The Secure Communications Podcast

With today's wars increasingly being fought on an invisible front defined by data, the most innovative cybersecurity companies are finding new ways to protect data in motion.

On this week's episode of The Secure Communications Podcast, DataTribe cofounder Mike Janke talks about why he's excited about cutting edge technologies designed to secure machine to machine communications.

As a successful serial entrepreneur, cyber investor, and former member of Seal Team Six, Mike has a unique perspective on the importance of securing data and communications.

Listen to this week's episode to hear his thoughts on how data will define the wars of the future, what must be done to protect it, and who is doing the most innovative work in the field of secure communications.

Welcome to the Secure Communications Podcast Data in motion is complex, chaotic, and unsecure, but the ability to seamlessly communicate is what drives innovation, growth and progress. Discover how the leading minds in the fields of technology, cybersecurity and communications are tackling the challenge of securing data in motion, and gain insights into what's new and what's next on the Secure Communications Podcast. Each week, host Kathleen Booth interviews bold thinkers who are developing and/or employing transformational technologies to solve communication security challenges.

In addition to co-founding Data Tribe, Mike Janke is a founder and former CEO of Silent Circle, the world's leading Global Secure Communications service and the makers of Blackphone – Time Magazine's top 10 invention of the year. Mike is also a former member of the elite SEAL Team 6 as well as an author of two best-selling books on self-discipline, leadership, and performance.

He is the 2016 recipient of the Visionary of the year award from the Center For Democracy and Technology. Mike is also the founder of Blue Pacific Studios – a Los Angeles based Film production firm. Prior to starting Silent Circle, he was the founder and former CEO of SOC-USA one of the country's largest defense logistics and security firms headquartered in Washington DC, with over 10,000 employees in a dozen countries. Mike speaks around the world on Technology, Defense and Privacy.

• Check out the DataTribe website
• Follow Mike on LinkedIn

Kathleen (00:02): Thank you for joining this episode of the Secure Communications Podcast. I'm your host Kathleen Booth. And this week, my guest is Mike Janke, who is a five time CEO and investor, and a former member of Seal Team Six. Mike, you have such a fascinating background. Welcome to the podcast.

Mike (00:25): Thanks Kathleen. I'm honored to be on your podcast.

Kathleen (00:28): I am. I'm really excited to have you here because you know, we talk about secure communications on this podcast and that's a very deliberately, a very large umbrella. And it covers everything from secure voice to email, to how data moves between places. And one of the reasons I was really interested in having you on is you have this, this unique perspective, having been a founder of a cybersecurity, multiple cybersecurity companies, having served in the military and in a, in a branch of the military, in a, in a service that, that required a lot of secure communication capabilities. And now as an investor, you have this, this unique insight into what so many different companies are doing. So with that as a, as a starting point, maybe you could give a little bit more about your background and specifically what DataTribe is and what it's doing.

Mike (01:21): Sure. So I'll start from a little bit earlier where, you're right, in special operations, you know, everything you do is about secure comms, secure radio, secure satellites, secure everything. So you get a pretty good taste, you know, crypto drops crypto loads on this. When I left the Seal teams, I started a defense firm that became one of the larger defense firms in DC during 9-11 and after. But it's also where I saw a problem. You know, I had almost 8,300 employees at one time before I sold that company. And this was the age of BYOD. BYOD, bring your own device, right. And at the time there really wasn't anything other than maybe PGP email you know? Everybody had apps. They had Skype and there really wasn't any thought of secure communications as we think of it, voice and video.

Mike (02:29): So I saw that problem that was not being solved overseas with contractors, with government people. And so I got together with Phil Zimmerman the Internet Hall of Famer who's the creator of PGP as well as John Callas who was the chief cryptographer at Apple and the creator of Apple solid disc encryption. And we built, you know, a secure communication cyber company. And after many iterations, after a secure encrypted, world's first secure encrypted phone, black phone, built that along with a great team. And then many pure software cyber companies after that. Now you know, as things have changed, I, one of my investors that was a fan fantastic investor, Bob Ackerman of Allegis Capital out in Silicon Valley, who became more of my mentor in the venture side. And he and I founded DataTribe together five years ago. We saw that a different model needed to be applied.

Mike (03:43): And we also saw that the, the real innovation, the two to three generations ahead, or absolutely new category generation was coming out of the intelligence community and the classified research and development labs in the five nations, right? The five nations are the US, UK, Canada, Australia, and New Zealand, simply due to the sheer volume of government spending on the offensive side and the new R and D side. And it was, we're five to seven years ahead in some technologies over commercial. So we knew it took a different model. So, and we had invested in, in other companies, but more for me as an angel and him as a VC. And he has built the oldest and largest cybersecurity only venture capital firm in Silicon Valley. We started DataTribe here in Maryland, because this is the epicenter of where the offensive, and where all the talent is, and the forefront or the front porch of the nation state fight.

Mike (04:49): Right. And rather than being like a traditional VC, we, we created something called a startup foundry where the whole team at DataTribe are multi time CE, commercial CEOs, commercial CTOs, chief marketing officers who were also multitime CEOs. So operators. And we, we invest, you know, 2 million or more into a seed stage. We move them into our big facility and we literally embed. And the whole idea is to make it an unfair fight. So companies like Dragos and Enveil, Attila, Refirm, Prevailion, Strider are some of the more notable. We've had several on the cover of Wired Magazine, but it's, it's more akin to old school venture the way it was 30 years ago. A bunch of operators pulled money together, invested, moved the start up in and they just jumped in, right? Rather than 14 billion and you do 130 investments a year. It's just a different model.

Kathleen (05:58): Yeah. And some really impressive companies that have come out of it, as you mentioned. And, and that are still coming out because you're, you're actively continuing to incubate.

Mike (06:05): I'm there now.

Kathleen (06:08): So when you think about, you know, how, how things have evolved since your day back as a member of seal team six and really needing to communicate securely. And what you've seen through, as you described the, the nation state level efforts to, to develop technologies you know, clearly this is a problem that hasn't been solved yet. But there are so much interesting technology that is emerging. And, and specifically when it comes to moving data, which I think is becoming so much more important as we enter this, this time of big data you know? We have innovation like 5G coming down the line. There's so much going on, that's going to influence how we're able to use data in the future, but it doesn't really do as much good unless you can keep it protected. I'd love to hear kind of your perspective on where things stand with protecting data and what our biggest risks are right now.

Mike (07:01): Great question. Well, one of the things I will say is, you know, having been doing this a long time, you see a lot of the changes. So, you know, five years ago, people were worried about hackers who lived in their mom's basement or criminals, you know, sophisticated hacking. And that quickly shifted to nation States, you know, Russia, China, North Korea, Iran, massive criminal organizations in Eastern Europe. And you know, now every country has their version of the, of an NSA, right? And so this is what's non-kinetic war, right? Instead of planes and bombs and guys with guns, it's now in the digital realm. The digital substrate is where conflict is happening and it's, and it's unseen to most Americans. I mean, they're, every day there are articles, but you know, people become numb to it. There's no context, right? There's no plane blowing up. There's no CNN video of, you know, buildings burning in the Middle East, but it's just as real and so much like world war two. Silicon Valley is a product of when they put a ton of money into a microwave and chips and, and radars as well as nuclear out in Berkeley and the Stanford area after the war. The government had dumped billions into it with all these, this talent.

Mike (08:42): And those were the, the beginnings of what became Silicon Valley. You have these tens of thousands of PhDs and academics who have been working on, you know, silicone and, and nuclear or world war two. And now all of a sudden there's no work. So they took that and began to develop technologies. I mean, even the iPhone you carry around in your pocket came out of that government innovation. We're on that second wave now where over the last seven, and it'll keep going, Government has dumped so much money in the innovation and more in the software side, whether that's defensive architecture or offensive, and you're seeing cyber continue to be the benefit of it, as well as, you know, the darker projects. A lot of the hardware. But let's say, you know, during the Snowden incident, people, we equate secure communications with I'm on my cell phone and is somebody else listening or recording?

Mike (09:50): I'm doing a video chat. Is somebody recording and eavesdropping? But we have transitioned into more of a different version of secure communications machine to machine, right? One server talking to another machine. The human data being sent across networks is a machine to machine communication. Anytime you send up, you know, a record or an attachment to an email and it's processed by a machine, it's machine to machine. And now you have massive, massive data centers and fusion cells that are sharing data, both in the corporate world, government, same thing. Penetrating those type of communications or being a man in the middle is the new kind of what we need to secure communications. There's always the need to secure your voice and your video, but that's more of an emotional thing, right? And that, that still is an issue. It's debated on the Senate.

Mike (10:59): You know, they want a backdoor into this. And people often think well I have a VPN. That that's, that's nothing. That's like, you know, I put in a rain coat on to go out in a hurricane. That, that may protect you from the very low level somebody doesn't get your IP address, but it has moved way beyond that. You take technologies like Attila that came out of the classified community. That is a massive leap in generational security for both machine to machine data, as well as people, right. You can plug it into a laptop. And if you're speaking to somebody else with that, you're top secret level. Or in the virtual world, virtual machines, speaking to virtual machines so that, that, those types of innovations are the secure communications that we refer to today.

Kathleen (11:58): I think it's so interesting how you described that because it's true for, and I'm somebody who hasn't worked in the cybersecurity industry for a very long time, you know, it's been a year or so. And, and I come in, you know, as, as just a person off the street, let's say. And I think the person on the street for most people, when they think about this, they do think about, as you say, their email, their phone. But let's be honest, what most of us are talking about and sending in our emails is of no interest to anyone at all. Including the person we're probably talking to. But what I do think is so interesting, and this really kind of came into even starker relief for me the last three days, because we just hosted this virtual summit on IoT security is, is how I think the person on the street doesn't really appreciate the extent to which every aspect of our daily lives is ruled and governed and managed and operated via a connection to the internet. And if we lose that, that, that has a such a bigger impact on our day to day lives, than somebody intercepting, you know, my phone call to my husband or my email to whoever, for most people. I mean, it's different when you're talking about classified government communications, of course, and highly sensitive military communication, but for, for 98% of the world, it's, it's really those other aspects of how data moves. And for intellectual property of companies and things like that. So it's really interesting.

Mike (13:28): That's a really good point. I mean, the way I've, I view it today, the individual and the personal consumer security is really privacy, but because of this massive boom of data, machine to machine, massive data lakes talk to the massive data lakes. Our lives are existing through electronics today. You have secure communication, which is viewed in the world of technology is a different terminology, right? I need to secure my link to my third party companies. If I'm Ford, I may have 2,000 third party providers, right? If I'm going to send an intellectual property drawing and engineering down to them that they built, I need to have secure communications of my machines to their machines, to their virtual machines. If you're in the government, it's the exact same thing, right? How can you share, you know, from this database to that database outside of voice and video, right? And that is really secure communications. If you're an opposing nation state, why would you try to hack the CIA when I can find out where you live and why not hack your home network? I get everything off your machine anyways, right? So the targets are changing how they attack and what we're trying to score. Now, you look at 5G, right? I mean, how often do you send something on your phone? That's got everything. Your GPS location. They can tell your gate, how you walk, your head or your foot or your.

Kathleen (15:16): And if you've got a, one of these watches, they probably can get your, you know, your biometric information as well.

Mike (15:24): And that's pretty much machine to machine. Yeah. Right. There's nobody there coalescing that. That's going from a device to a cloud and then to a virtual machine and then do some processing analytics. And so this machine to machine secure communication is really what we talk about today when we say secure communications.

Kathleen (15:46): So why is this something that has not been solved yet?

Mike (15:49): I don't think it'll ever be solved. I mean, I don't think there's a Holy Grail. A lot of it is because there's one constant in life and that is change and progression, right. Taxes is probably right.

Kathleen (16:07): Yes. Death, right.

Mike (16:13): We're working on that too. But systems today, at the pace of innovation, they're 14 months here and they're almost already old. And attackers, you know, because you need to do so many things in order to have a company of a hundred thousand people working seamlessly. It's impossible to keep it locked down. You know, it's, it's just an impossibility. So understanding that there's always a bleeding edge of innovation. And typically when innovation happens, security is kind of an afterthought, right? You look at autonomous vehicles and look at drones and you look at all the, you know, the Alexas and any of the new technology that rolls out every year. It generally takes three to four years and all kinds of articles about people listening in Alexa or...

Kathleen (17:10): Ring cameras. Yeah.

Mike (17:12): Hacking an autonomous car and then people go, Oh, wow. We better secure that. And that's the nature of innovation. So, you know, we, we get better and better. The other issue is you have to think of the differences in the world. Okay? So in the Western world, the democratized world, we provide a firewall where our intelligence services and our military, their charter is not to help the commercial world, right. There's dot gov. And then there's dot mil in America. The CIA and the NSA, they're looking outward. They're not looking at work. They're not tasked with helping, you know, Goldman Sachs. That's not their charter, but in many other parts of the world, the lines are blurred between the government entities, the intelligence services and commercial. You take China, Russia, you name it. They hack on behalf of their economy. If they can hack into Johns Hopkins research lab and take the latest tech, they give that to corporations that are partially owned by the government and they compete with us commercially. So it's an uneven playing field where our commercial entities are left to their own devices, ie. money, CISOs, people to defend against very sophisticated nation states. That's not the same in other countries. You have China, Russia that controls the entire green line, the green VPN controls, what comes in or out. They control, you know, all of it. So it's easier in those terms, but it does impact their innovation a little bit. But that's the difference in the playing fields?

Kathleen (19:03): Yeah. I thought you raised a really interesting point, which is this, this blurring of the lines between political cyber offensive and economic cyber offensive efforts. And, you know, one of the things that I did when I came into the cybersecurity world was I read Andy Greenberg's Sandworm, which is such a phenomenal, I mean, I feel like it needs to be made into a movie because it reads like fiction. But frighteningly enough, it's not. But it's such a phenomenal book that, that explains like that, that exact kind of convergence of how you, you really can't separate the two anymore. And, and I think that's, it also underscores why it's so important for businesses to take security more seriously.

Mike (19:50): No, without a doubt. I mean, you still have what they call kind of the recreational malice individual somewhere who's trying to, you know, just for kicks. But you have, you know, criminal gangs that that'll have a thousand sophisticated programmers that just came out of the FSB or, you know, and then you have nation states who, you know, they don't have the same laws and restrictions we do. And they're not necessarily trying to, you know, breach DOD and NSA and stuff like that. They're helping their economies by stealing the latest fighter engineering plans from Lockheed, or they're helping their car industry by hacking into Tesla, Ford. So even the, the face of the warfare has changed, but it's just as damaging, right. Economic as well as the cyber war.

Kathleen (20:50): Now you earlier, you mentioned the term bleeding edge and that's one of the things that I love to dig into on this podcast is, who is doing the really innovative work that gets you excited. I, you know, and I know you get to see lots of different companies in your position at DataTribe and, and as an investor. So I'm really curious, what's getting you most excited these days?

Mike (21:11): Well, that's a tough question because I think I have the greatest job in the world where you get the scratch the intellectual itch every day. See some of the most amazing technologies. But we have a particular area where we focus on things that have never been done before. We're not looking for iterative technology, right? We're not looking for an endpoint or a threat Intel feed. That's 10% less filling and 5% less sugar than the other 62 that are out there. We're looking for things. If you look at our portfolio, you know, Dragos, well, they were in the Sandworm book. They were featured heavily in that book. If you take a look at Enveil, homomorphic encryption. Or Strider, economic espionage. Or Attila, you know, the next version of TS machine to machine, people to machine communication spaces where either nobody else is even playing.

Mike (22:11): So you're, you're creating a new category, but we're not just confined to cyber. We like to say we're cyber as well as data science. We see innovation coming out of areas that might have nothing really to do with cyber, but more architecture, right? So by way of example, many of the classified agencies and government agencies have a pipe of data they bring in that's many times larger than Google and Amazon, which is probably a hundred times larger than say Ford or Disney. But every year that goes by, the Ford and the Disneys are digitizing and the amount of their pipe gets bigger and bigger, but many architectures or the plumbing of networks breaks at that. You know, what worked three years ago, can't handle the speed, the scale, the size, whether it's analytics, messaging buses, you know. So, oftentimes you'll see innovation coming out of areas that's not sexy.

Mike (23:22): It's plumbing of networks. But let's say it's three generations ahead of Hadoop. Or, you know, it's a, it's a new way of compressed data storage to handle the massive loads of data that organizations get today. That might be 10 times bigger than they were three years ago. So the bleeding edge has many things. Yes, you can get excited by hoverboards and, you know, jet packs and autonomous driving and robots, and that is bleeding edge innovation, but there are other areas where innovation is happening at light speed that is hidden or not sexy, or it's, it's the magic that happens behind your iPhone. You know, 5G's one of those, right. People don't care, they just go, wow, that was fast. And now I can Skype 72 of my friends at the same time.

Kathleen (24:22): Hey, my zoom call doesn't glitch when I have a lot of people on it.

Mike (24:27): Three Netflix shows at the same time on my iPhone. But what innovation happened behind that architecture, behind that scene to deliver that is where the real innovation happened. And that's areas we, we look at as well. Most of what we see from the cyber side that comes out and is just generations ahead, or new, actually comes out of the offensive side. So let me explain. So when you've got spy versus spy, right, everybody agrees China, Russia, and many other countries are very sophisticated, right? They had, they're very, very sophisticated. So for our nation and some of the five nations, they have to create new ways, new tools of either penetrating a network or getting into you know a network or evading malware. And when they do that, after a while they realize, Oh my God, the whole world's susceptible to what we just created, what we were able to do. We should leave and build a defense for that. Because that's going to be extremely relevant in 12, 18 months. So that's an example of where defensive innovation and insights come out of offensive types of, you know, breakthroughs.

Kathleen (25:56): Yeah. It's fascinating. And any particular individual people or companies that, that you want to shout out that are doing really great work?

Mike (26:04): Well, I would be a Homer definitely by saying that, you know, a lot of the DataTribe companies, but there, there are some really interesting companies out there that are in that zone where people are looking at and going well, that's incredible, but does it really do what it says? If you think of homomorphic encryption, you know, which is kind of the Holy Grail of things if you, that came out of Fort Meade. If you think of a Strider, which is a unique company that is actually solving the economic, a non cyber problem from a big data perspective. And that's, that's one of the fastest growing companies by month over month growth that we've seen. And that's, people are like, what? Technology that, but when you think about it, the world is so intertwined. You know, companies, public companies, to grow, they've got to be in Asia, they've got to be in Israel, they've got to be in Europe, they've got to be in South America.

Mike (27:13): And many of them, their third party providers, many of the employees they bring in, their foreigners, are not all there just to work for the company, right. Stealing IP and so forth. Attila is another one. You, you take a look at Attila, right? That was a massive breakthrough at the NSA. What generally weighs 13 pounds and could never see the light of day for you to plug in, to speak to somebody else who had the same giant green device to plug in. Now you have a TS connection that Attila developed out of there. Something that's an inch by an inch that you can plug in and now it's virtualized, right? So most citizens will never see that, but that's now being implemented into corporations, right? So what was the state of the art for, let's say secure machine to machine, both physical, as well as virtual, you know. That's a seven generational leap on scale, security, size, and usability.

Mike (28:21): It's not sexy. The average user it's, it just happens behind the scenes. Those things interest me because they are very big leaps in the way things happen. And we're still, you know, we're just on the, on the cusp of what AI is impacting our, our world. And it'll continue at a rapid pace to impact our world. There's, there's some amazing breakthroughs. There's a company in Canada called MindBridge. The CTO and co founder was the chief architect of Watson, right? You've seen all the commercials and it's applied to probably one of the most archaic industries in the world, which is auditing of financials. Anybody who's worked for a company or been in a company, knows that once a year, you need to get audited and you pay a hundred thousand dollars to a big firm. They come in, but they only look at less than 1% of your financial data. They go through it and then they certify it.

Kathleen (29:22): And it's still an intensely painful process, even though it's just 1% of people looking at spreadsheets. Talk about an industry that's ripe for disruption.

Mike (29:32): And this, this company applied AI that can not only look at a hundred percent, but a hundred percent of your historical going back to 1900.

Kathleen (29:42): Wow.

Mike (29:42): They show you fraud, show you where you miscalculated, but where you're overspending this. So pretty soon, I mean, it's one of the fastest growing AI companies in the world. Pretty soon to be listed on the stock exchange or anything. It's gotta be AI that validates financials. It's just human error. Even if it's not, no,

Kathleen (30:03): I was going to say, now we just have to hope that that technology doesn't fall into the hands of the IRS or all of us are doomed for the mistakes we've made. Oh, well, so interesting. So if someone wants to learn more about DataTribe or the companies that you've funded, how can they do that?

Mike (30:22): You can just go to www.datatribe.com. You can see our companies you know, pretty much anywhere. Two of ours were just awarded the World Economic Forum innovators, right. And what's interesting about that, there were only six in the entire world selected in cybersecurity. Three of those came right out of here within a 20 mile radius of the NSA.

Kathleen (30:51): That's amazing.

Mike (30:52): In the world, right. So things are changing a lot where there are hubs and spokes of, of pure excellence. And two of them were DataTribe companies.

Kathleen (31:03): Yeah. And I'll give a little plug for the podcast because I did just interview Ellison Anne Williams from Enveil and I've interviewed Rob Lee from Dragos. So if you want to learn more about either of those companies, which were those two that you mentioned, check out some prior episodes because I will say with both of them, my main goal as host was to just not sound like an idiot as I interviewed them, because it's amazing what they're doing.

Mike (31:28): Yeah. And look to, to be selected at the World Economic Forum, when they look at, you know, 40,000 companies and they boiled it down and you got two of them right here, it's, it's an impressive. But they are doing not just cool stuff, it's really having an impact on the globe. And they're two of the smartest people I know.

Kathleen (31:48): Yeah. Well, and speaking of cool stuff, I think it really also does speak to the incredible work that you guys are doing at DataTribe that you've found these companies, you've really incubated them, helped them grow and kind of, you know, sent them out from the nest in a, in a position to really be successful. So kudos to you for that.

Mike (32:05): Oh, well, thank you. But you know, we love the podcast. We push that out far and wide. It's really, what I would say, topical information that is relevant to today, not, you know, things are rolled six months from now in the world of technology. So keep doing what you're doing

Kathleen (32:25): Well, thank you very much. I appreciate that plug. And thank you for joining me this week, Mike. It was a pleasure. And if you're listening and you enjoyed this episode, please consider leaving the podcast a review on Apple Podcasts or wherever you choose to listen. We want to hear from you. And if you have an idea for a future episode or a guest, tweet us at @AttilaSecurity. Thanks so much.

Most of the cybersecurity industry is focused on protecting data at rest or data in motion, but what about data in use?

On this week's episode of The Secure Communications Podcast, Enveil founder and CEO Dr. Ellison Anne Williams talks about her company's pioneering work in the field of homomorphic encryption, and how it is leading the charge in the category of privacy enhancing technology.

