developer.
529
00:36:09,200 --> 00:36:11,440
That's utterly ridiculous, right?
530
00:36:11,440 --> 00:36:16,040
You know, even in the smallest of companies, you really only probably need three or four
531
00:36:16,040 --> 00:36:18,560
people that have access to the entire repository.
532
00:36:18,560 --> 00:36:19,560
Right.
533
00:36:19,560 --> 00:36:22,520
You know, otherwise people only need access to what they're working on.
534
00:36:22,520 --> 00:36:27,400
So really controlling that access of who's got access to what is a great thing to think
535
00:36:27,400 --> 00:36:28,400
about.
536
00:36:28,400 --> 00:36:33,560
Um, you know, the other thing is, you know, kind of pivoting off the whole fact that this
537
00:36:33,560 --> 00:36:38,440
was, you know, posted up in a gaming forum, just like the government needs to be looking
538
00:36:38,440 --> 00:36:39,960
everywhere for their stuff.
539
00:36:39,960 --> 00:36:41,120
So do companies.
540
00:36:41,120 --> 00:36:47,080
And the great thing nowadays is great automated tools that can help you find your information
541
00:36:47,080 --> 00:36:49,800
on the dark web, on the open web.
542
00:36:49,800 --> 00:36:54,780
And you know, if you've got any type of sensitive information of any size, you want to be looking
543
00:36:54,780 --> 00:36:56,880
for this stuff constantly.
544
00:36:56,880 --> 00:37:03,120
And it's not even just the highly sensitive government classified information.
545
00:37:03,120 --> 00:37:04,600
Sometimes it's even more benign stuff.
546
00:37:04,600 --> 00:37:08,920
I mean, I remember an incident a couple of years ago when I was working at IBM, I had
547
00:37:08,920 --> 00:37:14,440
this internal strategy presentation of, you know, what we were going to do over the next
548
00:37:14,440 --> 00:37:15,640
two years.
549
00:37:15,640 --> 00:37:18,800
And I showed it at a sale, an internal sales conference.
550
00:37:18,800 --> 00:37:22,720
And the next thing I know, those slides are posted openly on the internet, right?
551
00:37:22,720 --> 00:37:25,720
Now, I mean, I got it taken down.
552
00:37:25,720 --> 00:37:30,840
But if you're not looking for this stuff out there, how are you going to know?
553
00:37:30,840 --> 00:37:35,800
And you know, in the example I was using, it was just, you know, a little bit of education
554
00:37:35,800 --> 00:37:40,440
that was required of an employee, but also some education on my part of being a little
555
00:37:40,440 --> 00:37:44,600
more sensitive about where I talked about these things, right?
556
00:37:44,600 --> 00:37:47,400
So you know, there's learning opportunities there are bound, but I think there's a lot
557
00:37:47,400 --> 00:37:52,000
that can be learned from this incident is not that these things are never going to happen.
558
00:37:52,000 --> 00:37:53,840
It's doing two things.
559
00:37:53,840 --> 00:37:58,040
One, putting the right safeguards in place to limit how often it's going to happen.
560
00:37:58,040 --> 00:38:02,360
But more importantly, putting the safeguards in place to limit the blast radius of what
561
00:38:02,360 --> 00:38:03,640
gets relayed out there.
562
00:38:03,640 --> 00:38:08,160
I mean, if we go back to the Snowden incident as a similar example, look at all the stuff
563
00:38:08,160 --> 00:38:09,920
that guy had access to.
564
00:38:09,920 --> 00:38:13,000
Why does one individual need access to all of that?
565
00:38:13,000 --> 00:38:15,720
Yeah, that's a great point.
566
00:38:15,720 --> 00:38:16,720
It's a great point.
567
00:38:16,720 --> 00:38:20,000
So just in wrapping up, look, we talked about a lot of great topics.
568
00:38:20,000 --> 00:38:25,360
I appreciate, you know, we talked about AI and the speed of the speed that that's bringing
569
00:38:25,360 --> 00:38:27,240
and it's increasing.
570
00:38:27,240 --> 00:38:30,960
We don't track it in years anymore, the rate of innovation.
571
00:38:30,960 --> 00:38:32,720
It's a matter of days.
572
00:38:32,720 --> 00:38:37,600
We talked about nation state actors, the importance of an integrity of data and how that's kind
573
00:38:37,600 --> 00:38:42,680
of a threat vector that we really haven't, you know, when you talk about the triad of
574
00:38:42,680 --> 00:38:47,840
CIA, right, the integrity is probably the last frontier that that that we're going to
575
00:38:47,840 --> 00:38:49,880
start seeing some things take place.
576
00:38:49,880 --> 00:38:52,120
And we've talked about the changing infrastructure, right?
577
00:38:52,120 --> 00:38:55,720
I'm sure Jeff Bezos was happy to hear about your comments there.
578
00:38:55,720 --> 00:38:56,720
But maybe not.
579
00:38:56,720 --> 00:39:03,120
If he becomes a regulated critical infrastructure, he might not be too happy about it.
580
00:39:03,120 --> 00:39:08,960
So, so my question is, in closing, what are the two or three things you would advise our
581
00:39:08,960 --> 00:39:14,760
listeners that they should do today, keeping in mind our listeners are probably from that
582
00:39:14,760 --> 00:39:17,440
mid-market, you know, what are what are the two or three things?
583
00:39:17,440 --> 00:39:24,680
Yeah, so I think first and foremost, right, get an outside security assessment, right?
584
00:39:24,680 --> 00:39:26,120
It doesn't need to be expensive.
585
00:39:26,120 --> 00:39:30,640
It doesn't need to be overly complex, but get a third party to look at what you're doing.
586
00:39:30,640 --> 00:39:35,600
Because if you're in the mid-market, you may or may not even have a CISO, you know, which
587
00:39:35,600 --> 00:39:38,920
is fine, but you really need an hour, or even if you do, you still need to get a third party
588
00:39:38,920 --> 00:39:39,920
to look at what you're doing.
589
00:39:39,920 --> 00:39:44,600
You still need an outside opinion on, you know, how robust is your security posture?
590
00:39:44,600 --> 00:39:50,200
And once you get that assessment, you've really got to look at, you know, am I doing the basics
591
00:39:50,200 --> 00:39:51,200
or not?
592
00:39:51,200 --> 00:39:54,080
And if you're not doing the basics, then frankly, you need to invest.
593
00:39:54,080 --> 00:40:00,720
You know, this stuff, unfortunately, is not necessarily inexpensive, but it is, you know,
594
00:40:00,720 --> 00:40:03,280
one of the things you've got to do nowadays to do business.
595
00:40:03,280 --> 00:40:07,680
It isn't any different than paying for insurance or the sprinkler system in your building.
596
00:40:07,680 --> 00:40:11,280
It's just one of those things now you've got to do to be successful in business.
597
00:40:11,280 --> 00:40:14,760
And if you're not, it's not a question of if it's a question of when.
598
00:40:14,760 --> 00:40:18,080
And I can assure you from everyone that's ever been breached, they really wish they
599
00:40:18,080 --> 00:40:21,400
had made the investment to prevent it.
600
00:40:21,400 --> 00:40:22,400
That's really great.
601
00:40:22,400 --> 00:40:28,760
Caleb, I just want to thank you for your time for the very insightful and lively conversation.
602
00:40:28,760 --> 00:40:31,840
I appreciated everything that you shared.
603
00:40:31,840 --> 00:40:33,320
That's all for this episode.
604
00:40:33,320 --> 00:40:38,280
Make sure you tune in next time to Logically Speaking and stay cyber first and future ready.