Listen to the episode to learn how the ability to protect data in use will drive innovation across a range of industries by improving access to information and enhancing collaboration in ways never before possible.

Dr. Ellison Anne Williams is the Founder and CEO of Enveil, the pioneering data security company protecting Data in Use.

Building on more than a decade of experience leading avant-garde efforts in the areas of large-scale analytics, information security, computer network exploitation, and network modeling, Ellison Anne founded the startup in 2016 to protect sensitive data while it's being used or processed – the 'holy grail' of data encryption.

Powered by homomorphic encryption, Enveil's award-winning ZeroReveal® solutions provide Trusted Compute in Untrusted Locations™, enabling previously impossible business functionalities for intelligence-led decision making. Leveraging her deep technical background and a passion for evangelizing the impact of disruptive technologies, Ellison Anne has helped define and advance the Data in Use security space and cultivated Enveil's capabilities into category-defining solutions that enable secure search, analytics, sharing, and collaboration.

In addition to her ongoing contributions as a cybersecurity mentor and thought leader, Ellison Anne has been recognized as an SC Media Reboot Leadership Innovator Award winner, a Woman to Watch in Security, and a CyberScoop Leet List Honoree.

She started her career at the U.S. National Security Agency and holds a Ph.D. in Mathematics (Algebraic Combinatorics), a M.S. in Mathematics (Set Theoretic Topology), and a M.S. in Computer Science (Machine Learning).

• Check out the Enveil website
• Follow Dr. Ellison Anne Williams on LinkedIn

Kathleen (00:01): Thank you for joining today's episode of the secure communications podcast. I'm your host Kathleen Booth. And today my guest is Ellison Anne Williams, who is the founder and CEO of Enveil. And I should say, Dr. Ellison Anne Williams.

Ellison Anne (00:19): Only when I'm in trouble.

Kathleen (00:22): Well, welcome to the podcast. I'm so excited to have you here because I'm really fascinated with Enveil's technology. And I'm also, I also just was so impressed to see that the company was chosen as one of the World Economic Forum's Technology Pioneers, which is an incredible honor, especially for a company as young as Enveil is. So with that as an introduction, I would love it if you could tell my listeners a little bit more about yourself and your journey, how you came to found the company, as well as what Enveil does.

Ellison Anne (00:53): For sure. So again, I'm Ellison Anne Williams, CEO and founder of Enveil. So Enveil is about three and a half years old as a company. Before that period of time, I spent about 12 and a half years or so at the National Security Agency and the Johns Hopkins Applied Physics Lab. And then before that, I spent some time collecting degrees. So being a highly technical background female, so PhD in math, pure mathematics, Masters in math, Master's in computer science and machine learning before it was ever the cool thing to do and to be. So that's a little bit about myself. In terms of the company itself, Enveil. So Enveil is a data security company. We focus completely on securing data in use when it's being used or processed. So what does that mean? So if you think about it, the way that people most often will meaningfully use or process data to extract those insights or that information is by running some kind of a search or an analytic over it.

Ellison Anne (02:02): So when we talk about securing the usage of data, we mean being concerned with the security posture of that search or of that analytic as it's being performed. So for example, we can do things like take searches, take machine learning models, encrypt them, and then go run them anywhere. Our software is installed without ever decrypting them at any point during processing. So as you can hear a little bit of in that high level description, this can completely change the paradigm of how and where organizations can securely and privately leverage data assets. And we can talk a lot more about that during our time together.

Kathleen (02:46): Yeah, I'm, I'm fascinated by this because, you know, having worked in cyber for a few years, and I'm not a highly technical cybersecurity expert, but you know, my exposure to the industry, all the conversation that I've heard has always been around data at rest and data in motion. And so this is one of the reasons I was interested in talking to you is, is your focus on data in use, which is this new area, or at least it seems new to me in terms of the attention it's getting. Why, why is it important to protect data in use? And, and is it that data, is it that protections for data at rest and in motion are not enough? Or is there some other reason that that's so critical?

Ellison Anne (03:28): They are different and they are complimentary. So if you think about data security or data period, it has three different states. So three big components of data security. So two of which you've just mentioned, right? So securing data at rest on the file system in the database, that also includes things like access control, for example. So that's one piece of what we call the data security triad. The second piece is securing it in transit. So when it's moving through the network communications. Secure communications fall in that piece of the triad. And then the third piece is what happens to that data when you go use it or you process it in some way? That's that search and that analytic component to it. So three elements. Securing data at rest, in transit and in use. They're all very different but they're all complimentary to each other.

Kathleen (04:22): So what is the risk inherent in not protecting data in use? What, what are the potential compromises that could happen? How could it be used maliciously?

Ellison Anne (04:37): So securing data in use represents a new horizontal commercial market. And I will answer your question via example. So one of the ways that we have been extremely engaged is in the financial services vertical, and specifically in the area of enabling secure data sharing and collaboration between two banks and across different jurisdictions that have privacy and secrecy regulations associated with them in a large multinational bank. So if you think about securing the usage of data, in terms of securely sharing and collaborating with data, say you've got a large bank and they have one jurisdiction in the UK and another one maybe in Singapore, and they want to be able to check and see, I see this customer, her name is Christina. She's coming to be onboarded at my UK branch of my bank. I want to know if any of the other jurisdictions in which my bank operates know anything about this individual at all.

Ellison Anne (05:42): But the issue is that looking for Christina and her information associated with her, like her place of birth or address things like that are actually very protected and regulated pieces of information. So they can't just be exposed in a Singaporean jurisdiction, for example. So we can take that inquiry or that search for Christina in the UK, encrypt it within the walls of the bank, send it over to the Singaporean branch, for example, and then have that search run without ever being decrypted in that other jurisdictional environment. Meaning none of that UK regulated and protected information is actually ever exposed out of the UK in the Singapore jurisdiction, but it can still be processed in its encrypted state. Encrypted results are produced as they're sent back to the originator in the UK where they can be decrypted and further consumed. So that bank over in the UK can obtain the insights from a jurisdiction like Singapore using very sensitive, protected information in the UK without ever exposing it outside of those walls. So that's why it's so important to protect data while it's in use, because it is business enabling, opening up these use cases that were never possible before.

Kathleen (07:03): So is it effectively a, well, let me back up, it sounds as though for this to be put into place, it requires probably what is an incredibly complex set of rules. In other words, governing what data can be seen by who. Would that be accurate?

Ellison Anne (07:24): You always want some access control on your data. That's back to the data at rest portion of that. So for us, we're going to respect whatever access controls and access provisions and auditability provisions that, that data owner, no matter who they are, bank, healthcare organization, et cetera, has put in place for their data. And that's very, very important. So are there a lot of governing pieces that are required? Not really. But there are some, and those already exist within those types of regulated environments and we overlay and respect all of those governing elements in order to enable this kind of, for example, secure data sharing, to occur in this completely decentralized way. So in other words, data stays in UK. Data stays in Singapore and you still allow the usage of it while still complying with all of that governance. That's dictated by the regulatory bodies in those jurisdictions.

Kathleen (08:23): So this also sounds like it would have some potential applicability in, for example, healthcare with patient data. Is that an industry that you're involved in or you foresee being involved in?

Ellison Anne (08:36): I think there's tremendous opportunity within healthcare under that macro umbrella of secure data sharing and collaboration because health data is extremely sensitive. And when you start talking about getting a good global picture of what's going on from a health standpoint, in terms of diagnosis or development or things like that, then sharing that data is very, very important. But because of the sensitivities, you can't all combine it in one place because where would you put it right? Or regulatory standpoint. So being able to leave it in its originating location. So in a completely decentralized way, however, still allow it to be used and derive those insights in such a way that respects the security and privacy of those patients over that health information and the regulatory bodies within those countries is very, very important. And it's an excellent business enablement of a secure usage of data.

Kathleen (09:32): Yeah, it sounds to me like it, it changes the world that we live in from a, from a binary world in which you either have access to the data or you don't, to a much more nuanced place where you have access to just those portions that you need while never taking ownership. Does that makes sense?

Ellison Anne (09:52): Yes, that's correct. It opens up a whole new world of what is in the land of the possible today in terms of leveraging that data, wherever it may live, in its fullest form.

Kathleen (10:05): So you call this homomorphic encryption, correct?

Ellison Anne (10:10): So homomorphic encryption is what powers our capabilities. So homomorphic encryption, I'll define it for you. It's very actually simple in definition, but it's very powerful, which is why it's often considered to be that Holy Grail of encryption. But homomorphic encryption allows you to perform computations in the encrypted domain or cipher text space as if it's in the un-encrypted world or the plain text space. So for example, using homomorphic encryption, if I encrypt the number three and I encrypt the number two and I multiply those things together, and then I go decrypt that product, then I get the value of five on the other side. In other words, something meaningful when I go decrypt it, if you take any other type of encryption, say AES 256, and you encrypt three and you encrypt two and you multiply those things together and then you go decrypt it, you get absolute garbage. That's the power of homomorphic encryption. So in concept, it's very simple.

Kathleen (11:18): Why has this not been available before?

Ellison Anne (11:22): That is a great question. So homomorphic encryption is not new. It's been around about 35 years at this point, but it's been up to probably about five years ago, four years ago when we started the company. Computationally, impractical. So possible, but not practical. And so being possible is not good enough, right? For commercial use cases to really add that business value, it actually has to be practical, practically usable. So, breakthroughs that we had in homomorphic encryption and the way that you leverage homomorphic encryption took it from the land of the impractical to actually being ready and practical today for a wide range of use cases.

Kathleen (12:08): And is this something that has been used in, historically, was it used in the government more because of the difficulty of commercializing it or, and is it now only just being commercialized? In other words, or is it, are we taking something that has been in use and bringing it to the private sector or is it really new to government as well?

Ellison Anne (12:23): Well, historically it's not been computationally practical for really anybody, okay? So if it's not practical, it's not going to be used very effectively. However, because of its power, and I only gave you one use case and we talked about financial services a little bit, a little bit about healthcare. We could go on for a very long time about how this is paradigm shifting in a number of ways, but because of that kind of power, it's been pursued for a long time. So it's been a very active area of research in the community for many years, trying to drive it toward practicality, because wow, if it were practical, I think of all the things that you could do, which is exactly what we're doing as a company now. So was it in use? No. Were people actively really trying to work on it? Absolutely. Yes.

Kathleen (13:16): So whenever we talk about encryption, one of the questions that comes up is how hard or easy is it to break that, correct?

Kathleen (13:25): Especially, you know, just did one of my last interviews. I talked to Ron Gula about quantum computing and how it's not here yet, but it will be at some point. And so these are things we need to be thinking about now as we encrypt data. So when it comes to homomorphic encryption, how, how strong is it? Is it something that, that will be able to live on through the quantum computing age and, and what do you see in the future as far as its applicability?

Ellison Anne (13:51): So there are many different types of homomorphic encryption, and they are extremely secure. So nation state level secure. And there are a variety of ways that you can ensure that to be the case. So that's the first answer. The second, in terms of quantum, there are types of homomorphic encryption that are lattice based cryptography and that those are believed to be quantum resistant. So, yes.

Kathleen (14:19): Okay.

Ellison Anne (14:20): All good on the security of HE.

Kathleen (14:22): Checking that box. Right. so, so you mentioned there are so many different ways this could be used. I would love to hear, when you think about what gets you most excited when you get up and go into work, and you think about the possibilities or how this could be used in the future, what, what are you most excited about?

Ellison Anne (14:37): Well, gosh, many, many things. So we've talked about security, enabling secure data sharing and collaboration. I think that that is extremely, it's also extremely horizontal. So that could be financial services. That could be healthcare. That could be clouds. That can be oil and gas. Anywhere you have data and you want to share and collaborate in a way that respects the security and privacy. This allows that to be possible in a way that was never possible before. So that's extremely exciting. A Use case umbrella that we haven't talked about that I think is particularly exciting is in enabling secure data monetization because it's creating new revenue streams. So large enterprises organizations are always looking for ways to create new revenue, and that's never more true than today. And so one of the ways that they did that is they often look internally to their own data assets and say, how can we create new revenue streams on top of our data assets? In other words, monetize them.

Ellison Anne (15:40): And then the next question that comes after that is, okay, well, how would we do that in such a way that would respect the security and the privacy of those underlying data assets, as well as the security and privacy of the users of the monetization platform that we would create? And typically, that's where it stops because there, there really aren't great ways to do that for certain types of data. However, we enable that with these kinds of capabilities, for the secure usage of data to be uniquely possible. So opening the door for these new revenue streams, and enabling secure data monetization, I think is extremely exciting as well.

Kathleen (16:21): That is really interesting. And I've worked with several different companies that, that are commercializing data or selling data. And, and it sounds as though this is something that could really be built into to their platforms, but then also, what I find intriguing about it is that it opens up new possibilities for even pricing structures. You know, how you set up access to data platforms and, and giving more discrete options for people to, or to purchase in to specific segments of the data that are most applicable to them, as opposed to buying a prepackaged tier or offering and having data that maybe they don't need, but that's just part of the package. Does that make sense, is that, is that a possible use case for it?

Ellison Anne (17:13): So in terms of being a data aggregator we certainly don't do that as a company. And secure usage of data doesn't equal that aggregation. That's, it's something complimentary but a little bit tangential. I think what it does enable in the world of data aggregation or data lake or data marketplace is a decentralized form of that. So, and, and instead of having to centralize all of the data for a data lake, a data marketplace, you can leave it in its points of origination, which respect those kind of regulatory requirements or sensitivities around the creation of data, and then push your utilization of that data, your search, your analytic out into that data location in such a way that the security and privacy at all points is respected. So I think it allows and enables a different fabric and structure for a data lake that ultimately allows you to have better usage and utility and a richer type of insight that you can derive from the data resources that would be available in that platform.

Kathleen (18:26): How accessable is the technology to the marketplace? Meaning, is this something that you need to be a very large, you know, Fortune 100 company to use? Or, or, and I guess my question is really in two parts, how accessible is it now? And eventually how accessible do you foresee it becoming?

Ellison Anne (18:41): So it's extremely accessible today. So what we do is provide lightweight software applications. So in order to secure the usage of data, you deploy our software applications, we integrate with several things very easily and through API. And basically that's it, it's away you go. And it's GA and it has to be JLL on time and all kinds of certifications associated with that software. So today it's very easy. It's very GA. You can buy it, et cetera. Now in the future the, the vision is of course, as you create this new commercial market for the secure usage of data, securing data in use because either where the tech doesn't exist at all, or it doesn't exist in a practical form, which was the case with ECI, nor does the commercial market. So the minute it exists in a practical form, now we get to have the privilege, the challenge, of creating this new commercial market securing the usage of data. And so the end state vision of that is eventually, these capabilities become ubiquitous because it's the way that you do share and collaborate. It's the way that you effectively monetize data resources, et cetera.

Kathleen (19:55): It also seems like the regulatory frameworks around the world are driving in this direction. Increasingly. I mean, when I think about Europe and some of the privacy regulations they've been putting in place, and we have States like California moving more in that direction here, I feel like this is the way the world is going. And, and you're so well timed to be able to enable it more effectively, particularly for organizations that, that span multiple jurisdictions, if you will.

Ellison Anne (20:19): Correct. And the regulators are really leaning into this in the commercial world and in particular in financial services. So the FCA, financial conduct authority, which is the regulator out in the UK, put on a, ran what they call a tech sprint, which is a really collaborative effort between banks and innovative companies with new technology solutions around a specific problem set. So for the FCA, they had a tech sprint last summer that was centered around privacy enhancing technology. So privacy enhancing technology is just an umbrella term for a family of technologies that enable and enhance privacy while you are using or processing data, securing the usage of data. Homomorphic encryption is one of those secure. Secure multi-party compute is another. Trusted execution environment. Enclaves is another one. Those are kind of the main three that you would think about, but they recognized the power of privacy enhancing technologies of homomorphic encryption and said, Hey, can we explore and develop solutions in conjunction with the banks around

Ellison Anne (21:30): how can privacy enhancing technology solve major problems in the money laundering world? Because that problem represents 2% of our global GDP. So it's a big problem space. And so they put on the tech sprints and we solutioned for, along with HSBC and Barclays and ING and E and Y and Definitive, the KYC CDD use case. So know your customer, customer due diligence. So it's that use case that I just gave you earlier, where you've got somebody that walks up to a bank and they want to onboard, and who are they? Like, how do you do due diligence on them and make sure that they are in fact reputable? They're not trying to launder money through your system. So we solutioned for that use case. We won that use case out in the UK for the FCA simultaneously FINSIN. So are you talking about regulator in the US ran a tech sprint around privacy enhancing technologies? We also won that use case. So why do I say that? A couple of things. One of course, it's a testament to the fact that our capabilities are very powerful and impactful in that use case. But two, you see direct regulator lean in around embracing these new technologies that are now ready for mainstream and that are now in a practical capacity.

Ellison Anne (22:45): You mentioned the World Economic Forum at the top, right? We were just named. I can't forget that. Right?

Kathleen (22:51): It's amazing.

Ellison Anne (22:53): We were just named by the World Economic Forum to be one of their 2020 Technology Pioneers. And that's a huge honor for us because they selected a hundred companies globally. It's a two year honor, by the way. So a hundred companies globally, only six of which were cybersecurity, security companies. And out of that six, we were the only company solutioning around privacy enhancing technologies to secure the usage of data. So huge, huge honor.

Kathleen (23:22): Yeah. And it really speaks to not just the commercial potential of the business, but really the geo, the geo political and economic impact that you can have around the world, which is why I was so interested to learn more about it. It's, it's fascinating. It really is. And, and it does seem as though the potential for changing the way organizations do business, changing the way governments streamline information sharing, I mean, talk about a huge challenge that has not yet been solved. Filling out the same form a thousand times across different parts of our government. I mean, I think even now in a time like COVID-19 when you have people filing for unemployment and, and, you know, facing days of, of wait times to file their forms. And I just, my head is sort of exploding with, if this were something that were already in place, how could it have really changed our experience in the last several months and streamlined the ability for people to, to file unemployment and get paid quickly?

Kathleen (24:20): I'm sure there are thousands more use cases, but that's one that immediately springs to mind that's a pain point for a lot of people right now. So it's great. Well, changing gears for a minute. Outside of the work you're doing with Enveil and outside of homomorphic encryption, and some of the things that you're doing with data in use, with the way that we communicate and manage data changing so quickly in the world that we live in today, what do you see as the biggest challenge that we're going to face in the next few years?

Ellison Anne (24:53): I think the biggest challenge we're going to face, and it dovetails back into, of course, what we're seeing, is around the global demand for privacy and the regulatory requirements that are following that. Because if you talk about anything with data, with communication, with storing it, with using it, you have to respect the privacy implications of that. And that's never more true than today. And we've never seen it grow with the same rate. And so that has implications for how you communicate, how and where you're able to store data with that, a residency and localization types of requirements. And then finally, you know, how you use data. So I think that surge of privacy and the regulatory requirements that are following that are going to change everything

Kathleen (25:47): Now, outside of Enveil also, are there any particular companies or individuals that, that you think are doing really interesting or forward-thinking work in the area of privacy enhancing technologies?

Ellison Anne (26:01): Hmm. That is a good question. And we've certainly seen people start to solution in this space. So one of the ways that we know that we are succeeding in creating this new emerging commercial market, because when we started the company three and a half years ago, we looked around and guess what? It's only us, right?

Kathleen (26:23): You can't have a category of one, right? There needs to be an ecosystem.

Ellison Anne (26:26): It's really only on us. We were the, this was, this was never more apparent than the RSA Innovation Sandbox back in 2017. So we were the youngest company ever to be in the Innovation Sandbox. And so we thought, well, this is a great opportunity at the very least to get up and tell our story at the Sandbox. But typically, companies are where we are today or later, a little bit later stage before they ever make it into the Sandbox. So we made it in and stood up there and said, Hey, we've got breakthroughs. And this really powerful capability called homomorphic encryption, the Holy grail of crypto, it's going to change everything. And everybody went, wow, they're, they're the only people saying that.

Kathleen (27:08): Is it real?

Ellison Anne (27:08): Is it real? Does it work? That can't possibly be true? It sounds like magic, right? It's not magic. It's just math, but it was that journey.

Ellison Anne (27:17): So now it's very different. So homomorphic encryption, it's, it's very buzzy. Privacy enhancing technologies are, are important. They're recognized. They're breakthroughs in them. They're practical. And so as a result, we're seeing a landscape of people solutioning around it. And to us, that is an extremely positive sign.

Kathleen (27:37): So any, anyone in particular stand out?

Ellison Anne (27:42): Not to me yet. No.

Kathleen (27:45): All right. Well, we're going to have to keep our eye on that then, and maybe I'll come back to you in a few months or a year, and we'll, we'll see if that changes. That's how, you know, the category is really firming up. Right?

Ellison Anne (27:53): There you go.

New Speaker (27:56): Alright. Well, thank you so much for joining me this week. It's been fascinating. I'm really, and I can't wait to see where you go with this and how it honestly changes the world around us. And if you're listening and you enjoyed this episode, of course, please consider leaving the podcast a review on Apple Podcasts or wherever you choose to listen. We want to hear from you. And if you have an idea for a future episode, please Tweet us at @attilasecurity. Thank you so much, Ellison, and this was really interesting.

Ellison Anne (28:25): Well, thank you for having me. I appreciate it.

How does the US Government ensure that its most sensitive data stays protected on mobile phones?

On this week's episode of The Secure Communications Podcast, guest Dr. Bill Anderson, President of CIS Mobile, talks about how the government's approach to mobile security is evolving from bulky, expensive phones purpose-built to handle highly sensitive information, to commercially available smart phones with security built right into the devices.

Welcome to the Secure Communications Podcast Data in motion is complex, chaotic, and unsecure, but the ability to seamlessly communicate is what drives innovation, growth and progress. Discover how the leading minds in the fields of technology, cybersecurity and communications are tackling the challenge of securing data in motion, and gain insights into what's new and what's next on the Secure Communications Podcast. Each week, host Kathleen Booth interviews bold thinkers who are developing and/or employing transformational technologies to solve communication security challenges.

Dr. Bill Anderson is President of CIS Mobile, a leading provider of secure communications solutions for the US Government.

Bill is a veteran of the cybersecurity industry who has held executive roles in product management and marketing at several public and private technology companies. 

Bill has extensive experience in developing and marketing hardware, software, and intellectual property and is an expert on security in the mobile ecosystem. In this episode, he shares cutting edge developments in mobile phone security technology, and talks about why the secure phones of the future must balance security with user experience.

• Check out the CIS Mobile website
• Follow CIS Mobile on LinkedIn and on Twitter

Kathleen (00:06): Thank you for joining today's episode of the secure communications podcast. I'm your host, Kathleen Booth. And today my guest is Bill Anderson, who is the president of CIS mobile. Welcome Bill.

Bill (00:19): Thanks Kathleen.

Kathleen (00:21): I am excited to have you here, but before we get started, can you tell my audience a little bit about yourself as well as about CIS mobile and what you do there?

Bill (00:31): Sure. Well, I'm a, I'm a security guy and I've been working in the industry for a long time. I got my start on the technical front. I have a PhD in cryptography that started doing elliptic curve crypto at a, at a very successful company called Sertacom. And I stayed, loved it, stayed in the, in the industry ever since. Went and did my own startup. Raised money. Ended up selling the company. Worked at a couple of more startups. Found my way into venture capital briefly, which was interesting. And then, since then I've been helping companies figure out how to start up and build a good security, mobile security business specifically. And I got really interested in CIS Mobile, CIS Secure, which is the parent company. It's been around for about 20 years through a government security contractor.

Bill (01:19): They do some very secure communications equipment. They're an NSA certified TEMPEST lab. So they really, they serve that sort of core government community that needs absolute security in their communications equipment. And it's a very successful business. They decided they needed to grow. And the obvious place to grow was, was to look at these mobile devices that they hadn't been handling before and no one really had a good handle on, for, for government, and ended up acquiring a business that was started up in Canada about five years ago, five or six years ago, actually. And I am, in fact, I happened to know these guys, obviously being a relatively small community and the offer was, was too good to pass up. And so I joined about a year ago and we've been taking that business in a new direction, really of, of targeting it specifically to the US and our allies. Government security needs for mobile devices.

Bill (02:19): Mobile has been around a long time. There's been a lot of innovation in this space for the past 15, 20 years, really. I mean, even 25 years ago when there was, we were starting with Palm pilots and Palm pilots were cool. And you know, my company helped us secure them, and then they went wireless and they needed better security protocols. So we help with that. And, and it's led to, well, why don't we put it into a cell phone? Okay, we'll put it into a cell phone. Why don't we put it into a smartphone? And then suddenly, the problems just opened up because these are effectively massively overpowered supercomputers with sensors in them - cameras and microphones and Bluetooth and motion detectors, location sensors - we're carrying around in our pockets all the time. Wonderful. I mean, there are wonderful productivity enhancers. They're also the most effective spy that you could ever have sitting in your pocket. And you don't want to just bring that into a sensitive government facility. So the government, even more than industry, has had a real love, hate relationship with these mobile phones. And that's what really attracts me. I think that's, it's really an interesting problem space that we've got something to say about.

Kathleen (03:28): You know, the thing that fascinated me that when we first spoke was that there are a lot of companies out there that are, as you say, working on mobile security. There's a lot of advance, advancements that have been made. But there are kind of, there still remains this, this inherent conflict between the level of security that is needed, particularly within the government, as you say, where there really is a lot to lose, and the convenience factor. The usability. And this is something that I'm kind of personally passionate about is security and usability. And I loved that. You talked about that issue and, and solving for that issue and what's at stake if you don't solve for it. So this is kind of a big topic, but maybe you could kind of go roll that, roll it back a little bit and talk about historically, why have those two factors been in conflict so much - security and usability.

Bill (04:27): Sometimes if you let a pure security person design your device, you'll end up getting a very excellent, secure paperweight that no one wants to use. And, and you know, it's because it's hard to be a Renaissance guy. It's hard to, to know everything that it takes to make a device that users want to use and actually still be secure. And it, it is, it's a constant battle. Over the years, you know, the initial government reaction was, you're just not bringing that thing in here. That's, I don't know what that is. It's not coming in here, but inevitably, you know, these mobile devices are productivity tools everyone wants to use. And then we all use them in our private lives. You have to start to think about what's the societal impact if our entire government infrastructure is a generation behind the rest of the world. It's bad.

Bill (05:19): I mean, we would have people, frankly, we have trouble hiring people to go work in the government now because you know, 20 some year old has had a mobile phone in his hand his entire life. And you tell him, yeah, you're going to have to leave that in the car or leave it in a locker. We've got these great computers inside and you know, they do everything that you need. It doesn't work. People don't. First of all, it's not true. And second of all, people don't believe it. And so it's necessary to try to find a way to keep up with modern technology in order to be an effective organization. And like I said, there's a love, hate relationship with it. So the pure, pure security guys who know what our adversaries can do, you know, they stay up late at night worrying about this stuff.

Bill (06:09): If I, if I let this mobile device in, you know, what happens if somebody use this extremely sophisticated, you know, over the air baseband attack that let him take over the baseband processor and then inject code up into the, the firmware and then exploit the device? What if they did that? And the same guy says, but I know how to stop that. I'll design my own phone. And that's happened a few times. It's happened three or four times in the last 10 years where, you know, a set of extreme requirements comes out of somewhere like Fort Meade. Yes, they're there. They're typically the culprits. They know what they're doing, but they specced a few phones over the years that were monsters. What happens is, when, you know, when you work within the government community and you spec something out to meet all the security requirements, to check all the boxes, it's super conservative.

Bill (07:02): And then you, you put it out for a bid. You say, who will build this for me? Now, you gotta go through a government procurement process of getting the, who's going to do it? Is Google going to stand up and say, I'll put up with all this nonsense and I'll build you a phone the way you want it? No, they're not interested. It's the systems integrators. It's the big defense contractors that say, I'll take the money. I'll put a couple hundred people on our, its not that much, but I'll put a few people on this project for a year and a half, and we'll meet all your specs. It'll only cost you $20 million. You know, we'll build you that phone. Phones like that have been built and they end up hitting the street. And they're three years out of date. They're a monster of complexity and they have no usability because usability was not the design paradigm.

Bill (07:51): Security wasn't the design paradigm. We saw this happen with a device called the SME PED. If you look it up on the internet, you'll see it. It's ugly. How do you spell that? S M E P E D. And I won't name the guys who made it because I think they were, you know, they did the right thing. They did what they were asked to do. And then they produced this device that was kind of like, it looked like a Blackberry with some extra stuff built in. But it wasn't a Blackberry. It was actually running, as I understand it, it was Windows Mobile, 3.0 which was already three or four years out of date by the time the thing shipped. And it had some extra capabilities on it to handle the secret level communications. So they'd slap these two pieces of the phone together, put wireless in it, added a keyboard, added 12 other buttons.

Bill (08:38): And the two pieces didn't talk to each other. So you're really carrying two things just sandwiched together. But most important is, it was way out of date. And then they said, okay, secretary Clinton, here's your phone. She said, well, I've been using a Blackberry for the last five years. I'm not using that. I don't even how. It's, it's, it's a monster. And that obviously resulted in a whole other issue that, that was in the news for years. But not, not entirely because of the SME PAD, but you know, it wasn't very usable and a lot of people reject that technology

Kathleen (09:11): Well, and I think that's, that's like a recurring theme in security in general, which is that if you give people security technology that either they don't understand, or they find difficult or inconvenient to use, they are going to choose not to use it, or they're going to find a way around it.

Bill (09:28): They'll carry their own phone.

Kathleen (09:29): Yeah.

Bill (09:30): They'll use that phone for just personal, don't worry, just personal communications. Except when it becomes easier to send an email in an emergency from your personal account, you're going to do it. It's inevitable. And so work starts bleeding into this personal phone, which has typically no security whatsoever. And that to me is, is of course, one of the scariest things about that,,that crossover, is that the phones that most of the government is using today are horribly insecure in ways that the government purchasers don't understand. There is a huge blind spot. What, you know, we'd like to do typically is we'll say all right, we'll define some standards that are in our best practices that a phone has to meet or computer estimator communications equipment has to meet. And they're all good. They're typically backwards looking. They'll say, Hey, we've been burned on 27 different things over the years. Let's make sure that we don't get burned on those things again. And we put them into a standard. And then we say, in order for us to purchase this device, you have to meet the standard. And one of the standards that's relevant in mobile phones is, is Common Criteria. NIAP. I forget what NIAP stands for.

Kathleen (10:50): National Information Assurance Partnership.

Bill (10:53): There's a specification for mobile device fundamentals and related technologies. There's actually four specs that matter in the space. And that spec is good. I mean, if you do all the things that are in that spec, then you won't get burned by the bad things that have happened before. Doesn't mean the phone's secure. It means you won't get burned by the things that happened before. And we know of a lot of problems with phones that are being used in the government right now that have passed that specification. And by the way, we're going to do the same thing. We'll still go through NIAP specific-, certification on our platforms. We make, we make platforms as well as, I'll talk about later because it's good to check all those boxes, but one of the problems is that the buyers get this really bad, false sense of security.

Bill (11:41): They say, Oh, I'll put that on my approved list because it passed the test. Check. A new vendor comes in, says I passed the test. Giant vendors, giant vendors. I won't name names because I don't like to pull people down. But the biggest vendors in the world passed those specs. And those are the phones that the government is buying and they're full of holes. And one of the biggest problems with them is that the economic system around mobile phones is designed to monetize data that the users generate. And what happens is, for example, this is a, I love Android, by the way, this is an Android phone. We, we do stuff for Android devices typically. If this was not protected by our stuff, which we, we replaced the operating system so it's actually secure, a typical Android phone calls home to Google about 40 times an hour.

Bill (12:43): And it tells Google servers where the phone is, where the user is, what applications he's running, what messages he's been sending, what interactions he's had, what advertising codes have been triggered by his browsing patterns, and so on. An enormous amount of information actually getting sent back to Google servers. Why was, why would this be a problem? It would be a major problem if you wanted to track the President of the United States as he moved around in a motorcade from his place in Florida to meet with the prime minister of Japan for lunch, and then go golfing in the afternoon. This happened. The New York times published a series of articles in January, no December, this year, last year where they simply went out to third party advertising trackers and said, we'd like to buy some data from you.

Bill (13:37): We're interested in this kind of data around, you know, people who were moving around in this area and this area and this other area. And what they did is they zeroed in on where can I find tracking codes that are tied to location that happened to be at Mar-a-Lago. And then they did the same for Supreme Court justices, Secret Service agents, congressmen, and found that they could track the movement of those people from their home to their office, to their lunches, to their clubs and so on. And these were secure phones.

Kathleen (14:10): That's unbelievable.

Bill (14:12): It's amazing. And so you think, all right, so why, why did that happen? It probably happened because the people who were making these purchase decisions felt safe by simply buying stuff off the approved products list, without thinking holistically about what's really happening in this mobile ecosystem. You know, what, what, what are the motivations of the parties that are involved here?

Bill (14:35): How do they get paid? And, and that's the big question is, of course, if government is going to engage with industry and purchase technology, they have to think about where are all the values being, where are the values being exchanged? How am I paying for these platforms? And you make a mistake if you assume that by buying a cheap Samsung phone and giving it to the military, that because you paid for it, that you're okay. You're not okay. Those phones report data back to the mothership and third party advertising trackers, and they put our people at risk. And so, you know, I think it's really important that we educate the buyers, we educate the industry in general about, you know, I like to say consumer technology is great for consumers, but governments ought to know better. And, and repurposing one of these consumer platforms and putting a mobile device management tool on top of it, it doesn't solve the underlying problems, which is that they're designed to monetize people. That's why the operating system is free. That's why the apps are free. Google gives that stuff away for free. So they have to make their money somewhere else.

Kathleen (15:42): That's so interesting because it really, you know, listening to you talk about this, I feel like there, here's the, the, the black hole in the middle, right? Which is that you have the option of building your own device, which is a terrible option from everything you're saying, because you wind up having these companies that are really not experts in UI or UX, creating devices that are incredibly inconvenient, difficult to use, you know, large, et cetera, but might be secure. Or you go to these commercial providers that are really good at UI and UX, and you're sort of choosing UI and UX over security. So I imagine this is, like, where your company comes in, in the middle. But like, what is the solution then?

Bill (16:32): What we do is, we sort of stand on the shoulders of these giants. We stand on the billions of dollars that have already been invested in making the sleek piece of black plastic so powerful. You know, it's got a Qualcomm quad core processor and it's got fingerprint sensors, all that stuff. It's got a, you know, billion dollar operating system. It's a huge amount of effort that went into building this thing. We don't want to replace that. It's awesome. Android, Android is an awesome platform. And fortunately, there is an alternative to just taking it. Android's available as an open source platform. So what we do is, we take the open source and then we reengineer it. So we take out this, we can take out the weaknesses as far as we can find them. I mean, we're not perfect. We probably haven't found everything.

Bill (17:19): And the important thing is that we, we let our customers view our source code. And when our customers are running systems, based on our platform, they're running the platform. So they take the server and they run it themselves. They take the phones, we flash the operating system into them. They can look at the operating system and then they manage their phones themselves. And so all of the data is going from a controlled platform to a controlled handheld, and we've turned off all the features they don't want to see in those platforms. We've also added a bunch of other capabilities that matter in some specific usage cases. So for example, people are working from home and people are carrying multiple devices. You know? Government phone, and a work phone. We set it up now so that I can have two phones in one, or three or four.

Bill (18:09): So this is my personal device. If I log into it using my other fingerprint, it'll actually open up a government device. So there's a separate version of Android running in this phone. So I switched over to the Android for work, run just a curated set of apps that I'm allowed to run in the, in the government space. It's running a VPN that terminates at the government space. They control the apps, they control everything about the platform. And then when I need to make a personal phone call, I fingerprint into the other side, and there's my Twitter account and Facebook and all the things that I would use for personal. And it's separate, but I just have to carry one piece of plastic. And I get the power of all of it. Having a phone like this means I'm more likely to use it.

Bill (18:53): I'm actually, more or less, I'm not going to subvert it. I'm actually going to use a platform that's fully controlled. And this is important. This isn't a bring your own device solution. Those are fine, but they're not very secure. This is, the government wants you to work and wants you to be productive and is going to give you a phone that you can use for personal, as well as work. One of the neat things about our system is, let's say there was an emergency and something was happening in San Francisco. And let's say it was a Homeland security or FEMA deployment. They can actually push a third phone. Well, it's a container, but we call it, you know, you push a third container out to all the people who happen to be in the geographic area where there's been a disaster. And then they log into that third device using a different access control method and get all the apps that they need for just dealing with emergency management. Contact lists, the VPN terminates somewhere different, they've got a bunch of data collection apps. They run those and use them for the duration of the emergency. And then when it's over, you can take it all back. You can take it off the user's phone. They don't need it anymore. We refresh it and get it ready for the next disaster. And so there's, there's a whole bunch of different use cases that you can build around this fully, fully managed and secured platform.

Kathleen (20:10): That's so interesting. I have so many questions. So the first of all, my comment is that that sounds amazing because the last place I worked did. You know, I'm in cybersecurity. And so it's, that is a priority for companies. They actually issued me a work phone. So I had my work iPhone and my personal iPhone. And I remember I was like, Oh, this is so inconvenient having to carry two phones. And so I went on to Amazon to try to find, to see if there were cases that were built to carry two phones. And there really aren't. I mean, there are some, but they're, they're just equally as bad as carrying two phones. Right? So it's just, it's an awful solution. And, and like you were describing, I would find myself in situations where I'm like, Oh, I don't have my work phone with me, because I didn't want to carry it.

Kathleen (20:58): I didn't think I would need it. You know, and it just, it, or it wasn't paired with my car. And so I would use my personal instead, all kinds of dumb excuses that because of usability reasons led me to not using that phone in the way it was intended. So I can really see the value of having it in a single device. But are there still, I mean, you still have to toggle between containers, correct. So what you had, you have any data around what, I guess what percentage of, of, of, I don't know, even know how to phrase it. If you go from having, let's say two phones to having one phone with two containers, what percentage improvement is there in terms of people not falling back on the personal side?

Bill (21:46): I don't have, yeah that's a great question. I actually don't have a statistic because we don't have enough data to really answer it. We probably wouldn't like the answer.

Kathleen (21:54): Yeah. I mean, I imagine there's still plenty of user error. Willful user error. But I could see where it would be less.

Bill (22:02): You'd have a lot more control as the, as the government administrator, because you would be able to say things like, look, the government apps are always there. They're at your fingertips. It takes two, two seconds. You know, you push the button, then you're in the container. So it's not that hard to get there. And they're always with you. And you could say things like, look, we don't, we don't put Gmail in the government space, but it's right over there on your personal space, if you need to use it. But for government emails, you know, you go over to the government phone and use that one. If you make it easy and you peel over the barriers to using it properly, then people are more likely to use it properly. One way to measure it would be consider the impact of failure to follow the security rules. It's a very, very high impact. We could be completely subverted. If we can reduce the incidence by even a, you know, small percentage, it's a significant improvement in our overall security posture. But I, I would not be surprised if, you know, if we can get most people using a single device, then compliance would be extremely high.

Kathleen (23:06): Now you talked about this in, in terms of a solution for the government. Is this equally as viable a solution for enterprise clients?

Bill (23:19): Our strategy is to focus on the, really not quite the highest problem. The highest problem is actually a very, very small number of super, super secure $5,000 phones, $30,000 to deploy. We don't want to do that. You know, we're selling standard phones, that cost a standard amount. But we're, so we're sort of targeting the second tier people who are doing, you know, secret and, and, you know, unclassified materials on a phone, which is the mass of the government. The, the next, and we're going after our allies so we have customers in the five eyes community already. And the next tier for us around that is actually all the government contractors because they're, it's a huge community. And they're working with the same kinds of information and the same kind of security requirements around them. And so that's kind of our next circle to expand to. We are talking to some companies that are interested in deploying for enterprise but we may not ever get into doing enterprise deployments ourselves.

Bill (24:30): It might compromise some of the, our capabilities. There are things that I have not told you today about what we can do with the phone. We serve the intelligence community as well. And so we have a whole bunch of capabilities that we just don't talk about particularly publicly. And so it's not, it's not really acceptable for us to, to be offering those up to the enterprise community. So what we might end up doing is sort of splitting the code base at a certain point and licensing it out to enterprise use because it really is quite useful for enterprise. And then keeping the really high end secret stuff for, to, for just our government community.

Kathleen (25:09): That makes sense. And do you sense that there is demand within private enterprise for this? Because the, the impression I've gotten just from other conversations I've had is that, is that private enterprise really isn't there yet in terms of the mentality and the focus on security? I think in principle, they liked the idea, but, but they don't, they don't seem to put their money where their mouth is.

Bill (25:32): And they're better than consumers though. I'll say that at least enterprise, you know, that's where we've always been. I've always made money in the past is selling security to enterprise. They will pay for it if it brings them enough value, but you know, there's a lot of good security for enterprise already. The basic platforms with mobile device management software and the APIs that are built into the phones, they do a lot. There is opportunity for differentiation and if you're a new vendor coming into the space, or you see the big guys eating your lunch, how are you, how are you going to survive? You know, there's a, there's a couple of ways to survive and go down market. You can go up market. But for the folks who want to go up market, it's about security. That's one of the most important differentiators that I'm hearing about.

Kathleen (26:18): Now, when you think about the future, do you think at some point this level of security will, will become accessible to the individual user? I mean, is that the direction we're heading or will we kind of remain with, you know, just secure enough for us to feel, feel like we're checking the box?

Bill (26:38): I think we have a societal problem in that the corporate motivations behind this technology are to you know, to serve the, the interests of the corporations, which is to serve the interests of the shareholders, which is to make money. And, and the way that the, the two main players in the mobile phone space work, so it's really, it's a, it's a duopoly right now. You can have an Apple phone or you can have an Android based phone. There's nobody else left. And, and they have slightly different business models, but the way that they make their money is to collect data and to, and to, and of course in Apple's case, they do other stuff. Apple doesn't collect as much as, as Google does, but they both do to some extent, and that's in order to, to be able to provide other services. Other, you know, other paid services.

Bill (27:28): I don't see that motivation changing anytime in the, in, at any point. And so if we were to see a, the development of privacy for an individual and security for their data and having some sort of individual sovereignty over your information, if that became a theme that people cared enough about, then we would have to see political action to actually start to, to to put regulations into, put, put sort of standards in place for how these companies should interact with users' data. For the most part, consumers don't think about it. They don't care about it enough. They don't mind the fact that somebody might be tracking them. It doesn't actually hurt them all that much. And what they get is, they get a phone that's not very expensive. And, and so, you know, the mass 90, 95% of all people just don't care enough to worry about it.

Bill (28:29): However in the European Union, the European Union looked at some anti competitive practices and found in, what, let's see, in 2018, actually ruled against Google and said, what you guys are doing here is anti competitive with, with some of their platform practices and said, you can't do that and fined them. I think it was almost $5 billion, which is probably not very much for Google, but it seems like a lot to me.

Kathleen (28:57): I wouldn't mind having $5 billion.

Bill (28:59): I think they're probably still disputing whether they need to pay or not. But the point is that, you know, the EU said, look, this, this practice that you guys have for forcing OEMs to deliver all of your software suite, all of your services to prevent other people from building platforms like yours to prevent, couldn't fork the code, a single OEM who was already building an Android phone that had Google services on it, wasn't allowed to build a phone that was slightly different. And so there was a bunch of practices there that were, in the EU's opinion, against the consumers' interests. And the EU said, you've got to stop that. We haven't seen any change in North America though.

Bill (29:42): So it's apparently not a political issue. And so I, I doubt, unless there's a real sea change, unless there's some real awareness about this, then you probably won't change. And I don't think we will see a significant improvement for consumer security. But for governments, unfortunately, they're being hurt right now and they don't even know it. And that's where we come in and we're, we're trying to, to raise the bar and to prevent some of that data leakage. And when we show what we can do to these customers, they, they, they, they understand. I mean, they were aware of the issues and they're kind of looking for solutions.

Kathleen (30:16): Yeah. Now, when you look ahead to the future, what do you think when it comes to mobile security? What do you think the biggest challenge is going to be that we'll face in the next few years?

Bill (30:29): I would say it's probably that corporate mentality of, we need your data. So that's, that would be on the one hand. And I've talked enough about that. The other is that frankly, there are bad guys out there who are going after your data too, and they really are going after their data. And so, you know, we, we do need a base level security. I want to say too. And I know, in case I came across too strong, Google and Apple have both done a really excellent job of building security into these platforms. They are really, fundamentally, very secure against external attacks. So when the hardware boots, it does a hardware root of trust, the checks, the first layer, which checks the next layer, which checks the next layer, which checks the operating system. And so it's really, really hard to, to break that. They've done an excellent job.

Bill (31:18): And as, as you know, they're really, really very capable. My only exception is that they wrote themselves a get out of jail free card, and they said, we won't let anybody else have the data, but we can have it. That's my only complaint. But the bad guys are out there. And you know, for our governments, when they work overseas and, you know, go to various places where they need to work, they can't rely on the infrastructure. In some cases, you know, the local carriers are connected with the intelligence services that they may find antagonistic. And so, you know, they need a phone that can can blend in, that looks like a regular device, that doesn't give off any signals that says I'm a, I'm a Blackberry.

Kathleen (32:04): I'm a spy phone.

Bill (32:04): I'm a spy phone. I'm a Blackberry, I'm a, I'm a super secure, you know, $5,000.

Bill (32:08): They can't have that. They need to be able to, to act and look like like a regular device and not stand out. And so you need a special approach to be able to protect government workers against serious, serious existential threats when they're working abroad. And so, and that's not going away anytime soon. You know, we also have to think about the, you know, the reliability of the infrastructure. We should not trust any networks. We should assume that every network is subverted and we should be delivering data securely from end to end. Never assume that nobody is listening because they typically are. And so we should design our systems from the base up assuming that we're responsible for our own protection.

Kathleen (32:57): Yeah. Now building on that question, when it comes to secure mobile communications, is there a particular company or individual outside of your own that you think is doing really interesting work in this area?

Bill (33:11): Well, one thing I was, I knew you'd ask this actually. So I, I did think about it a little bit. We've, we've talked to and looked closely at what the UK government's National Cyber Security Center's been doing. And they've put out some really excellent recommendations about how to think about risks, how to think about deploying systems that we think are, they're just full of common sense. So unlike the sort of checkbox where, that I've complained about before, where he said, I would really well, we'll make sure we protect against all the things that happen before a check. Okay. We can all buy that. These guys say, no, that's never okay. Every time you go to field a new system, you need to think in this way. And they have some really, really intelligent, deeply thought out advice for how to think about risks and threats and usage models. And, and I think it leads the users to deploying a system that doesn't cost too much, and that is typically going to be effective for their particular use case. And, and I, I found that very refreshing. So I'd recommend more people go and take that approach to, to their deployments.

Kathleen (34:21): That sounds interesting. I'll definitely have to go check that out. Well, this has been really fun to chat with you about. And I think it's, it's neat that you guys have a solution that really works with the devices that we're all already used to using anyway. I mean, that's, that, that eliminates so many of the points of friction. I think that otherwise would cause us to make very poor choices as human beings. So it's, it's, it's fascinating. So check out if you're listening, check out CIS Mobile. Bill, any other places that you would point listeners to if they wanted to learn more about the company or ask a question about what you're talking about?

Bill (35:02): Feel free. Yeah. Feel free to email us. Cismobile.com. And if you go to the cismobile.com resources page, we've got a bunch of videos where I've, I've actually recorded the product in action. So you can see some of the capabilities and it's kind of fun to see what you can do with it.

Kathleen (35:17): That's great. Well, definitely check that out if you're listening. Thank you so much for joining me this week, Bill. It was really fun. And if you are listening and you enjoyed this episode, please consider leaving the podcast a review on Apple podcasts or wherever you choose to listen. And we want to hear from you. If you have an idea for a future episode or a guest that you want to suggest, tweet us at Attila Security. That's it for this week. Thank you so much, Bill.

Bill (35:42): Thank you.

As host of The CyberWire podcast, Dave Bittner talks to leaders from throughout the cybersecurity industry on a regular basis. From his industry-wide perspective, here's what he sees as the biggest secure communications challenges that need to be tackled.

On this week's episode of The Secure Communications Podcast, guest Dave Bittner talks about how COVID-19 has altered the way that people and organizations think about cybersecurity, and why ease of use is one of the biggest challenges facing the cyber industry.

Welcome to the Secure Communications Podcast Data in motion is complex, chaotic, and unsecure, but the ability to seamlessly communicate is what drives innovation, growth and progress. Discover how the leading minds in the fields of technology, cybersecurity and communications are tackling the challenge of securing data in motion, and gain insights into what's new and what's next on the Secure Communications Podcast. Each week, host Kathleen Booth interviews bold thinkers who are developing and/or employing transformational technologies to solve communication security challenges.

Dave Bittner has a unique perspective on the cybersecurity industry. A professional podcaster who is the host of The CyberWire, Caveat and Hacking Humans shows, he has interviewed many of the leading minds in the fields of cybersecurity and been amongst the first to hear about cutting edge new technologies.

In this episode, he shares his insights on the impact that the COVID-19 pandemic has had on the way the general public thinks about cybersecurity and what that means for the industry, and explains why he believes that usability is the biggest challenge that cyber companies need to address in the future.

• Check out The CyberWire website
• Connect with Dave on LinkedIn
• Follow Dave on Twitter

Want to what Dave has to say about the biggest challenges the cybersecurity industry needs to address?

Kathleen (00:27): Thank you for joining today's episode of The Secure Communications Podcast. I'm your host Kathleen Booth. And today my guest is Dave Bittner who is the producer and host of The CyberWire. Welcome Dave.

Dave (00:46): Hello, glad to be here.

Kathleen (00:48): So good to have you here. It's such an interesting opportunity for me to interview another podcast host. I feel like you're in such an interesting position as the host of a podcast that is really all about cybersecurity. You have a very interesting vantage point on what's going on in the industry. So I'm really looking forward to picking your brain about that, but before we get started on that for those who may not be familiar with The CyberWire or with you, could you talk a little bit about, you know, what The CyberWire is and your background and how you came to be host of the podcast?

Dave (01:21): Sure. So The CyberWire itself is a company that has a, a number of different products that we put out there. We have our CyberWire daily briefing. That's probably the thing we're known best for. It's a daily newsletter you can subscribe to. Comes in your email. Basically it gives you a, a short, brief rundown and analysis of all the things you need to know about today in cybersecurity. Along with that, we do The CyberWire podcast, which is a podcast version of that briefing with some extra stuff thrown in. We have interviews with people and partners we talk to. Again, just a, a short, concise, brief summary of the things that you need to know as a professional or enthusiast or student in cybersecurity. We have other things we do. We have other shows. I produce, cohost, the Caveat podcast, the Hacking Humans podcast.

Dave (02:11): We do a show called Research Saturday, which we run once a week, which is all about interviews with people who are doing research in cybersecurity. We've started a number of new shows. So we just brought on Rick Howard, who is our chief analyst and chief security officer. He used to be the chief security officer at Palo Alto Networks. And so he's got a couple of podcasts he's starting himself. And we just started running those. We also just launched a pro version of our podcast, which has additional information insights. There are more more podcasts, more analysis. Just a lot more detailed stuff of the things people have come to rely on us for. So for folks who want to take it to the next level, we have that as well. My own history, I have a background in broadcasting and digital video and that sort of thing. I came into the cybersecurity world probably about five years ago. And that was along with starting The CyberWire. We got spun off from a cybersecurity company about four years ago. So my journey began about five years ago.

Kathleen (03:18): Well, all of a sudden I'm feeling incredibly intimidated because you host something like five podcasts. And so now I'm feeling like I need to really up my game and make sure I, I match your, your expertise here.

Dave (03:33): But it's not, it's not a contest, Kathleen.

Kathleen (03:35): I know, I know. No, but that's great. I think it's so fascinating. And I love what you guys are doing. Side note, if, for those who are, some people may be listening to this, but others may be seeing this on video. If you're seeing this on video, hat tip to Dave who has the awesome Zoom background of the Millennium Falcon.

Dave (03:55): She may not look like much, but she's got it where it counts.

Kathleen (03:58): Oh, she holds a special place in my heart. And we are recording this on May 5th. I did note that yesterday was may the fourth and of course, may the fourth be with you, so we are a day late, but, but we'll extend it for a day.

Kathleen (04:13): So what I really wanted to talk with you about was just this whole topic of secure communications. You know, this podcast kind of covers a range of topics that are under a large umbrella, all having to do with securing data in motion, which you know, which does cover a lot of different things. And that's why I was particularly interested to chat with someone like yourself, who, who does get to talk with practitioners from different parts of the industry, people from different companies, researchers you know, and, and has insight into all the different things that are happening. And so I would love to just hear from you, what are you seeing in the landscape of secure communications technology and, and, you know, what do you think are the biggest challenges right now really that we need to address?

Dave (04:58): Hm, well I mean, these are certainly interesting times when it comes to secure communications, right? I mean, I think we were sort of, I'd say, rolling along in a, mostly an evolutionary mode where folks were bringing new things to market. Had new ideas. But then all of a sudden we had this COVID-19 thing happen. And now, with so many people working outside of the office, working at home, that really shone a light on all of this stuff. And then also, all of the scrutiny that Zoom has been under for their own security issues, shortcomings and so forth. You know, you and I are, are using Zoom right now to record this conversation. And I think that also brought to light some of the disconnects between maybe what some organizations' marketing messages may be about their security, about whether or not things are truly end-to-end encrypted or not, and made people take a second look at that stuff to make sure that what people are promising is what is actually being delivered.

Dave (06:08): I think coming into this, I think there has been a lot of confusion when it comes particularly to VPNs, because there are so many providers of VPNs. And I think especially on the consumer side of things, and I would, I would include small businesses with that as well. The folks who don't necessarily have a dedicated IT team who really know all of this stuff inside and out. It's hard to know who to trust when it comes to having a provider for your VPN, because there's so many out there they all promise the world. And then how many times have we seen that such and such VPN provider either was leaking information or was breached or, you know, so on and so forth? So I think we've seen more scrutiny with those sorts of things. And then on the policy side of the equation, we're seeing the ongoing crypto wars, if you will, where we're seeing legislation coming through, where, you know, some folks in government and law enforcement are saying, we need to have backdoors to some of this stuff.

Dave (07:17): And in response to that, you have companies, Signal, for example, who are famous for their end to end encrypted messaging and video chat app, has said, if you do that, we may have to pull out of your market. So I'd say it's interesting times. I think there are opportunities there for organizations. And I would, I would put Attila in that group who have, who have offerings in this space and who can make a clear presentation. Can make their case in plain English for why whatever they're offering is going to provide their customers with what they need, back that up with the documentation and the, the science for how it actually works, differentiate themselves and make it easy for people. Because I think that's another barrier. If, if it doesn't work, if it gets in my way, if it slows me down, if it's a speed bump for me, or roadblock, I'm gonna - most people are going to go for convenience over security, especially if they just have to get their work done. Right? If I'm sitting in that airport well, airport is probably not a good example, right?

Kathleen (08:33): There are still people flying. There aren't that many of them. But there are still some.

Dave (08:38): But let's use that as an example because it's one that everyone can imagine. If I'm sitting there and I've got work to do, and I've got, you know, emails to exchange and I just can't get my secure communications working and it just keeps throwing up errors, well, I've still got work to do. And so I'm going to, chances are, I'm going to take that risk. And so that's the thing that I think we need to, to work on and that folks can differentiate themselves with, by having it be effortless and seamless and just work. I think that's the real thing people are hungry for.

Kathleen (09:09): Wait, I think that's so true. I heard someone once say that every end user is their own CIO, because you can give them any tech you want, but as soon as they, as you say, as soon as they hit a speed bump, they're going to make a decision that works best for them. We're all very inherently selfish. Right?

Dave (09:27): Right. Yeah. One of my cohosts on the hacking humans podcast, Joe Kerrigan, he works at Johns Hopkins and Johns Hopkins is, as everybody knows, in addition to all the tech stuff they do in the university, they have a hospital. And so Joe makes the point that when it comes to doctors, if there's some security thing that's getting in the way of them providing treatment, there is no ambiguity as to what takes priority. That security thing is out the door. Because they're literally dealing with life and death situations there.

Kathleen (10:01): Yeah. Especially at a time like this. I think it's really interesting how you frame this because I hadn't thought of it in this light, but now I'm, I'm kind of seeing what you're saying, which is that with everything that's happened with the coronavirus, I mean, we're in cybersecurity. So we're talking about and thinking about security all the time. But yeah, I, you know, I don't come from the cybersecurity world and, and I can say firsthand that most people don't think about it very often, if at all, unfortunately. And what's been really interesting to me as this has unfolded, and I think Zoom, as you raised, it's the perfect example of it, is that, you know, you take a platform like Zoom and I've used it at, at every company I've been with for the last several years extensively and no one ever raised a concern about security.

Kathleen (10:55): And it took this strange set of circumstances, this pandemic, where we're all working from home, including organizations that really do have to worry about security, for those concerns to kind of bubble to the surface. And I think at least what I've observed is that it's starting a conversation that really wasn't happening before in places that, that weren't thinking about this topic. So, you know, I feel like coronavirus is, is accelerating a lot of things, you know, remote work, you know, all kinds of telemedicine. All kinds of different things are speeding up the pace at which they roll out because of this. And it's almost like the conversation around security is, is, is falling into that category as well. Like companies are starting to talk about things they weren't talking about before, or at least that's what it seems to me.

Dave (11:48): Yeah. I think that's a good point. I mean, one thing that I think about when it comes to this stuff is if you think back to the days before we had things like Touch ID and Face ID on our phones, on our mobile devices, or on the Android side of the equivalents to those, I would say a lot more people did not lock their phones as a matter of habit before we had those quick, easy, seamless ways to do so. Right? And so in making that layer of security, frictionless, making it almost instantaneous, you had huge adoption by a wide swath of people who never thought that that was important before. Again, convenience trumps security so many times. So by making that easy for folks to do, we had this, almost a side effect of, widespread adoption. And I think there's also kind of a coolness factor there that I bought this device.

Dave (12:49): It has this cool new thing. Hey, look at this cool new thing. And that's great too, but if you can make it fun for people, make it seamless, you know, that that to me is a, is a win win. How interesting now that, you know, Face ID is having some, some challenges with people wearing masks. So Apple is pushing out some updates that are, that are going to help, you know, make that a little, a little easier for folks who are wearing masks. So could we find ourselves a little, maybe a half step backwards? But yeah, I, again, I think it, if you want people to adopt it, you gotta make it so it just works.

Kathleen (13:24): You make a really good point. And I, I, the last interview I did for this podcast was with Nigel Jones from KoolSpan, who talked about exactly that with mobile communication security. That really, for any solution to be effective, it has to be completely built in to the device, to the application. It's like, you really can't add any extra steps for users because any extra steps are going to serve as an impediment. And I think in general, that does point to this, this notion that user experience is, is almost as important, if not more important than the tech. You know, it, it's not the thing that we talk about as much. It doesn't seem as sexy as some of the cool cyber technology out there, but it's, it's so critical.

Dave (14:10): Yeah. And I think because also when the thing works properly, nine times out of 10, you don't notice the nine times it works well. You notice the time that it frustrated you. The time that it kept you from doing the thing that you want it to do. I notice this with using things like Siri on again, on, on my iPhone. If Siri gives me the answer that I want or what I'm looking for over and over again, that's great. And I appreciate that. But boy, that time when I ask something crystal clear and she comes back either with a nonsense answer or whatever, that just registers with me. And I'm more, I'm hesitant to use Siri next time because they wasted my time.

Kathleen (14:53): It's so funny because this happened just last night in my house. My husband was trying to ask Siri something and I mean, he was being pretty clear and she just, she was not getting it and he must have tried five times and then he just started to yell at her as though she could understand. And I, you know, I watched him spiral into this like Siri rage, so absolutely.

Dave (15:19): Everyone else in the house, it's just glad that it's not them, right?

Kathleen (15:22): Yes, exactly. So, so you have this interesting purview sitting in the seat that you do and talking with all the different people that you talk to. I'm curious, you know, who do you see out there that that's doing really interesting, groundbreaking work in this area of secure communications technology - company or individual?

Dave (15:45): Hm, that's interesting. I don't know that I have actual names to share. I mean, I, I think, I think maybe another way to come at this is that it seems to me like a lot of this is becoming ubiquitous. In other words, the expectation is that our communications are going to be secure. I see a lot of people we mentioned earlier. The Signal app, you know? To me, that's a good example of something that is written from the ground up with security in mind. It is open. So it's been vetted by people who have no skin in the game, no financial interests in their success. And so, the widespread adoption of that, I think, is very interesting. It demonstrates there's a desire for it. Other apps like, you know, Apple's texting app has end to end encryption.

Dave (16:55): So I think, you know, things like that are becoming part of the expectation rather than an added feature. Again, I don't know. I wonder how that's going to bump up against law enforcement from the policy point of view because there, and law enforcement has a legitimate desire to be able to do the work they need to do. But if encryption - encryption is not hard anymore, right? It's not exotic. It's not hard to do. So, if you take away my Signal app, I'm sure there's going to be someone somewhere around the world who's going to spin up an app that I'll be able to download, even though I'm in an area that has no, where it's illegal...

Kathleen (17:38): Right?

Dave (17:39): ...technically. So it, you're not going to be able to make it unavailable. Maybe inconvenient. So I don't know.

Dave (17:49): I, I guess it's a roundabout answer to your question, but I, I, part of my answer is that I don't know that I've seen anything recently that has made me go, "Oh, wow. That's really interesting and new." Actually, you know what, I'll, I'll take that back. I think some of the interesting work I'm seeing is in some of the really advanced encryption technology, like the folks at Envail who are doing work with homomorphic encryption, where you can you can look at the, you can, you can perform calculations and analysis and so forth on the data that has been encrypted without decrypting the data and without revealing what the data is. And to me, this is, that is like that old saying from Arthur C. Clark, that a high enough level of technology is indistinguishable from magic. You know, I understand that they're, you know, very, very smart people working on these things and and it's amazing that they can do the things they do. So will we see those sorts of things become part of the day to day? Will everything be encrypted so that if some, if there's data breach that it doesn't matter because it all has strong encryption and, you know, you're, it's worthless that way? I think it will be interesting to track that as well.

Kathleen (19:12): Yeah, it's fascinating because I was just talking with someone yesterday about quantum computing and how, you know, it's probably not going to really roll out for 20 to 30 years, but, but what most people don't really consider is that it's still a risk now because data stolen now can be held. And as soon as it becomes viable, you know, essentially, that data can be cracked. And while that might not matter if it's your, you know, today's checking account, it does matter when it comes to, you know, government data, other intellectual property, some, some personal information, health related information, et cetera. So, yeah, it's, it's interesting to think about, you know? The risk is, is very real now, even though the possible compromise of the data isn't coming for awhile.

Dave (20:05): Yeah. And we've certainly heard those stories that our adversaries, you know, might be a, you know, vacuum, vacuuming up encrypted data that they've gotten access to. And like you say, even though it's not useful to them now, it doesn't mean it won't be useful to them later. I like, there's a joke about quantum computing that it's kind of like fusion energy, that it's, it's always 20 years away, no matter when you ask. I don't, I mean, I think there's definitely progress being made on quantum computing, but yeah, it's definitely seems to be fuzzy as to when, when it'll actually make a difference in our lives. And I don't have a good sense for what that timeline is.

Kathleen (20:46): Yeah. So when you think about the, all the change that's happening, you know, we talked about quantum computing and we talked about this push and pull between people wanting stronger encryption and the need for law enforcement to have back doors.

Kathleen (21:04): When you think about this whole landscape that we're in right now, what do you see as the biggest challenge that we're going to face in the next year with respect to secure communications?

Dave (21:13): I think it's, I think it's the human side of it. I think if we look at how people are being attacked these days, a huge percentage, depending on who you ask, the people will say up to 90% of breaches start with a phishing attack. So taking advantage of our natural human impulses to either be helpful or to respond to something that makes us fearful or trigger some kind of emotion in us. And the bad guys know that. They take advantage of it. The techniques they're using are not new techniques. These are age old scams that have been adapted to the modern age. So, I think being able to have the machines assist us with that, to be able to do a better job at looking at our communications and saying, "Hey, this doesn't, you know, the, this, this this return email address looks like it's coming from inside your organization, but it's not, in fact, it's routing back to some bad place that, you know, so don't click on this." Those sorts of things.

Dave (22:29): But then also, you know, assisting us, basically having our back. You know, being that, that virtual assistant who can help. If you look towards the future, you know, I can imagine a system, you know, maybe making use of your web cam or something and saying you know, "Hey, Dave you seem a little wound up right now, are you sure you want to hit send?"

Kathleen (22:59): Oh a lot of people could benefit from that.

Dave (23:02): Or maybe I could tell my computer, I could say, listen, if you notice that my heart rate has increased, you know, because, because I'm wearing an Apple watch or a Fitbit or something like that. So you have your, you're sensing into my, you have a view into my biology, right? So if you notice that while I'm responding to an email that I'm getting a little wound up about something, and you notice my eyes are moving around or whatever, I want you to automatically hold that email for an hour before you send it. And then before you send it, I want you to check back with me and say, "You wrote this email an hour ago, and since then your blood pressure has gone down. Are you sure you want to, you don't want to take another look at this?" Right? So maybe that way, the technology can have our back protect us against ourselves. Some of our impulses when it comes to those emotional responses to things.

Kathleen (23:55): Yeah, the, the topic of human, the human element has come up a lot in the conversations I've been having for the podcast. And, you know, it's, it's interesting because I think in cyber, we, we do many times think technology first. But this can't, you know, at least right now, it can't be solved by tech. Although I love some of the ideas that you just mentioned. I wish those existed, you know? That and a breathalyzer that you have to blow into before you send an email or a text or a post to social media. But in the absence of, of a tech solution, you know, how do, how do we solve this? I mean, how do we solve the human thing? Because it seems like there are, there is plenty of training out there, but it goes right back to what you said in the beginning, which is that, you know, we're, I hate to use the word lazy, but in some respects, it's true, you know? It's, we, we follow the path of least resistance.

Dave (24:50): Yeah. And I think rather than saying we're lazy and I think it's true, w,e are you know, I certainly, speaking for myself, I am. But I think it is probably a better way to say it is that we're human. And so we just, we, all of us have these human frailties and shortcomings, where the way that we're all wired, we respond to certain emotional impulses. And all the data and science shows that the bad guys know how to press our buttons and they know how to get us to do things. And so there's no shame in that, right? And so, so I think an important notion here is that organizationally, when you're building your company culture, if someone does accidentally click on the link or forward the email or, or whatever, there shouldn't be punishment for that.

Dave (25:46): That should be an opportunity for education and figuring out, you know, why did we as an organization become a victim of this? Why did we fall for this? Did we fall short on training? Did we fall short on, on tech? We fell short somewhere. How could we have done a better job and not shame someone? Because I think if you have people functioning in an environment of fear, then they're going to be afraid to report anything to you. And you want those open lines of communication so that everybody in the organization knows what's going on. I think it's another interesting point is we're all working from home here with coronavirus is that makes it a lot harder to poke your head in your colleague's office or the cubicle next door, and say, I just got this funny email, or the boss just asked me to wire $25,000 to someone right away. Does that sound right to you? No, it's harder to have those little conversations that I, that are useful for checking things out, slowing us down, you know, having a little personal cross human backup before we do something that we may later regret.

Kathleen (26:58): Absolutely. Yeah, it does present new challenges and certainly the, the threat landscape has gotten bigger. You know, I've been just so disappointed to see the, the escalation and attacks that have happened since this all started, not just against, you know, the average person working from home, but against health care facilities and, you know, just, Ugh.

Dave (27:19): Yeah. And just some of the, the, these folks have no shame. You know, some of the despicable attacks of claiming that you know, someone you love is, has the disease, or if you don't send us money, we're going to infect you or one of your loved ones or something like that. You know, they don't, they have, no, they have no honor, they have no scruples. And so that's who we're up against.

Kathleen (27:42): Yeah. There's a special place in hell for people who take advantage of something like this.

Dave (27:48): Agreed. Agreed.

Kathleen (27:49): Yeah. Well, this has been so interesting. I could talk to you for hours. I love, I love the perspective you have, you know? Because normally, when I chat with folks, they're from a particular company, or, you know, they've, they've created a certain technology, but it's interesting to speak to someone like yourself, who, who has this perspective of, of looking at the industry as a whole.

Dave (28:10): Thank you. Yeah. Thanks for having me. No, it was a real pleasure. Thanks for extending the invitation. This was a lot of fun.

Kathleen (28:17): Absolutely. Well, if you are listening and you enjoyed this episode, please consider leaving the podcast a review on Apple podcasts or wherever you choose to listen. And we want to hear from you. If you have an idea for a future episode or a future guest, tweet us @Attilasecurity. That's it for this week. Thank you so much for joining me, Dave.

Dave (28:37): My pleasure.

Despite incredible advances in technology, the achilles heel of cybersecurity continues to be human error. Why is it so hard to solve?

On this week's episode of The Secure Communications Podcast, guest Ron Woerner talks about the intersection of human psychology and cybersecurity and why the future of cyber needs to be grounded in simplicity.

Welcome to the Secure Communications Podcast Data in motion is complex, chaotic, and unsecure, but the ability to seamlessly communicate is what drives innovation, growth and progress. Discover how the leading minds in the fields of technology, cybersecurity and communications are tackling the challenge of securing data in motion, and gain insights into what's new and what's next on the Secure Communications Podcast. Each week, host Kathleen Booth interviews bold thinkers who are developing and/or employing transformational technologies to solve communication security challenges.

Ron Woerner has spent his career studying, advising businesses, and teaching others about the intersection between human behavior and cybersecurity.

As President and Chief Trusted Advisor at Cyber-AAA, he solves cybersecurity problems by providing answers, assurance, awareness, assessments and advising for small, medium and large organizations. Woerner established the Cybersecurity Studies program at Bellevue University, an NSA Center of Academic Excellence where he still teaches.

Ron has been featured at TEDx, (ISC)2, ISACA, and RSA conferences for over 15 years. He has written for multiple security publications and has created online courses for LinkedIn Learning and Cybrary.

In this episode, Ron talks about why human error continues to be one of the primary challenges facing the cybersecurity industry, and what needs to happen to solve for it. 

• Visit the Cyber AAA website
• Follow Ron on Twitter
• Connect with Ron on LinkedIn

Kathleen (00:02): Thank you for joining today's episode of the secure communications podcast. I'm your host Kathleen Booth and today my guest is Ron Warner who is the CEO, President and Chief Cybersecurity Consultant at Cyber AAA as well as a professor of cybersecurity studies at Bellevue University. Welcome Ron.

Ron (00:25): Oh Kathleen. Glad to be here. 

Kathleen (00:30): I'm happy to have you here. For those who are listening, could you tell my audience a little bit more about yourself and your background and what you do in the field of cybersecurity?

Ron (00:39): Certainly. So I'm an Air Force veteran. I was an Air Force intelligence officer and that's how I actually got started in information security. I was a computer science graduate working in intelligence and just led me naturally into data protection. When I left the Air Force, I was a Unix systems administrator and this was back in the day where we didn't have specialized security professionals. So it was also my responsibility to secure the networks and the systems for companies like Mutual of Omaha, ConAgra foods, TD Ameritrade. About 10 years ago I decided I wanted to try teaching. So for the past 10 years I've been teaching for Bellevue university in their cybersecurity studies. But I also act as a security consultant for small and medium businesses, helping them solve numerous types of security problems and ensuring they're compliant with the different laws and regulations such as NIST, PCI and ISO.

Kathleen (01:38): Fantastic. And one of the things I find so interesting about the whole realm of cybersecurity and secure communications is that, you know, there is such a strong, if you will, technical or technological aspect to it. The, the technology is evolving so rapidly, but there's also this other side of it which has to do with the human condition and psychology and human behavior and really human factors, I guess is the best way to put it. That, you know, you can have in many cases an incredibly well crafted technological solution and still the weakest link in your, in your chain if you will, is going to be the people that are a part of the ecosystem that, that is involved in that solution. And you've done some really interesting work in this area. So just wanted to just sort of like say that to kick off the conversation and, and I would love to get your thoughts on, on the human element of communication security.

Ron (02:40): Well definitely. It's not that humans are bad or trying to be malicious on purpose. We often just are trying to take the path of least resistance in solving whatever problem, whether it's communicating remotely like so many of us are doing right now because of the Coronavirus or just trying to get their job done. So it's important to understand the user's perspective in developing the solutions, this way they can implement it as easily as possible and security is not seen as a blockade as it often sometimes is. So it's the idea of understanding that user experience, or UX, as a part of the technology development process, talking to end users, finding out what they want, how they will use it, how maybe they will misuse the technology. So that's all of what I've been studying for about the last 10,12 years.

Kathleen (03:36): So why is this such a difficult problem to solve? Because it's been around for some time. As you said, you've been studying it for 10 years. Why, why is it so hard?

Ron (03:47): Because so many people, we're all different. But we're all very similar. If you read the book predictable, predictably irrational name, the author is slipping my mind, but he studied this - how we're very predictable, but we all tend to be irrational in how we approach and solve problems. So that's always going to be the challenge. Plus, so often from a technology, so I'm a techie, I'm a geek, nerd. I think my perspective is the way to go, and it's sometimes hard for me to understand the end user's perspective. Plus it takes a lot of time and effort as part of the development process to go out and talk to sample user populations to find out how they will leverage the technology and again, how it could be abused and misused as well.

Ron (04:38): And that's why we need part of the whole development life cycle to include requirements testing throughout and then penetration testing or red teaming at the end of the process to find out those security gaps.

Kathleen (04:52): So, during the design stage of, of if you will, architecting either a technological solution or putting together a cybersecurity program, what are some of the things that organizations are currently doing if, I guess in the, in the best practice category to try and tackle this before it becomes a problem?

Ron (05:13): Of course the answer is it depends. The really progressive ones have user focus groups available early and get them involved in the conversations in the development process. So many times though, what happens is we take a compliance based approach where we look at the current requirements like NIST, like PCI, HIPAA, ISO, and we base our security on those, which aren't necessarily based on how end users will actually use the technology.

Ron (05:44): Keep in mind, most of the laws, regulations were written a long time ago, like NIST, the one many of us now follow, was actually written back in 2012, 2013. Think about how things have changed since then. We're so much more reliant on mobile technologies and cloud infrastructure and that was not necessarily included in those early compliance documents. So again, the idea for developers, it's just finding out who your user base is, getting involved with, getting them involved in the process as early as possible and then understanding how they think and how they are influenced, which is actually a whole other area of human aspects that we like to talk about.

Kathleen (06:28): Is that really where design thinking comes in and, and you know, structuring your, your development process to have those sprints where you're really engaging prospective users and essentially observing them as they behave in the wild?

Ron (06:44): Right. Well that's exactly right Kathleen. You need to observe how they will leverage the technology early so they can, you can understand, well again, how will they not only use it in normal environments, but how it could be used abnormally through the testing cycles. For example, I am a hacker, a pen tester, and one of the things I'll do is figure out how technology breaks. And that's because end-users will accidentally break things all the time. They won't even understand how they did it. They'll just begin playing with it and all of a sudden, poof, they can get into an insecure state. So that's why having security as part of these like agile sprints can be very beneficial. And then understanding really how to make the technology usable. So this way users, the end people who are leveraging it, will want to use it. It's user friendly.

Ron (07:44): So from the design principles, we're looking at it based on psychology. It's, you know, is the product easy to understand? It's almost likable. Like we like humans, we can like technology as well. And understanding those types of usability gaps actually from fundamentals that were designed back in the 1970s.

Kathleen (08:07): Yeah, it's fascinating how some of this stuff is, you said NIST is from what, you know, what is it six years ago? And, and other elements are from even farther than that. What are some common ways that you see these, these issues manifest themselves? I mean, I imagine that there are certain behavioral things that come up over and over again that, that you see as common mistakes in the process.

Ron (08:34): Right. People again, will take the path of least resistance, for example, with their network security. So many, when they're working from home, don't want to use a VPN for example, because of that fear, the unknown unknowns, if you will.

Ron (08:49): I'm afraid if I use a VPN to encrypt my network traffic, that it will slow everything down or that I won't understand how it really works. So it's just, how do we educate as a part of this? And that's where being a teacher really comes in handy. Being able to teach early and make it very, very small chunks of information. Because if you overwhelm your end users with too much information right away, then they won't bother either. So it's just, how do we take like, two to three minutes worth of chunk learning to help our end users leverage the technology?

Kathleen (09:29): So you just raised education and that actually taps into the next question I was going to ask you, which is, you know, knowing that at least at the stage we're at right now, there isn't a solution to, to, to guarantee that any security solution is going to be architected in a way that is perfect or completely locked down. You know, I think we have to acknowledge that we need to do something to try and encourage users to, to comply, if you will, with the behavioral traits that we're looking for. So, you know, just tapping into psychology, I feel like there are a couple of different ways you can approach this. You talked about education which is, is can be very anticipatory. But then there's also the, the carrot and the stick approach. There's incentives, there's, you know, punishment for noncompliance. What do you find is most effective? I'm assuming it's probably a mix of these things, but I've never seen any data to support what works and what doesn't in this regard.

Ron (10:36): Actually, there's a lot of data saying that the stick, with the carrot and the stick doesn't really work very well with most people. I mean, young kids maybe, but you really need to show them the benefits and how that benefits them personally. So Simon Sinek, Start With Why. What is their personal why they want to do this? For example, taking from the current situation with coronavirus, we're constantly being reminded to wash our hands and not to go out if we're sick. I mean, this is nothing new, right? But it's really being driven home now because it's affecting us personally. We don't want to impact our neighbors if we happen to have this and not even realize it. So it's taking those ideas outside of the world of technology and bringing them in. We call it cybersecurity hygiene.

Ron (11:28): So what does that hygiene we can be taking and doing, like washing our hands? Well, it's like spring cleanup around our homes right now. We're recording this at spring. We should be doing spring cleanup on our PCs. Are we running only the programs we need to run? Otherwise there's too much overhead. Just like if we have too much junk around our house, it makes it hard to walk around. Too much junk on your computers or on your networks, it's too hard to, to be able to allow the traffic, network traffic, that needs to get through. And so many people don't even know what's on their home networks with all of the IOT types of devices that people are plugging in. A common complaint I hear is that now everyone is working from home and all the kids are taking classes from home. It's bogging down the network. So look at your inventory. Start with the inventory. What do you have? If it's not needed, unplug it. Get rid of it. Make those decisions. So it's really what we need to be doing, on the technology side, is really learning from how we do things in our daily lives.

Kathleen (12:31): So do you have any, any examples that you can point to at the organizational level of companies or organizations that have done this really well and how does that play out? What does it look like?

Ron (12:44): Yeah, so the companies that do cybersecurity well, again, they make it personal for the employee. They show how the employee is part of the security equation and the little steps that they take. Keeping it as simple as possible. So KISS, if you will. Keep information security simple maybe where you know, hey, by just making sure my computer is being updated, that I know like, at the start of Zoom meetings, what am I talking about? If there's anything sensitive, then making sure we know who is in the Zoom meeting. I mean, those little behavioral steps go a long way that everyone can be involved in letting the employees know that they are an important part of the security equation. And again, encouraging the right behavior. So learning from common management practices like The One Minute Manager, remember? This whole book by Blanchard and Johnson where they're talking about one minute goals. So, you know, what is the one minute things that end users can do? One minute praise. So not just, in security we like to just tell people how they're doing things wrong. No, we need to show them. Hey, you're doing things right. When you compliment how things are going well, then when there's that room for improvement, it makes it so much easier to make those subtle little changes. So that again comes back to this human aspect, understanding basic influence and leadership techniques, and how do we equate it back into communications and security?

Kathleen (14:16): Well, that's a really interesting point because you know, that makes me think about where responsibility for this typically lies within the organization and, and, and I guess I would ask you that, who do you see within companies or larger enterprises or even you know, educational institutions, nonprofits, government, who do you see typically owning responsibility for this?

Ron (14:41): The ones that are doing it well, I'm seeing this right now with my clients as a cybersecurity consultant, it's where upper management is taking the lead because it becomes having the right culture of security. One of the companies I'm working with, the CEO is leading the charge for security. Even though he's delegated it to his chief security officer and chief technology officer, he's the one who is saying, Hey, this is what we need to do to be successful as a company. I've seen the same thing with the chief financial officer because security is really about risk, which is an economics problem. For example, I was working with one client and they were wondering why they were using so much network bandwidth, and this was the first time the CFO had asked the question, so where are we using all of our network bandwidth? And the network engineer was in the room and said, Oh, well here, let me show you.

Ron (15:32): And I pull it up. And lo and behold, what were the top sites? Facebook, Netflix, Google. The CFO had a minor cow right there because this was a defense contractor where employees shouldn't have been watching Netflix during, you know, using the company bandwidth. So right there, he was able to set the direction and then percolate it down to the rest of the company. So it's just, again, common, good leadership techniques. Take it from the top. Too often we see Kathleen, and this is a situation, unfortunately this may resonate with some of your listeners. It's known as Spaf's first theorem, first law, of security administration. It goes like this. If you have responsibility for security, but you don't have the authority to enforce it, you're just there to take the blame when something goes wrong.

Kathleen (16:24): That's so true. I think that's true of most positions of responsibility.

Ron (16:31): Very true. So that's where they need to match up, and the companies that are successful match responsibility with the authority for network communications and network security.

Kathleen (16:43): You know, and that gets me thinking about leadership paths for cybersecurity professionals because so many of them start out with more of a technical kind of education background. But from everything you're saying, you know, I'm hearing things like, if you're going to be an organizational leader in the field of cybersecurity, you need to have really strong skills in education, in leadership. You know, all of these other soft skills that are not necessarily the things that we associate with an education in cybersecurity. So I wonder if you could speak to that.

Ron (17:17): Certainly that's sometimes the challenge with this. I'll be talking to young folks trying to break into security or they're already a network security analyst working in say, a security operation center. They'll go, well, how do I get a leadership or management position? Well, you can start actually within your communities. There's numerous groups throughout the United States, throughout the world, like ISC squared, ISSA, ISACA and Infraguard. So, take a leadership role within your local community. Great way to build up the networking, the human networking connections and give you that practice with leadership and management as well. Numerous other groups as well, just taking initiative and taking a lead and finding a mentor. That's sometimes what we forget about as well. Really the good security professionals learn how to coach and mentor. So first of all, ask if you're a junior in cybersecurity or network communications, find a mentor. Ask, will you mentor me? And then, as you get more advanced, become a mentor to other people and it becomes very synergistic where you can co-mentor each other to build each other up. And then that really helps the whole community because you're gaining understanding in real world environments, not just within a classroom.

Kathleen (18:40): That's great advice. So what is the implication of this problem not being solved? I mean, you know, when we think about the human element, it could be one person who's, you know, somewhere in a massive organization of thousands of people. If, if one person kind of makes a wrong move, how big of a problem can that be?

Ron (19:00): Well, it can take a company down when it comes to ransomware. It just takes one person not thinking, going unconscious for a few minutes, you know? Getting that email that looks real, clicking on that attachment and all of a sudden, poof, because they didn't take the responsibility for securing their system, knowing what network shares. So, one person can take down an organization, unfortunately. So the way to do this, well, again, it's just that continual coaching of employees. Why we keep seeing this. So it's a phrase that me and a few of my buddies created like 10 years ago called Security Groundhog Day. Security Groundhog Day. It's like the Bill Murray movie. We're reliving the same day over and over again. Because it's common practices like good network security, making sure you're configuring your network devices appropriately, staying up to date on patches, having policies in place, knowing who has access to what, where, when, why, and how. You know, these things are nothing new. Even though the technology has changed. We're now using all sorts of devices on our bodies, in our homes, but the same philosophies and concepts reign true. So it's going back to those, the basics of blocking and tackling, you know? Taking from sports analogy, it's just to work with our users, coach them, and again, show them why it's important. Get them involved.

Kathleen (20:31): Great. Now shifting gears for a minute, I have a couple of questions that I always like to ask my guests when they come on the podcast. The first one is, with the way that we communicate and manage data changing, what do you see as the biggest challenge that we as a society are going to face in the next few years when it comes to securing our communications?

Ron (20:57): It's the challenge that we're still seeing today is that we're plugging in so many devices now in power networks, whether it's the business network or home network, do we know everything that we're plugging in, whether it's wired or Wi-Fi? Do we have the policies in place to tell the end users that, no, you can't plug in a Google home or Amazon echo type of a device that, you know, they're just thinking it's a Bluetooth speaker. I want to listen to music while I'm working. Why is that not allowed? Or I'm connecting my, I'm pointing to my iWatch, whether it's iWatch or Fitbit or whatever. I'm plugging that into potentially a production network. So it's starting out with that inventory. What do we have? Because you can't secure things if you don't know it even exists. Getting alerted that, hey, we have new devices on our network. Should they be there making a decision, yes or no? Before the yes, then are they configured appropriately? Many times, the manufacturers give direction on how to secure the device, but people may not take the time to do it. So realizing, it's up to all of us. Just like we secure our homes and our cars, it's all up to all of us to secure our business environments as well.

Kathleen (22:12): It's pretty unbelievable how much of our lives are run by, you know, some degree of, of internet connectivity. You know, I think most people have no idea how many things they have running on their network. So following on that, what, you know, looking ahead to the next five years or so, what new secure communications technology are you personally most excited about?

Ron (22:43): Well, I think to make security, keep it simple so that KISS approach. Keep information security, small, simple, accessible for everybody. So that's where I see, really, the innovations to where we can bring security with us wherever we go. So let's just say I need to work from a coffee shop. Well they're known to be very insecure. Or an airport. When I would travel, I would get a lot of work done at airports, but using their Wi-Fi is just not always a good idea. There's numerous steps we need to take. And again, sometimes we're in a hurry and we forget about locking the car doors if we will, doing it with our network security. So keeping those devices small, simple where we can plug in our security wherever we are, on any of the devices that we have. This way, we'll always be in a secure state and we won't even have to think about it. Like today, how we lock our car doors as we're walking away from our car because it's become unconscious for us. It becomes so easy. We need to get to that within our network communications and security.

Kathleen (23:48): Great. And is there anyone in particular that you think is doing really interesting or, or bleeding edge work in this area of, of communication security?

Ron (23:58): Well, of course Attila, with your products, with making them very small and accessible. Really, again, it's that approach we need to take. We're seeing this with numerous other companies as well, integrating security into the technology too. So it's not just an add on, you know? How do I secure a home after it's already been built? No, you want to build security in. So it's that actual model is part of the application development or product development life cycle as well, where you can turn to the companies and find out ,yes, that you've already been certified in security and you can prove that you have the right amount of security depending on your, what is the sensitivity of the data or the systems in use.

Kathleen (24:45): Great. All right, well we're coming to the top of our time, Ron. If someone wants to learn more about you or follow you online, what's the best way for them to do that?

Ron (24:56): Certainly go to out to my website, cyber-aaa.com. You can also follow me on Twitter at @ronw123 or connect with me on LinkedIn, just Ron Woerner. I make myself very accessible on purpose because I love connecting with people. Together, we can solve today's security challenges and that's why I love being able to come on podcasts like this. So Kathleen, I appreciate you having me.

Kathleen (25:22): Oh, I appreciate you coming on. And I will put all of those links that you just mentioned into the show notes so you can find those on the attilasec.com website. Thank you for joining me this week, Ron. And if you're listening and you enjoyed this episode, please consider leaving the podcast a review on Apple Podcasts or wherever you choose to listen. We want to hear from you, and if you have an idea for a future episode or a guest that we should speak with, tweet us @Attilasecurity and we'll look forward to hearing from you. Thanks again, Ron.

Ron (25:55): My pleasure. Be safe everyone.

Kathleen (25:57): You as well.

Mobile voice and messaging has been around for a long time, but is still plagued with security vulnerabilities. Given the explosive growth of mobile device usage, why hasn't this problem already been solved?

On this week's episode of The Secure Communications Podcast, guest Nigel Jones of KoolSpan talks about the evolving landscape of mobile communications security, and what it will take to provide a high level of security in an increasingly mobile, connected, and interoperable world.

Nigel Jones has a unique perspective on the secure mobile communications space, having worked as a Marine Corps officer focused on secure voice and data communications early in his career, to investing in the industry as a partner in private equity firm TWJ Capital and a Principal at the Carlyle Group.

Today, he's the CEO of KoolSpan, a leading provider of robust, cross-platform, communication security on smartphones globally, with government and enterprise customers in more than 60 countries.

In this conversation, Jones explains the history of mobile communications security and why, despite the astounding growth in mobile telephony, the sector is still plagued with security vulnerabilities. He also shares his insights on what it will take to finally solve the security challenge. 

Kathleen (00:13):

Thank you for joining today's episode of the secure communications podcast. I'm your host Kathleen Booth, and today my guest is Nigel Jones, who is the CEO of KoolSpan. Welcome Nigel.

Nigel (00:25):

Thank you. It's a pleasure to be here. Thank you for having me.

Kathleen (00:28):

Yeah, I'm excited to talk with you. Before we dig into the topic at hand today, could you maybe tell my audience a little bit about KoolSpan and also your story and how you came to be doing what you're doing today?

Nigel (00:43):

Okay, great. So thank you again. So first of all, KoolSpan, based in Bethesda Maryland, is the leading provider of secure mobile communications as a platform for government organizations and enterprises globally. We're deployed in more than 60 countries worldwide and continuing and actually accelerating our pace of deployments as the, as the need for secure remote communications in this current environment has become really much more intense.

Kathleen (01:10):

Yeah, it's so timely what you're doing.

Nigel (01:12):

Absolutely. I guess from my background, I started my career, my professional career, actually as a communications officer in the Marines. So I feel very passionately, particularly about providing secure communications to that organization, to that community, that DOD community in particular. And I've been CEO of KoolSpan since 2015. Spent a bit of time in operations and as the chief financial officer before that. And before that I just, I've had a variety of roles across private equity and venture capital as well, focusing primarily on telecommunications infrastructure.

Kathleen (01:47):

Okay, great. And you know, this topic of mobile network security, as you said, it is so timely because as we're recording this, we're I don't know how many weeks now, I think I've lost track of time, into the Coronavirus pandemic and so many people are now working from home. And you know, the number of cyber attacks has increased on all fronts from everything I've heard and the data I've seen, and I'm sure mobile is no different. Can you talk about why, you know, cell phones and smartphones have been around for so long, but I guess a great place to start would be to talk about why, given that these are not new devices, is this still such a problem? Why is it so hard to secure mobile networks?

Nigel (02:33):

Yes, exactly. So this goes back. The issue, the fundamental issue, goes back to the beginning of the development and implementation of mobile networks back in the seventies. You know, back in the seventies when mobile networks were first designed, they were designed in terms of the way they interoperate, the operating protocols, with the baseline assumption that every network can be a trusted network. And in 1975, that was actually true. There were a handful of networks. And in order for users to be able to operate seamlessly roaming globally, every network was assumed to be a trusted network in terms of how the calls and messages were handed off. And that was, you know, going back 2G, 3g, that protocol SS7 has been in place ever since that and has had that same fundamental design flaw. What's even more amazing is that the interoperating protocol for 4G and soon 5G networks, Diameter, has the same fundamental design flaw. 

Nigel (03:29):

And this protocol, you know, designed by the GSMA in Europe, it has to be a global standard that, that fundamental assumption that every network is a trusted network enables, you know, commercially available software as well as software that's available on the black market. You put it on your laptop, you put a phone number in, you're very easily rerouting calls, monitoring calls, capturing messages. And the issue is pervasive. It's been around for a long time. It's really, you know, just a couple of years ago, actually, the FCC and the Department of Homeland Security for the first time explicitly acknowledged the fundamental security flaws in mobile networks and they explicitly made the recommendation for the adoption of end to end encryption on the application layer. As you pointed out, it's really just been in the past two or three months with this, you know, this absolute requirement to communicate in terms of remote teleworking, the need to communicate securely or actually where it is that we're not communicating securely, that the issue has really come front and center.

Kathleen (04:29):

Yeah. I have to admit, my mind is kind of blown that this has been a problem for so long and it hasn't been fixed. Now granted you mentioned there's this new mandate, but why wasn't it fixed sooner?

Nigel (04:42):

So in our experience, actually the issue, the awareness, the requirement for secure mobile communications has actually been much more pervasive for a much longer time outside the US than in the US. So across Latin America, across the middle East in particular, they've been working on providing or enabling more secure mobile communications for, you know, and trying to get the best solutions possible for much longer than we see here. And I think part of it, just anecdotally, is really a false sense of security in the United States. People don't understand that when they're talking on their AT&T phone, they're talking on their Verizon phone, you know, as long as China Mobile is roaming, you know, seamlessly with Verizon, AT&T, it doesn't matter where the bad actor sits, if they have the right software and those two networks are communicating with each other, you're vulnerable. And I think that that awareness has just not been - it's a bit of a puzzle to be honest with you why that understanding hasn't been as pervasive in the US as I've experienced outside of the U S

Kathleen (05:50):

Yeah, I think there's, it definitely sounds like there's a cultural component to it. But I think what's fascinating to me is KoolSpan works with the government, you know, and I can see where the average person could say, you know, who cares if somebody listens to my conversation, you know, they might find out what movie I'm watching tonight or where I'm having lunch. But it's a different story if you're, you know, an executive with a company that has high value intellectual property or you're working for the US Missile Defense Agency on, you know, trajectories for missile launch. Like, these are things that, that can't be compromised. So knowing that there are those aspects to mobile network security and there are organizations that do have so much to lose. How are they addressing the situation right now because that's a problem that already exists?

Nigel (06:45):

So first of all, in all fairness, there's always been secure communications available for the highest levels, for, you know, top secret type communications, white house communications, agency type communications. Those are very expensive devices. And so in part, the issue at the highest, highest levels of government has been addressed, but it's a very, very thin segment of the market. The other element there where we've seen people try to address the problem is using consumer oriented applications, open source types of solutions like Signal, WhatsApp, Wire, those types of solutions, they have their own problems inherently, particularly in terms of not enabling an end using organization to have complete control over the backend infrastructure and the types of policy enforcement tools that are required. And I think that that kind of points to the broader issue we've seen with mobile communications, not just calling and messaging, but just generally people not understanding that you've got to have a pretty broad footprint of security in terms of securing the data on the device, securing the application, protecting the application, preventing the operating system from being compromised. And that market is continuing to grow, but it hasn't grown as fast as it should have.

Kathleen (08:04):

That's so interesting to me. You know, and let's go back to your example earlier of the average person, the consumer who has, especially in the US, this lax attitude towards security. What does that person have to lose if they were breached or compromised?

Nigel (08:23):

Well, yeah, it's a very interesting question and to be honest with you, for most people, for the average consumer, in many cases, WhatsApp is good. It's good enough. I use WhatsApp talking to my friends and family. And really in terms of my personal communications, typically you don't have a lot to lose. And that's why we focus on providing a more robust layer of protection and security for government and enterprise customers where there really is valuable or highly sensitive communications that are transiting the networks. I just lost my train of thought. I got it. The issue we see now though is that so what is there to lose? So now we're kind of securely, we're not securely communicating. We're communicating on a distributed basis in this COVID environment. Everyone is working from home or people are going to school online. What there is to lose is when you've got a class on Zoom and you start getting Zoom bombed and you're getting all kinds of, you know, illicit material or racist material or racist communications. And then that's when you really realize that even in a collaborative environment, on a collaboration platform, if it's not secure, even as an average consumer, there's a real threat. Your kids are threatened. Your work communications can be, you know, they're at risk.

Kathleen (09:42):

Yeah. I actually experienced that. I was not in my personal life or even in my job, but I was speaking at a virtual summit for another organization and it was myself and two or three other panelists, and there were some of the most vile comments that came through, clearly from a Zoom bomber. It was the first time I'd ever experienced it and it was more disturbing than I thought it would be. So I definitely can appreciate that more now than I could before. And that happened after all of this Coronavirus stuff started. So there's definitely been an uptick.

Nigel (10:17):

Exactly. And I think what's happened is that the threat surface has grown exponentially since everybody's using the same platform to communicate, which has attracted hackers and people, you know, the bad guys to find ways to exploit that much bigger attack surface. And I think, you know, for better or for worse, my guess is that there's going to be a lot more remote working, a lot more teleworking going forward regardless of how the world and the current situation evolves. And hopefully we'll get better. But I think people will be working for home more than they used to, which means that that attack surface is going to be bigger, you know, going forward than it ever was before, which means that there's going to be a need to have more secure solutions than Zoom because Zoom is not secure.

Kathleen (11:02):

Yeah, I couldn't agree with you more. I think the genie is out of the bottle when it comes to remote work and everybody's, even the doubters have recognized that the world has got, you know, continued on and there are so many not, you know, definitely not everyone can work remotely, but there are so many people who can and are and doing it well that it's going to be hard to go back to a place where we mandate everybody come in all the time. So for this to actually get addressed, I find it really interesting because you talked about GSMA and you talked about how this is very much an international problem because you have these interoperability issues. What needs to happen from a coordination standpoint for this to really get solved?

Nigel (11:45):

So from a coordination standpoint, the global mobile network operating community is working to provide more security on the network level. And that's in terms of implementing firewalls, SS7 firewalls, Diameter firewalls, which are meant to try to catch these malicious routing and queries. And so there's been some progress. That's actually a pretty fast growing market. The problem is, even with those firewalls, a query that looks legitimate from a legitimate actor to reroute a call or a message may actually be, you know, a hack. And so they're trying to implement more intelligence into the firewalls with data and analytics. And that will continue to evolve. That market will continue to evolve. But that is why the FCC and DHS and others are saying even with improved security on the network layer, you still need an additional layer of security on the application layer in the form of end to end encryption.

Nigel (12:48):

And I would even take it, you have to take it one more level and say, okay, well if my application is giving me end to end encrypted communications and messaging, encrypted end to end encryption for data in transit, what happens if my device is compromised? If my device is compromised, even if I have end to end encryption, if someone captures the microphone or the speaker, if they can take screenshots outside of those bounds of end and encryption, I could still be compromised. And that's what happens actually many times with hacks of WhatsApp. And that's why you need to have, the application either has to have the ability to detect rooting or compromise of the operating system, or you need some additional layer of protection on the device that can protect from the device itself being compromised, and particularly the operating system. So it's really, it's gotta be a multilayered defense.

Kathleen (13:36):

Yeah, it sounds almost like you're talking about Zero Trust at a mobile device level.

Nigel (13:41):

Absolutely. I'm talking about Zero Trust. And I'm also talking about just fundamentally, if the operating system is rooted, all bets are off. So it's the ability to detect that the operating system that the integrity is still there.

Kathleen (13:54):

So you've got the operating system, the application and the device. When we look at those three realms, where are you seeing that the most progress has been made to date in securing those things?

Nigel (14:08):

In our experience, I think the most progress has been made actually on the device level in terms of having more protections, in terms of secure workspaces, and other elements to detect if the device you know, knocks. Zimperium if the, if the operating system is, is still protected.

Kathleen (14:28):

What are some new and interesting ways that this issue is being addressed? Are there new technologies that are starting to emerge that you think hold a lot of promise for solving this?

Nigel (14:42):

So I think over the horizon, both in terms of our own technology and, and more broadly, the real key is to integrate the security as much as possible into the native applications, the native calling, the date of messaging such that, you know, when the other person, the person on the other end has a similar configuration and authorization, that call, that message is just secure, automatically, by default. That's the next generation of our products. And I'd say more broadly, whether it's a collaboration tool or just a communication tool, a one-to-one communication tool, being able to natively integrate the security capability, the security feature without, which means that the user does not have to make an independent decision to adopt a security feature, is really the key. And I think that that's where the world is heading and, you know, five or six or seven years from now I think that's where we will be in terms of the security on the device as well as securing data in transit. It will just be there and it'll be kind of seamless in the background. And the key to that is going to be the adoption of standards across, you know, the iOS world, the Android world and so forth.

Kathleen (15:55):

That sounds like a big hurdle. The adoption of standards across all of these different worlds. I mean, you've got really entrenched players that at least, it seems to me as somebody who's not as deeply embedded in this as you are, don't always play so well together. Are you seeing that there's more cooperation between some of these different players or the possibility of it?

Nigel (16:19):

On a regional basis we're starting to see some cooperation. So for example, iMessage, FaceTime, those are actually relatively secure tools, although there's still issues with the back end infrastructure where it's being hosted at Apple. But there has been an impetus amongst the carriers, and I've seen this particularly with the carriers in North America, to begin to adopt end to end encrypted communications, you know, that's managed by the carriers. RCS calling and messaging for example, that's managed by the carriers. That's a regional initiative. I could see a world, particularly as 5G gets rolled out, you know, a decade from now where there might be some global mobile network operator level protocol for end to end encrypted calling and messaging potentially that would, potentially supplanting solutions iMessage and FaceTime.

Nigel (17:25):

Now the issue will be, those would be good solutions for consumers. You would still have this fundamental problem that governments and enterprise or you know, big enterprises have, in particular the US Department of Defense, where they need to be sure that the backend infrastructure for user administration, for call management, the call data records, that really needs to be under the control of the end using organization in order to have the maximum layer of protection and security. Because even if the carriers move to adopting more encrypted tools themselves, you still have the problem that the carrier themselves, the service provider, is hosting the infrastructure.

Kathleen (18:04):

And then, sort of related to that, when you think about corporate mobile device usage, I've worked in a variety of settings, some where I'm issued a cell phone by my company. Some where I have to have my personal phone and my company phone. And then others where I just use my personal phone. You know, I would imagine that now it's much easier to exert control if you issue your employees phones, although the cost of that I would think is considerable. In the future, how do you think that will be handled?

Nigel (18:39):

So if I understand your question correctly, I think this points to one of the other issues with the consumer oriented applications being used in a government or enterprise context. And that is, if you're using WhatsApp to chat, to send chats with sensitive information to your colleagues, and you leave the company or you lose your device, all of that sensitive chat history is right there. If someone could get into the device, they can see what's in there. And what you need, is you actually need a solution that I think this is your point, that enables an organization to remotely wipe the application, remotely wipe the device. But if it's a personal device, what's important is the ability to remotely wipe the application. Because obviously you can't remotely wipe a device. And so I see the world moving towards a place where if it's your personal device and you have an enterprise application or an application for government communications, that application is going to be tied into the mobile device management platform of the organization so that it can be remotely managed.

Kathleen (19:43):

How big of a challenge is the you know, I like to think of it as the uniquely US passion for kind of, I don't want to say privacy because I think in some ways we're very privacy relaxed, but like independence and control over your own domain. I'm curious whether people would accept on a large scale giving a corporation access to any ability of control over their personal device. And if that were to be the solution, that there would be mobile device management at a centralized level within an employer, is it a barrier right now, given the way we're used to functioning in this country to say, as an employer, I want to be able to have ssome control over some part of your device?

Nigel (20:36):

I don't think it's a barrier because if you think about it, I think people have accepted that corporate email is actually owned by the company. And even if you put personal information in your corporate email, you're inherently, you're sharing that information. You're giving the corporate IT manager access to that information. I think where we're getting to, and people understand that email is vulnerable because we, we've seen phishing attacks and email so much more so up to now than we've seen hacks of calls and messages. But I think that more broadly, all data in transit that is under the corporate purview is going to become under more control, similar to what we've seen with email. And I think that because people have become socialized to understanding that they actually don't own their corporate email, I think that they will eventually come to accept that they also don't own all of those messages, you know, in the corporate messaging application. So what you'll have, so I've got TrustCall on my phone, which I use to communicate with people at work and I've got WhatsApp on my phone, which I use to communicate with friends and family, and the two worlds do not intersect.

Kathleen (21:50):

Got it. And you mentioned phishing when you were talking earlier. I started thinking about phishing because, I think at least in my experience as an employee, as a person who's worked for different private enterprises, I've undergone plenty of training to recognize what a phishing email looks like. But I don't think I've ever had any training that talked about the equivalent for mobile devices. What does a phishing call or text, et cetera, look like? What needs to happen on that front? Because it does seem like, from what you're saying, that the individual is still the weakest link in the chain.

Nigel (22:25):

I think it's just going to be, well, it's going to be training, but it's also going to be really awareness and sensitivity to the vulnerability which we're seeing in spades right now. I think people just don't think about the fact that your Zoom call can be attacked, but they do now. And I think that as people become more aware, they're actually, I mean I was just reading articles the other day, they're becoming aware of how does, how to, to the extent they can adjust the privacy and protection and policy settings to give themselves more protection.

Kathleen (22:57):

Yeah, it's definitely changed really quickly. That's been an interesting thing about this current situation, is I think it's been like a catalyst for something that might otherwise have taken potentially years to happen. Maybe that's a silver lining. I don't know. So what needs to happen from a regulation standpoint?

Nigel (23:18):

I think from a regulation standpoint, so this is a really interesting question. I actually think one of the reasons that it's taken so long for awareness in the United States to grow, to be where it needs to be in terms of the vulnerabilities in mobile communications, is because it's been very difficult to have the dialogue with the carriers about the fact that the networks are not secure. And it's really not, so we work with mobile carriers around the world and the message I bring to them is not your network is not secure AT&T. That's not true. AT&T's network, you know, they work hard to make it as secure as possible every day. The issue is that the network, the global network of networks is not secure. And so from a regulatory standpoint, it really needs to be you know, that needs, that's a global issue.

Nigel (24:10):

You know, all of the carriers are using the same protocols that really needs to be driven by GSIMA and they are working very hard, truth be told, to develop more secure protocols for networks globally. However, the problem is going to be for a long time. So, even if we say a 5G network is a lot more secure than a 3G network, well guess what, 5G networks have to be able to interoperate with 3G networks for the next 30 years. So as long as there's even a handful of 3G or 4G networks out there in the world and we want every network to inter-operate, those flaws are going to be there, just fundamentally. The security and vulnerability is going to be there.

Kathleen (24:56):

Yeah. Not to go to a dark and doomsday place, but when you talk about that, it makes me wonder how vulnerable are the larger networks? Like how easy would it be for a malicious actor to take down, you know, AT&T's network, for example? Forgetting about the consumer - like the big one.

Nigel (25:18):

So, yeah, interesting question. I think, and we've seen this a lot in the news in the past couple of years, kind of, you know, where did the components of the network come from? Should we have some sort of national security policy around our supply chains from mobile networks? And I think that the question, actually in my mind at least, fundamentally misses the point, which is that, you know, I think a bad actor someplace else in the world is not necessarily, you know, I don't think they're thinking about how to take down AT&T's network. I think, you know, if you're a spy someplace, if you can have complete visibility into that network and see all of the communications or whatever the communications that you think you need to see in that network, you're just as well having, you know, just maintaining that access as your leverage point, as your asset. And you actually don't have to touch the network in order to have that level of access. The vulnerable, the vulnerability of the network becomes a liability for, you know, for the host country, for the home country.

Kathleen (26:27):

Is it fair to say then that probably many of our existing networks are already most likely compromised?

Nigel (26:34):

Absolutely. Because as long as I can roam from AT&T to any other network in the world, it's vulnerable. AT&T and I'm picking on AT&T, I don't mean to pick on AT&T, Verizon, Sprint, they're all, you know, they're working to put firewalls in place. Those firewalls provide better protection, but it's still, it's a very hard problem to solve because the firewall needs to be a smart firewall, and their firewalls are getting smarter, but they're still not smart enough to eliminate the vulnerability.

Kathleen (27:04):

Wow. That's just so interesting because on the one hand you think about just how quickly mobile device technology has evolved, and how clearly the stuff that underpins it on the backend has not kept pace with that. So fascinating. Well, a couple of questions I want to make sure I ask you before we wrap up. The first is really with the way that we communicate and manage data changing so quickly, what do you see as the biggest challenge that we're going to face in the next few years?

Nigel (27:37):

I think the biggest challenge we're going to face is the one we're facing right now, which is how do we collaborate remotely in a secure way that's actually intuitive and easy to use for a broad swath of the population? I don't think we're there yet and I think we're finding out very painfully that we actually have quite a ways to go. There's quite a different, you know, there's a number of tools that are out there. I haven't seen one yet that I think really rings the bell in terms of ease of use, ease of access, and a robust level of security. I think that that's going to be a big problem for us. A big challenge that a lot of people including us are going to be working hard to solve over the next few years.

Kathleen (28:23):

So knowing that there's not one that rings the bell, what technologies that are out there right now are you most excited about?

Nigel (28:31):

That's a great question. So I'm really excited about our technology because I think we approach the problem first from a security standpoint and from meeting the requirements of the organization and then, you know, broadening our capabilities to become more of a collaboration platform as opposed to a one to one communications platform. And I think that others have come from the standpoint of ease of use and a more consumer feel. And I think it's actually harder to come from that perspective, as we've seen with Zoom, and try and layer in the security.

Kathleen (29:08):

Yeah. Now other than KoolSpan, company or individual, who do you think is doing really interesting and cutting edge work in this area?

Nigel (29:21):

Other than KoolSpan, who is doing really interesting and cutting edge work in this area?

Kathleen (29:24):

It could be an individual person or a company.

Nigel (29:28):

I think that Harold Smith at Monkton is doing really interesting work in this area in terms of, he's got a really good understanding of the security requirements, particularly from the perspective of the Department of Defense, but then also just kind of a leading edge, innovative perspective on how to rapidly develop mobile applications and get them into the hands of users as quickly as possible. And he's been working a long time, you know, kind of building this capability and I think right now we're really seeing that that combination, his pretty unique combination of understanding how to navigate through the building and the Department of Defense, but then also be a really innovative and scrappy mobile app developer is just a great combination.

Kathleen (30:20):

Alright, so Harold Smith?

Nigel (30:23):

Harold Smith at Monkton, yes. That's the one to watch.

Kathleen (30:24):

I'll put a link to information about him in the show notes.

Nigel (30:29):

Absolutely, and someone that's worth talking to by the way.

Kathleen (30:31):

Yeah, definitely. We'll have to try and get him on. Harold, we're coming for ya. Well, thank you so much for joining me this week, Nigel. This has been really interesting to learn about this and what a fascinating but sort of hairy problem to try and solve.

Nigel (30:46):

Challenging times but exciting and really looking forward to being part of the solution here.

Kathleen (30:52):

Great. Well, if you're listening and you enjoyed this episode, please consider leaving the podcast a review on Apple Podcasts or wherever you choose to listen. We want to hear from you, and if you have an idea for a future episode, tweet us @Attilasecurity and maybe whoever you suggest will be the next guest. In the meantime, thank you so much, Nigel. It was fun talking with you.

Nigel (31:13):

Thank you. It was a pleasure speaking with you as well.

With State-sponsored cyber attacks on the rise, how can we protect the world's most critical infrastructure, and the industrial facilities that underpin national economies?

On this week's episode of The Secure Communications Podcast, guest Robert Lee talks about solving the industrial controls security challenge.

Robert Lee is a pioneer in the field of industrial controls security.

From his roots in the Air Force and the National Security Agency, where he carried out some of the earliest cyber intelligence missions aimed at preventing State-sponsored attacks on critical infrastructure and industrial sites, Robert went on to found Dragos, an industrial cybersecurity company that focuses on operations technology for industrial control systems.

The organizations that rely on industrial controls span a wide variety of industries, from data centers, to utilities, manufacturing, transportation, real estate and more.

In this episode, Robert shares his insights on the magnitude of the industrial controls security problem, the impediments standing in the way of a solution, and what he sees as the way forward in a world where cyber attacks continue to increase in frequency and sophistication. 

Kathleen (00:05):

Thank you for joining today's episode of The Secure Communications Podcast. I'm your host Kathleen Booth. And today my guest is Robert Lee, who is the CEO and founder of Dragos. Welcome Robert.

Robert (00:17):

Thanks for having me.

Kathleen (00:18):

Yeah, I'm really excited to have you here. I've been following Dragos for a while and following what you've been doing. I nerded out and read a few books that you were mentioned in so we can get to that. But before we get into the topic at hand today, for those who might be listening and maybe aren't as familiar with the company or with you, could you give some background on what Dragos does and also your story, how you wound up founding the company and how you got to where you are today.

Robert (00:48):

Yeah, sure. So Dragos is an industrial cybersecurity company, so that means we focus specifically on operations technology for industrial control systems. Those that would be found in anything from data centers, the electric infrastructure, oil and gas manufacturing, things like that. Specifically we're a technology company, but it is my core belief that the best technologies are made by the best people. So we also have a services team that's always going to go get good insights and expertise so that's back to the product. And then we also have an Intel team that can track the adversaries and keep our customers up to date. As for myself, I started out on the Air Force side of the house for a couple of years. I was there. Most of my time was spent over at the National Security Agency.

Robert (01:34):

I was kinda like loaned out to them and passed off to them doing various cyber and intelligence missions. The one that got me most interested, and I sort of was already interested in industrial control systems. I'm not an engineer by trade at all. But I spent time in Cameroon dealing with wind turbines and water filtration systems and similar, and I was always kind of enamored by control systems. And so I ended up building out a mission there and looking at various States breaking into ICS or in these industrial sites, which little known to me was not being done at the time. So it was kind of a first of its kind mission set. And what I kind of took away from that was really questions about visibility and collection requirements and telephones analysis on broader topics. And it just, it was all very, very exciting. But also kind of resonated with me on a personal level as you think about military and why you joined that.

Robert (02:25):

A lot of folks join on this belief of service before self and trying to serve your communities. And what I found with this topic of industrial systems was there was nothing more offensive to me. I mean, nothing that's sort of hurting more of a community than people going after civilian infrastructure. You know, like the lowest of the lowest kind of discussion there. So I ended up dedicating my career to it. I got out of the military when they put me on the offensive side of the house. And I wasn't a really huge fan of that. I think everybody should stay out of everybody's civilian infrastructure. And then I ended up founding Dragos. And as much as I would love to just centralize talent and similar, I think the way that you make these problems scalable is technology. So it's gotta be a combination of people, process, technology. So that's where we are today.

Kathleen (03:15):

I love your story and it really resonates personally with me because funny enough, way back in my professional history, I spent the first 10 or so years of my career doing something totally different. I used to do work in international development consulting and I specialized in public private partnerships for the management of water and wastewater utilities in the developing world. So I went to 54 countries, lots of countries in Africa. Basically by definition any place where the water was dirty is where I would go. And I spent a lot of time touring those facilities and I spent a little bit of time in some other utility areas as well, but my heart was really in water. And so, I totally agree with you, especially, you know, here in the US we're very fortunate that we have 24/7, in almost every place, 24/7 access to clean water.

Kathleen (04:06):

But so much of the world that is not the case. They might have a few hours a day, they might not have it at all. You know, and you're talking about people's basic health and their ability to lead their lives. I could go on and on. I mean, it affects everything from like, one of the reasons a lot of girls don't go to school throughout some of the developing world is it's their job to get the water for their family so they can't get an education. So the, the ripple effect of not having access to basic infrastructure and services is tremendous. Obviously, the canvas of that across the world is different, you know, in the US versus some of these countries.

Robert (04:42):

I think you're spot on though. And then, and then the audacity of somebody to come along and make that harder through their actions, you know, like to be an adversary and create capabilities. I mean I just, yeah, the, the point about a young girl not being able to go to school I think is very poignant. And, then again, you have somebody on top of that that's just complicating things like just, I don't know, it's a level of asshole nature that I'm happy to not have to deal with in life.

Kathleen (05:16):

There's a special place in hell for people who take advantage of those things. So when it comes to, I guess I want to start by by asking you one question, because when we first spoke, you mentioned something that I thought was interesting where you said, I take issue with the fact that people lump industrial control security and with IOT. So can we start there and can you explain like what is, what is it about ICS that makes it its own category?

Robert (05:41):

Absolutely. This probably seems uber pedantic to like argue about lexicon, words and definitions, but I think it's really important and I think if we're going to have a professional practice, we're gonna have people that are dedicating their careers to learning and being professionals, then words meaning and matter. Very important. And what IOT is on one hand, as you deal with organizations that have security cameras and IOT type devices like Alexa, you know, they are definitely challenges worth looking into and I think they have their own place. And right. What I've seen is that IOT gets broadly applied to operations technology or ICS, not because of an understanding of IOT specific drivers and requirements, but as a catch all of, well, I don't understand that stuff in the plant. So it's just all IOT.

Robert (06:37):

So it's not only inaccurate but sometimes even if, not maliciously intended, it comes off as very dismissive when in reality that water plant, that manufacturing side of the house, the gas turbine, like that's why your business is there. Like that's generating revenue for that company and also doing the service, the community. But, to go, without being pedantic about it, to go one step further, operations technology deals with physics and it deals with the world around us. And so the way that I want to deal with that is going to be different. And to say it very cleanly, the mission in industrial is different. The threats we face are different. The systems and the communications are different, the risks are different. Therefore, the strategy and the way that we approach it needs to be different. And I think a lot of people go, well, they're just embedded systems sometimes. Or maybe it's just windows software anyways.

Robert (07:25):

And that misses the whole point. It's the mission and the risk to them and what you have to actually deal with them. And I've joked before, but somewhat seriously that, but the moment we compare Alexa to a gas turbine, we're all gonna die. You know, like we do need to keep those things a little bit differentiated and protect them differently. So to me, operations technology is, if anything, a broader category as it relates to the systems, computers and parts and similar around the world that are dealing with physics and the mission and yeah, it needs to be treated differently.

Kathleen (07:59):

So this obviously is an incredibly, it's an area of incredible strategic importance for, you know, for individuals in their daily lives, but all the way up to nation states. You know, when you think about electric power grids and, and you mentioned natural gas and water, this goes right to the heart of the issue of national security. Given the strategic importance of operations technology and industrial controls, why is this not something that has already been solved? What is it about it that makes it so difficult to solve?

Robert (08:33):

Oh man, that's a good question. So I think it's a lot of things. So one part is the education of the topic of what is the real risk? Is this worth investing in? Do we have a problem? And I think when we look at the industrial security community, you know, even dating back to 1998 when it was like PDD 63 from president Clinton saying, cyber attacks can happen on electric infrastructure and we should think about this. That was, you know, well over 20 years now that we're talking about cybersecurity with relation to industrial, but I don't know that a lot of folks had the visibility, in fact they didn't have a lot of visibility or insight into what was happening in the operations technology environments. We'd hear about breaches at like Dow chemical or others and like the APT one case is a really good example.

Robert (09:23):

No one had ever talked about, well, was there anything on the ICS side? Was it anything in the operations networks? It was always, its data loss at the company. So hyper focused on enterprise security. So to just shorten the answer, I would say the first problem we've had is getting visibility on the problem and having the right people, process and technology to get into those networks to even see the problem first. It has been a long struggle actually I would say probably until 2014 and 2015 it wasn't even really feasible at scale and that's just when like the market started picking up on the technology side. On the second challenge is I think there's also been a longstanding debate of who owns the problem. Should governments protect companies against state actors or are the companies on their own? And honestly, the narrative gets spun and it's confusing. I've seen many government representatives saying onstage, when you have an attack, call me, we're here for you.

Robert (10:19):

Hey, we will provide you intel. We will provide incident response. We will do this for you. But what the government means as an attack is not the same thing that private sector usually means as an attack. They mean, Hey, when the lights go out across the Eastern interconnect, we're probably going to war. Let us know. We'd like visibility but not, Hey, you're broken into and your property was stolen off the manufacturing lines. You know, even so government, they have a lot of good roles and responsibilities, but they've equally struggled with the cybersecurity issue, talent, people, tech innovation, everything. And what happened long ago was government, right, wrong or indifferent, doesn't matter. You're not talking about intent here. But they abdicated the responsibility on this domain and the private sector picked it up and ran with it. Independent companies, product, services, et cetera, doing a lot of amazing work so they can't really force themselves back in now.

Robert (11:14):

And that's where some of that conversation comes and it goes back to what you mentioned, which it has to be a partnership. We have to take, especially when you look at the United States. I think this is for everybody, most countries, but we have an amazing private sector that's just overflowing with expertise and talent you can't find anywhere else in the world. And the same time you have a government, when it focuses, can be an extremely powerful tool. We shouldn't be doing the who's on first, who's on second. It should be what's the roles and responsibilities and how do we work and play together. And some countries are nailing that. When you look at the work in Australia, when you look at the work in the UK, and there's Norway. When you look around the world, some of the, some of these countries are really nailing the let's play with a full hand by picking the best out of every section that we have versus the debates that sometimes we get a little locked into here in the United States about who owns this.

Robert (12:10):

And then lastly, I know it was a very long answer but lastly I think after the, you know, what's the problem? Who owns this? Then it's how do you actually put a strategy together? And I see a lot of companies making choices around services or products or training or similar without a real strategy. And there's a desire by a number of executives to have a single pane of glass with a single governance strategy. And if ICS is different and our threats are different, and everything else, then your cybersecurity strategy for ICS needs to be different as well. And you can't just have the same patch program or vulnerability management program that you're trying to run on the IT side with one set of values on the operations side, which has different challenges and also may not be that valuable.

Kathleen (12:51):

So how big is the problem? Because I think for a lot of people maybe who aren't really embedded in that world that it could be easy to think that in the US because we're a pretty advanced country that we don't have a huge attack surface or the problem isn't enormous. How big is it really? Yeah,

Robert (13:10):

And this is, this is a good one as well. This is where like the nuance always gets argued. The problem is huge and we're also okay, and like that's the piece that's always confusing to folks. Like you said, the threats real bad. I'm like, they're real bad, but we don't have to worry about the lights going out anytime soon. You know, like there's a, there's like what, it's almost like conflicting messages and the narrative is, our infrastructure providers have done amazing work and they've made safe and reliable systems even when they weren't doing it for security. So there's an inherent security value in the way that a lot of our systems are just resilient and we have really good infrastructure and our companies have paid attention to that over the years. However, the threats we do face are getting more numerous and far more aggressive and our landscape is changing. You know, the, the different buzzwords get thrown out.

Robert (14:00):

Digital transformation. Industry 4.0, or whatever you wanna call it. But we are getting to a homogenous and hyperconnected world, even on the industrial side. And that changes the attack surface. So that landscape change with the changing threat landscape and the progressive and numerous aspects relates to a position that regardless of all the good work done before we have gaps. And we have real gaps, especially on the cybersecurity component of operations. And so our infrastructure is actually pretty awesome. We shouldn't have people freaking out or building bunkers or you know, read the Ted Coppell book and you know, freaking out. But, at the same time, asset owners and operators or infrastructure providers have gotta do a lot more, not because they suck, but because things suck around them.

Kathleen (14:44):

One of the things I thought was really fascinating was, I mentioned when we started that I read book where you were mentioned and that was the book Sandworm which I thought was a fascinating read. And the thing that stood out to me from reading that was when it talked about the power grid in Ukraine being brought down, it talked about how because that grid was not as modern as ours, they still literally had like a lever that they could pull and turn it back on again at certain points, you know, because there were still very manual processes involved. Whereas here in the US as you mentioned with digital transformation, we're, you know, it's almost like we've become, we can become a victim of our own innovation in the sense that it is all software. There isn't a lever we can pull like there might be in a place like that. Could you talk about that a little bit?

Robert (15:41):

Sure. So the Ukrainians didn't have as much automation. They do, but it wasn't, it was later in their sort of journey. I think it was like last 10 years that they really went to much more automation. And you're spot on with the fact that they were able to go back to manual operations in a much better, coordinated way than we would be able to do. So we do have manual operations. We can go back to manual operations and we do this for like hurricane season in similar and different parts for electric infrastructure. You go out to the switch yard and you're literally throwing switches and connecting power to customers. And that can happen but the workforce that we have is not well trained at sustaining that at scale like the Ukrainians who still have that expertise. And the makeup of our electrical infrastructure is different enough that the scale of the problem is much larger for us.

Robert (16:37):

Where a line, you know, a lineman in Ukraine could probably cover six or seven substations. For us, it wouldn't, you know, two or three in that kind of scenario. Not every utility is going to be different on those numbers, but the scale is much worse. And if that experience is leaving our workforce and we are relying a lot more on automation. So I think the natural thing, and I've seen some well-informed Congressman and similar come out and go, well we should go back to manual operations. No, you don't want to go back in time, but we want to understand what we're doing and design compensating controls around it. We want to get the value of automation. We want to get the value of digital transformation. But we want to offset the risk with cybersecurity but not cybersecurity that's applied from a framework or a checklist, check the box, but to specifically and uniquely understand that industrial environment and what we are trying to offset with the changes that environment has seen.

Robert (17:31):

And I think that's also what makes industrial security pretty difficult. And this is, this is going to come off, I'm going to come off very dismissive now folks when I say this and it's not intended to be, but because of the progress of education and training, and because of the advancement in technology and process, you can be an entry level security person and do a lot of good in the company. And we sort of have this base foundation that a decent security person can be really impactful and everybody can make really wonderful chains and you can do an eight to five kind of job and not have to have your life be dominated by InfoSec. Although many of us do. You don't have to do that. You can have the balance. In ICS security, we don't really have that level of foundation. There's a lot of things to figure out.

Robert (18:22):

There's a lot of nuance to it. Also there really isn't -- we say ICS or OT security, but that's almost a made up term as well just to say not IT. The difference in distribution electric power is way different than upstream, you know, oil and refinery oil work in the oil and gas industry or downstream refinery. So the, the reality, and again, not to be in any way harsh, is you can't just walk in and be contributing to ICS security with the security that you have. Many of them can be dangerous in an operations environment or cause more harm. If I told you that you had a vulnerability and I didn't want you to patch it, that would seem like I was being a jerk. But patching the vulnerability on the operations side of the house may not reduce any risk whatsoever, and may introduce more than the way that you're going about it.

Robert (19:12):

Or maybe I find that I'm infected with something, but it's not having an operational impact and we're not losing anything. Maybe I decide to monitor it and keep it for three months until a down period or a maintenance period when I can go clean it up. So there's a lot of ambiguity at times and I think the necessity in ICS security right now is to demand much more senior folks. We want to change that, and I think there's a lot of work around the community to try to bring it down. And again, it's not like bring it down to be dismissive, but to make it more approachable and to have more, this is what right looks like, and here's playbooks for these things. And then in that way we can make it more approachable to the industry. I've seen new people do really well in this industry and really make a lot of change, but they also have really a high level of mentorship and wonderful folks around them, and that's awesome, but shouldn't be required to do a job.

Kathleen (20:05):

Yeah, it sounds like training and education is going to play a big part in how we're mobilized to address this going forward.

Robert (20:12):

Absolutely.

Kathleen (20:13):

So you mentioned earlier this push and pull between government and the private sector in terms of who owns the problem, how's it going to get solved? I want to talk about one specific aspect of that, which is the financial aspect. You know, how is it gonna get paid for? My understanding is that there's a lot of real kind of legacy equipment issues to deal with if we're really gonna address this. And there's a price tag attached to that. And I'm kind of now harkening back to my, to my prior career and remembering, you know, there, when you talk about utilities, these are regulated entities and tariffs, you know, the price we pay for utility services are regulated, whether it's the Federal Energy Regulatory Commission or what have you. I guess my question is how, how do we navigate that process of, of covering the price tag that's necessary to really fix the problem? And do you think there's really a two part question. One of them is would it get approved at the regulatory level? But the other is, would consumers have an appetite to pay for it? Because ultimately I'm assuming that would be passed down to the end customer in the form of their fee that they're paying.

Robert (21:24):

Absolutely. Yeah. It's got to come from somewhere and I think it will ultimately come from the consumer one way or the other. Taxes or otherwise. But I think anybody living in a town that has a chemical plant or has a water filtration system or electric power or whatever, has general expectations and those expectations have to be met. So I'm usually a big advocate of what the companies themselves and, because I see a lot of good work they're doing and, and like an electric utility, even if there's not money in it, we'll go do the right thing just because they want to have safe and affordable power that we need to live and work in the communities that they serve. But if I stepped back from that for a second and go, what does the answer have to be, it is a combination of regulation and incentives.

Robert (22:09):

Right now, some industries are over regulated and the electric sector is one of those industries that has more regulation than I think probably actually makes sense. But instead of arguing that, I usually say, well, the regulation has put us into a good place. So now let's look at incentives instead of just regulation. It can't always be the stick, but some industries have to have some regulation. Look at gas pipeline industries. For the ability of the natural gas community, the natural gas pipeline community to impact national security and those electric abilities is significant and there are very clear gaps. But I don't think it should be a regulation for security. That just doesn't work. And so there's always a nuance of how do you do it. In My opinion on some of these topics like with natural gas, tell the community what you want because you can, if you're an executive of these companies, everybody we talked to, there's a different opinion about how you see the business and different government agencies have different views on it.

Robert (23:09):

So you hear from DOD, FBI, DHS, DOE, and you get four different answers. And so in my view there should be a, we expect if you're a natural gas pipeline operator in this country to be able to do these things and usually it's performance based. A lot of regulations have been very prescriptive. You will have, you will have patching, but it should be much more performance. So while I'd like to know that if we found the threat and we informed you about it, that you'd be able to answer whether or not you'd have that threat in your environment within a two hour window. Or if you had an incident, I would expect that you were able to have, regardless if you outsource or not, however you deal with it, be able to have a recovery plan and to get you back up and running within a 48 hour window

Kathleen (23:50):

Basically like an SLA.

Robert (23:52):

Yep.

Robert (23:52):

We should basically have SLAs around things like safety as well. Which the safety community has done a pretty good job of actually. And then that kind of performance of here's what we think right looks like to be an infrastructure provider. And to live and work in those communities. I think those would be much more palatable as well for companies and saying, these are what you got to sign up for however you do it is up to you, but we're going to hold you accountable for this is as a combination of regulation. And then if you exceed these things or you do these things that we're not gonna regulate you against, but we really would like to see you up in this top quadrant, and whatever we want to hold companies sort of accountable for, here's the incentives to make it happen. Good example. I've been along, I've been a big proponent of education and training incentives, where a SANS class, so SANS in my opinion, is by far the best training in the world for cybersecurity skills, especially as it relates to things like digital forensics and incident response and pen testing and those kinds of things.

Robert (24:45):

But there's a lot of wonderful classes out there. If we want to talk about rinse and repeatability, like any individual class would be much better than any given SANS class, but SANS can do it at scale like nobody has ever been able to do. And they can train an entire workforce. And so when I think about like an ICS SANS class, your SANS classes are six, 7,000 bucks a pop, and that's five days, and they shouldn't be your entire curriculum. It should be the year I'm gonna sharpen certain skills or get you going. If an electric utility is doing things for Cisco training to take better advantage of networking skills that they're benefiting from business standpoint, I think that's on them. If the state is saying we're not going to protect you against threats from other foreign States, then we should like, the incident response skills that they want to go pay a $7,000 class for whatever. It, it shouldn't be on them.

Robert (25:36):

And so I think it's completely appropriate then for us to say, well, it should be on you. I do think it has to be on you. It's the only way it works. But you know what? We're going to do tax credits, that if your a, if you're investing up to this level and security skills to relate to these challenges that we from a national security perspective think are interesting, these classes qualify for a tax credit so that you can actually train your workforce and then you get workforce development. And some of the things like that in terms of a combination of regulation and incentives has to be the answer. And so far we have much more regulation than we have incentives.

Kathleen (26:16):

That's interesting. So you know, when you think about the challenges that we're currently experiencing and then you think about all the innovation that's happening, what do you see as the biggest challenge we're gonna face in the next few years looking forward?

Robert (26:32):

Yeah, there are a lot of, and I'm going to scope it specifically to operations technology and whatnot. But there are a lot of companies making a lot of investments right now and they're going to need to get wins. And winning is a lot about how you measure things. And what we don't want to do and what I'm hopeful won't happen if done correctly is that people do things, or I'm hopeful that people don't do things, think that they're not worth doing and don't do them again. And so good example is there's a couple of approaches to ICS security that I just vehemently disagree with and I'm okay with that. I like that there's different opinions and I'm hopeful that we can all like, no person should be able to dictate these things. But why I vehemently disagree with them is, I don't think they're going to result in anything positive. And I worry about some of the massive companies that are doing those approaches and if their strategy isn't validated or invalidated, you know, kind of where does the business stand and, and there is the, there are some companies that essentially bury their head in the sand and if they don't have a major breach or something to be able to know it, they never really know the risk that they're taking for their community or they did something, they know the risk, they took an approach.

Robert (27:46):

It was a very extensive approach. It resulted in no value. So they go, well this problem is just too hard to solve anyways. And so I think about those kinds of extremes a lot. And, and I think that as we go forward, there's going to be this driver to do the easy answer and we as a community have to dig deeper. It goes back actually to kind of like the IOT comment. I meet with a lot of executives these days and brief a lot of boards, which is odd for me in a lot of ways. It's like why are you having me brief the board? But yeah, sure. And so I think the last two years I've probably been in front of 20 or so boards of some of the most significant companies on the planet. And they kind of all fall into either the believers and the nonbelievers.

Robert (28:28):

And actually there's not so much opposition from the board. The board gets it all. I was surprised. I thought the board would be kind of the harder one. The boards get it. Oh yeah. All the businesses on that side of the house. What are we doing to protect it? But it's commonly at the CISOs office that I'll see either the, we need to take a unique approach and do this and we need to, we need to dig deep and think about what we're doing and why we're doing or at all are. And can you just import it all into one pane of glass and have one strategy and we'll GRC it to death. And what we've done. And, and again, I, I worry about the, the easy answer of, let's call it IOT. Let's pretend that a big major company is going to handle it for us or is going to handle, there's a silver bullet.

Robert (29:09):

It's like the silver bullet aspect of this of, either they've got it or they've got it, or we're going to have this framework and we're done, or we're going to follow NERC CIP with electric guidance and we're done, and it doesn't work. And I hope that we see an upwinds elsewhere in the community to balance against that. And I think we are, we're starting to, which is good, but it's also going to mandate that people are talking about it. And our community, especially in industrial is one that we don't really talk about things a lot publicly, and we're very quick to be able to be critical of something, but if something's working, we don't want to sort of reveal what we're doing for security and we worry about the offensive-defensive aspect of that. And we've got to build the community more than we build our companies.

Kathleen (29:52):

That makes sense. So speaking of the community, Dragos is obviously doing a lot of really great work in ICS security. Are there any new technologies that you're really excited about?

Robert (30:04):

At Dragos or like outside of us and for like ICS security related and stuff?

Kathleen (30:10):

Anywhere.

Robert (30:10):

So not ICS security related?

Kathleen (30:10):

No, ICS specifically.

Robert (30:13):

So I, I think yeah, there's, there's quite a bit that's happening in ICS security, one of which isn't necessarily technology, although I think technology is enabling some of it, but like rings access and similar. You know, if we want to get people really understanding industrial it can't just be academic. It really is important to get hands on equipment and see the physics of it. Oh that valve opens and closes and these things happen. And so we're starting to see a lot more from universities as well as some companies and government is doing it well to get access to ranges out to people. We try to play our part in that as well, where people can get hands on with the industrial world around them. So when you say industrial, you think electric utilities, oil and gas, maybe manufacturing. Then you realize like, no, it's rail and this data centers and it's, it's literally everything outside of like financial services and even they have building automation. Know it's, it's, it's, it's kind of interesting.

Robert (31:03):

So I think that's really exciting. I also think it's really exciting what we're seeing kind of in the supply chain discussions. There are different ways to take the supply chain challenge and there's different things. We mean when we say supply chain. Do we mean interconnection with the vendors? Do we mean the actual products itself, hardware, software, R and D, whatever. But there's companies that are making products along validation of firmware and understanding like what's getting loaded on our systems. And it is, is it what we expected? There's companies that are doing really cool things with helping the vendors themselves take accountability for their bill of goods and bill of materials and Hey, can we more accurately understand the software and supply chains that we're using at like a GE as an example. There's some that are working on even like software development life cycle work. And so there's a lot of different elements coming at this that I think are pretty exciting. We kinda got the segmentation thing good. We know how to do segmentation and industrial companies like mine are all around like asset identification and threat detection, and responding to attacks. And I think if after you take the, we can watch it once it's there, your questions are well what happens before I got there and what happens sort of over time as things change and those are kind of the areas I'm seeing some, some pretty cool things.

Kathleen (32:15):

Got it. Now outside of yourself and the team at Dragos, is there a particular person that you think is doing really interesting work in this area?

Robert (32:23):

In industrial there are a lot of them. So I'm always a huge fan of just anybody that's trying to take more of an educational based approach. And like I said, there's a, there's a bunch of them out there. I think that you have your folks, it's funny, I keep thinking of names like, no, we hired that person, no. I sound really arrogant, but like we try to really hard to pull a bunch of talent together. But there's, I think a lot about the folks that don't have profiles. And so yeah, I think a lot about like the, the Mark and Brent at Salt River Project. I think of, you know, Jason and Mason at Oklahoma gas and electric. I think of, two of them like repping their shirt today just cause it's comfortable. I think about, you know, the Kevin's and Jason's in Southern California Edison, the Curlys at Southern company, like, you know, Glenn Ibel at BSF. Like I think about all these practitioners and leaders inside these companies that don't get celebrated, that don't get the podcast interviews that similar, but they're doing all of the mission.

Robert (33:25):

And so like you talked about like the Sandworm book. I have not read it. I refuse to read it. I, Andy is awesome. I'm sure it's an amazing book. It is so awkward. Like he messaged me and was like, yeah, you're in the book. And I'm like, Oh cool, can I check the quote or whatever. And he was like, Oh, you're a main character and I'm like, what?

Robert (33:44):

And like I find that I can't read about myself like that. Just also as a, as a technology provider, like we're the digital janitors, you know, like we're the service providers. Here's the mission or the mission. And so you asked about like who's educating and who's doing like the really hard work. I honestly think it's most of the people that are actually at these companies that never get celebrated. There are other people out there. I'm Chris [last name] is a long time friend of mine. He's over there at Fireye doing amazing things to educate the community, you know, that that type of behavior exists in a lot of places. But the ones I, I sort of adore the most are the ones that are with those companies,

Kathleen (34:18):

That's great. Well there's no reason we can't have an operator on the podcast. So yeah, no, I always love, I always love hearing the names that are mentioned cause you never know, those could be the next people we interview. So that's a great list

Robert (34:34):

It's a good list of people.

Kathleen (34:36):

This has been fantastic. Thank you so much for joining me this week, Robert.

Robert (34:40):

Yeah, of course. Absolutely. I'd probably just end in saying like, you know, your, your company does a lot of interesting things. And so for whatever positioning you could do for folks listening in and part of that supply chain challenges, is that connected to the issue and how do you actually connect to these sites and how do you do it correctly? And kind of in this random COVID time and all the things that people are dealing with, I would highly encourage people to be looking at those remote connections and specifically how they're thinking about securing because all of the adversaries that we are tracking are happily taking advantage of the moment. So thanks for your time. Thank you for having me on and good luck there when listening.

Kathleen (35:18):

Yeah, and I certainly appreciate the plug and the shout out for Attila. If you're listening and you enjoyed this episode, please consider leaving the podcast a review on Apple podcasts or wherever you choose to listen. And we want to hear from you. If you have an idea for a future episode or a guest, tweet us @AttilaSecurity. That's it for this week. Thanks so much.

Stonemill Ventures Founder Michael Sutton knows a thing or two about secure communications. As the former CISO of ZScaler and now an angel investor, he's been involved in multiple companies doing cutting edge work in cybersecurity.

In this episode of The Secure Communications Podcast, he talks about the concept of "zero trust" and how it is designed to solve the challenge of user risk. 

Never has this topic been more relevant than now. With the Coronavirus driving organizations to send their employees to work from home en masse, securing teleworker access to corporate networks is critical. 

Traditionally, the work from home security challenge was solved by installing VPNs, but in today's world, the organization no longer has control over where its employees are working, how they're connecting, or what devices they are using.

Zero Trust was developed in response to just this challenge. 

Listen to the episode, or read the full transcript below, to hear Michael's insights on Zero Trust.

Kathleen (00:01):

Thank you for joining today's episode of the Secure Communications Podcast. I'm your host Kathleen Booth and today my guest is Michael Sutton, who is the founder of StoneMill Ventures. Welcome, Michael.

Michael (00:39):

Thanks for having me, Kathleen. I appreciate it.

Kathleen (00:41):

I'm looking forward to talking with you. Before we dig into our topic today, can you share with my listeners a little bit about yourself, about StoneMill Ventures, and your background and how you came to be doing what you're doing today?

Michael (00:54):

Yeah, for sure. So I've been in security pretty much my entire career. I spent the majority of my career in startups as an operator in IT startups in the security space. Typically I was the guy who would build the research teams and the last role that I had in that world was with Zscaler. I was one of the original employees. Zscaler stayed there for a decade. Ultimately I became the CISO of the company and got into investing later during that time and just really fell in love with angel investing. I've always loved building things and that's why I was in the startup world. And then as I became an investor, I loved the fact that I was doing that, but doing that with multiple companies and amazing founders who were pouring their all into these great new startups. And I kind of decided that that was the path that I wanted to go down. So when ZScaler went public, that opened the door for me to step down and do investing on a full time basis. And so that's what I do now. I do full time investing and pretty much exclusively focused on cybersecurity.

Kathleen (02:04):

Boy, as a side note, I can really relate to that because I owned a business for 11 years and when I decided to get out of that game, I had a lot of different options and with where I was in my career, I think a lot of my peers tended to gravitate towards larger companies. And as somebody who's owned a business, I love growing and building things. And so I too had that kind of affinity to startups. It's a very particular world and it's not for everyone, but I think if you've got that entrepreneurial bone, it's a pretty good way to address that need in your life.

Michael (02:39):

Yeah, totally agree. And I always say being an investor is like being the uncle as opposed to the parent where I get to have all the fun and work with these founders and get to work on the ideas. But then when things get really tough, I can go over and help another one and hand the baby back to them. So, it's kind of the best of both worlds.

Kathleen (02:59):

That is awesome. Less stress. I love that analogy. Well one of the reasons I was really excited to talk to you is that on this podcast we look at all things relating to secure communications, which admittedly is a pretty big umbrella. And one of the topics that has come up again and again is this notion that at the end of the day you can have an amazing security architecture, but your end user is still in many cases your greatest risk. And that has really led to the advent of this movement towards zero trust. I know you've got some thoughts on that. You've been looking into it, you deal with a lot of different companies that are playing in and around that space. And so I'd love to just start out by getting your thoughts on the advent of zero trust and why you think that the time is now for it.

Michael (03:58):

Yeah. So I think it's especially pertinent now given that we're all working from home and we can dig into that deeper as we go. But you know, working remotely and having technologies to do so is not new. We've been doing that for a few decades now. But historically the way we would do that was using VPN technology, virtual private networking technology. And now we're starting to see new technologies like SDP, software defined perimeter, and we can get into kind of the differences between those. But the concept of zero trust encompasses a few things, but obviously the connectivity pieces is core to that. And so you need a technology to be able to do that. Now, the term probably originated about a decade ago. I know Forrester, John Kindervag at Forrester was pushing this probably back in 2010 and he's probably the guy who first coined that. Google has been talking about zero trust, although they typically talk about it under the moniker of their beyond corp initiative.

Michael (05:05):

So they've kind of been doing internal business that way for a long time. And really, the philosophy is that we're changing a paradigm on how we connect remotely. Whereas we used to have this philosophy of we just build an impenetrable fortress, all of the assets are in the castle and we have the impenetrable moat around it, and we decide if you should gain access and once you gain access, you're good. Now that worked when we were in a world where the corporation controlled all of the assets and they all sat in one place. But obviously the world has changed dramatically. And that's not the case. You know, typically, I'm working remotely. I am on a personal device. I am using a cloud based resource. So the enterprise no longer controls the device. They no longer control the network, they no longer control the data.

Michael (06:02):

So zero trust kind of shifts the focus from saying, Hey, we'll make sure you're a good person and then we'll let you into the fortress to, we're just not going to trust anybody. We don't care where you're sitting. You could literally be at your desk on the corporate laptop. I'm not going to treat you any differently than the sales guy who's sitting at the airport on his iPad. I'm just going to assume that everybody's untrusted and I'm going to authenticate you in real time specifically for that task that you're trying to complete. And once that's done, it's done. And then we'll worry about the next request when the next request comes. And so it's a very different philosophy on how we handle remote connectivity.

Kathleen (06:45):

It's interesting to me because I think one of the guests I just spoke with in a previous episode, that episode was all about the human factor and why it's been so difficult to solve because that's not a new issue. You know, you have your end users and you can build these amazing technologies to protect the corporate network. You can put in place great security solutions, but you still have people on there. They're unpredictable behaviors and they're doing the things that are easiest and most comfortable for them whether or not they make the most sense from a security standpoint. So it's interesting to have this conversation on the heels of that because I feel like that is sort of where we've come to is that even with well-meaning end users, there are still behaviors that they will engage in that with the best of intent put the corporate network at risk. So, what is the implication of zero trust not being solved? What do we stand to risk if we can't put an architecture like that in place?

Michael (07:56):

Yeah. So, you know, the world is changing and so we have to adapt with it. And if we don't, it's really gonna impact not only security but our productivity. Like if I say, you know, let's be really archaic and say you can only work in the office and you can only work on the corporate issued laptop or desktop, well right now your company would be shut down because that is not an option. So that's a bit of an extreme example, but I think it illustrates where we're headed. And I think it's also important to know, you know? Often I'll get asked like, Hey, what are zero trust technologies? Zero trust is not a thing. It's not a technology. It's really a philosophy. It's what we talked about earlier where it's just changing the paradigm on how we do security, how we decide who is allowed to do what and when.

Michael (08:45):

So it's really a combination. It is a collection of technologies. Everything that is used to handle that authentication, that connectivity, figure out the risks associated with it. So it's actually multiple technologies. And it's a change in the philosophy and we're doing security at a separate layer whereas we used to do security at the network layer, what I was talking about before, like, Hey, we'll decide if you need to get in and we'll give you that open pipe to do whatever you need. And now we're really doing security at an application layer where we're doing it specifically for whatever task you are trying to achieve at that time. So again, zero trust is not a thing you know? It's really an approach. It's a philosophy on how we do security and it's just, it better fits where the workforce is headed and gives us much more flexibility and ultimately hopefully more security as well.

Kathleen (09:44):

Now when you look at the landscape of organizations, and organizations being a really broad term, encompassing private enterprise, government, you know, nonprofits, educational institutions, you name it, when you look at the world of organizations and then you think about the varying degrees of zero trust implementation from zero, I haven't done anything with it to 10, perfect world, I've got it completely on lockdown. Where are we right now? Sure.

Michael (10:15):

Well, I think we've just gotten a shot of adrenaline, and that may be a silver lining of this pandemic that it's forcing us to kind of accelerate some of our thinking and how we do things. But you know, where we're at, different companies, so as I mentioned earlier, like Google was talking about this publicly back in 2010 where, and they weren't selling products related to it. They were talking about, Hey look, this is where we think the world is headed. And so we're internally building tools and technologies to allow us to do this. So they were certainly ahead of the curve. I think on the other side, more conservative organizations like especially federal government, Intel organizations, things like that, they're moving more slowly, more cautiously toward that. And those that simply aren't able to put a lot of money into innovative technologies like not-for-profits, they might not be doing it as much.

Michael (11:13):

But you know, a couple of things there. One, it's no longer a costly venture. As we move toward more SaaS based services, cloud based services, you know, that's one of the beauties of technologies like that you don't have to build and buy and maintain and set up and infrastructure, you know, you can literally rent that infrastructure. So some of these cutting edge technologies are accessible to everybody in a way that they never were before. And then back to my earlier comment that this fact that we've suddenly had to go from maybe a handful of remote employees to all remote employees, is really forcing to rethink things and say, okay, from a couple of perspectives, I think companies, number one, they just have no choice. It's either shut the doors or figure out a way to handle remote work and zero trust is a platform which enables them to get there.

Michael (12:09):

You know too, I think when the dust settles, a lot of these companies and employees are going to revisit this and say, this wasn't such a bad way to work. Companies are going to say, I didn't have to pay for office space. Employees are going to say I didn't have to sit in the car and traffic for an hour every day. So we were always moving in this direction. We were always moving toward cloud and SaaS and mobile devices and personal devices and suddenly I see us getting the shot in the arm that's going to cause that trend to accelerate.

Kathleen (12:38):

Yeah. I'm already hearing those conversations. You know, it's really interesting, both on the employee side of, I don't know if I can go back to 40 hours a week commuting in and also on the corporate side of companies saying maybe we should renegotiate our leases. Maybe we should downsize our space or get rid of our space. So that is interesting. I liked that you mentioned costs because my question, following on what you were talking about, was going to be, what does zero trust do to the cost of a security solution. And you said it doesn't increase it, but it's interesting to me why that is. Because on the surface, when you think about introducing that added layer of like check and balance at every new, call it, action that an end user will take or every new entry point or every new task, it seems like it would seem as though that's adding layers of bureaucracy and security solution architecture design. Is it just that these products are now being developed so that it's so baked into the system that it doesn't introduce a lot of inefficiency and additional costs.

Michael (13:42):

So let me answer that from a big picture perspective. So I wouldn't suggest to someone that, Hey, you can just throw out everything you're doing and move to a completely different security paradigm and it's not going to be costly. It will be costly because you're going to have to fundamentally change a lot of what you're doing. Now if we go even a step above zero trust, Gartner is now talking about SASE. That's sort of their new buzz word and it stands for secure access service edge. And really what they're talking about is zero trust is a component of that. What they're talking about is, Hey, look, world is changing and so let's combine everything that we need to do to get there. And they're combining the security and the networking technologies under one umbrella, which makes sense because it's pretty hard to separate the two at this point.

Michael (14:32):

Everything's interwoven. And they're saying we're now delivering security and networking in cloud based solutions, whether it's infrastructure as a service or SaaS based solutions, things like that. And that encompasses a lot. Zero trust is one piece of it. But things like your SD WAN technology, your secure web gateway is all under that umbrella. So if you're going to do zero trust properly, it's not a small endeavor. It's not just well, okay, you used to do things the old way and just give people network level access and now flip a switch and we're going to do zero trust. No, you're going to fundamentally change your network architecture, your security architecture and your security philosophy overall. So, that is going to be a costly and lengthy journey and you're not going to just rip it out and start from scratch and do it overnight.

Michael (15:36):

It's probably going to take several years and you know, as certain technologies come up for renewal, you're going to start replacing it. Now, if you're a greenfield company, it's very different. I mean if you started a brand new company tomorrow and you just started hiring people, let's say you're a small company, you're less than 20 people. I mean that's just the way you would do it. You wouldn't set up an email server, you wouldn't set up file sharing, you wouldn't set up servers and clients. You would go and set up your G suite and sign up for some SaaS services and you would hit the ground running. So you would go down the zero trust path from the get go. So it sort of depends where you are as a company based on how challenging, timely, costly, this movement will be.

Kathleen (16:27):

So have you seen any companies right now that you think are kind of the standard bearers for how this should be implemented? I mean, you mentioned Google. I'm assuming that they've gotta be drinking their own champagne. I like that phrase better than eating their own dog food. But other than Google, are there any out there in the wild that come to mind that you think are really leading the pack with this?

Michael (16:51):

Sure. Going to my statement about how if you were starting a company now, prior to my time as an invester, I was at Zscaler for a decade and we really drank the Koolaid, the zero trust Koolaid, for good reason. That was a big part of our business that we were selling, but that was really core to our philosophy. We're very adamant that we were going to do everything in a SaaS based model. You know, everything was going to be single sign on. We weren't going to run servers. I still remember a conversation, you know, as the CISO focused on security technologies and I was looking at this technology from a well known, but I'll keep unnamed, vendor. And they said, Oh, you just have to install this component on your internal servers. I said, I can't, so what do you mean?

Michael (17:41):

Like it's, you know, it's just this little virtual thing you just decide. I said, I don't have any servers. And he looked at me like I was nuts. At the time we had two employees, so we weren't a small company, but that was core to our philosophy and although we were kind of bigger than most companies that would have been die hard on the whole zero trust philosophy. That was the reality. And I think that any company that starts running today, we'll follow that same path. I think technology companies, especially any technology company that's started within the last half dozen years, that's just a given that you're going to go down that path.

Kathleen (18:20):

And you know, obviously with this kind of a shift, you're moving from taking ownership of your security at the local level to really, I guess for lack of a better term, outsourcing that to the cloud providers. How confident can companies be that their cloud providers have this all on lockdown?

Michael (18:44):

Sure. You know, that's a question I'd say I get less now because we're more comfortable with it. But I used to get hammered with, well, since this is security, I can't outsource security. And to me, that's not really a decision right? There is one thing you can't, whether or not you're doing that in house or you're doing it in the cloud, you still can't outsource the responsibility.

Michael (19:13):

I would absolutely argue that for the vast majority of companies, if you hire the best security talent, you know, entice them because they were coming through this really cool growing company that was doing some really fascinating stuff. It's pretty hard to get good security talent when you're a widget factory. So I think the vast majority of companies would see far greater security when they move to cloud providers because that is their key focus.

Kathleen (20:15):

So now you mentioned before that zero trust is not a technology and I think you made a great point about that. It's a philosophy, it's a culture within the organization. Having said that, are there some technologies or providers that you're particularly excited about with regard to, you know, them doing really cutting edge work that's gonna feed into the ability to solve for zero trust?

Michael (20:40):

Yeah. So I think, you know, again, zero trust kind of has all these components. It's got an authentication component, an identity access management component, and a security component. But I think a key part of it is, for those remote employees, there's the connectivity piece and that's where we're seeing a shift in the way that external entities will connect to a system. Whereas historically, we would use VPN technologies, now we're moving to something called SDP, software defined perimeter. And really to kind of just summarize the differences between the two, VPN is a ,networking technology. So, ,the idea is I would connect to somebody at one time, ,authenticate them, make sure that, Hey, this is a trusted person, trusted device, but once they're in, they're in and then they can do whatever they need to on that network. Access whatever resources...

Kathleen (21:33):

Keys to the kingdom, right?

Michael (21:36):

Now it's not wide open. I would use access controls within the environment, but that's sort of a separate thing. I have to do a good job on that if I make a mistake. And you know, some of the big data breaches in the past have resulted from that. A really famous one is target where an HVAC vendor had the network connection or VPN connection and obviously it wasn't locked down and I mean, all they were supposed to do is check the HVAC systems, but the attacker was ultimately able to leverage that to get to the point of sale systems. So software defined perimeter, which is a zero trust technology takes a very different approach. It's not network level access, it's application level access. I'm not getting a connection at the beginning of the day and then keeping it open.

Michael (22:25):

I'm connecting as I need it. So I'm in an application, it needs to access a file that could be anywhere. And that's an important part of it. It's really transparent to the end user. Could be in the private data center of the company. It could be sitting in AWS, could be on internet resource. It doesn't really matter to me. I just know I need to get it. So it would establish that connection at that time for that purpose, and authenticate me. And once I'm done, I'm done. It doesn't mean I have to type in my password every time I change a cell in an Excel spreadsheet that's transparent to me because other technologies like single sign on are taking care of that. But that's kind of the core difference philosophy. You know, a networking level technology like VPN or an application level connectivity technology like SDP or software defined perimeter.

Kathleen (23:12):

Great. And any companies out there coming to market with really interesting products to solve that?

Michael (23:20):

Yeah. So there's a lot of players in the SDP space. Zscaler, that's a big part of our business. A lot of the networking VPN companies have pivoted. You know, the Checkpoints of the world, the Pulse Secures. I'm also seeing a number of startups. In the past year I've had some companies pitched to me like Meta Networks and New Edge, both of which have actually already been acquired. And that's not entirely surprising to me, because it's an increasingly hot space, but also because you need agents on all the devices and it's increasingly hard to convince the CISO to install agents on thousands of devices. So, the incumbents have a leg up because they already have that real estate taken care of. So a lot of them are leveraging those same agents to now offer an SDP kit, the abilities. So a lot of it is kind of the usual suspects in the networking space, the VPN space, that are now offering this as functionality. They're Acquiring SDP startups to get there.

Kathleen (24:30):

Great. All right. Shifting gears. I have a couple of questions I typically ask my guests and I'm curious to hear what you think. I guess the first one being, you know, with the way that we communicate and manage data changing so quickly, what do you see as the biggest challenge that we're going to face with respect to securing communications in the next few years?

Michael (24:55):

Yeah, so I'll give you two answers to that. One very immediate term and one longer term. You know, the immediate term as we were discussing, you know, we feel forced into the sudden change of everybody working remotely. Well at some point we're going to have to go back. I think the new normal will not look like the old normal for a lot of different reasons, some of which we discussed. But from a security perspective it's going to be tough to roll that back. You know, companies quickly throw the policies and the rules out the window because, you know, we just had to stay functional. So, you know, it might've been like, Hey, you could only work two days a week, or Hey, you can't access that server unless you're in the office. And suddenly that got chucked out the window and it was like everybody gets everything.

Michael (25:36):

Well, what happens when we go back to work? And that has to get real bad. And as a guy who's worked in security most of my life, I know I'm drawing a line in the sand and holding to this one thing. Coming into a new company and saying, okay, all the stuff that you used to have, all this flexibility and access that you used to love, it's going away. That's really hard to do. So I think, recalling these rights is going to be an immediate challenge. But I think the longer term challenge, security talent is really the biggest challenge that we're going to face. You know, there is a major shortage of security talent. And that's one reason why as an investor, I'm very interested in companies that can help. It'll make things easy for companies to do security. Not, I don't really need expertise. I don't have to build this massive, expensive and heavily staffed security operations center. So that's always going to be a challenge that we're going to face.

Kathleen (26:36):

So what new security technology are you most excited about in the next five years or so?

Michael (26:43):

Yeah, so I spent a lot of time looking at artificial intelligence, machine learning, technologies in that, you know, it's a fascinating space and unfortunately, much of what you hear is hype. We're not there yet. I'll be the first person to tell you that AI and ML is not a silver bullet to solve all of your problems.

Michael (27:08):

But you know, there's no doubt that that's where we're headed. Now, anytime I get a pitch where it will, number one, I don't think I could possibly get a pitch where the person doesn't mention AI and ML. Like it's just, it's kind of a, you know, the belief is like you're expected to have and you are.

Kathleen (27:26):

How often do they really have it though? Because I've noticed people over and over, they have used those terms and use them liberally when they're not really accurately describing the product they're talking about.

Michael (27:38):

I'd say nine times out of 10 as I started digging and pulling on the thread, really once you get under the covers, it's the same old stuff. Signature-based technologies and things like that. But again, there's no doubt we're moving in that direction. So if I get a pitch where it's like, Hey, we use AI and ML to create this black box, it's magic and just put the data in and all your answers are coming out the other side, that's going to be a short pitch meeting because that's just not true. That's not the way it is. But, we are already at a stage where AI and ML can do narrow tasks quite well. Like giving an example, what we're not good at doing is just, there's unstructured data and it's, Hey, go find bad stuff in there. That's just too complicated. But if it's more specific than that, like, Hey, in this pool of data, can you tell me what was the human being and what was the machine? It's actually pretty good at that because machines behave in a very predictable manner. You know, they only go to a couple of domains and they only, and they do it at the same time of day. So it depends on what, you know, what problem you're trying to solve. But you know, absolutely fascinating and critical technology that is going to take time to live up to its full promise. But there's no doubt in my mind that it will be driving every security solution that we have in the future.

Kathleen (29:00):

So third question, company or individual, who do you think is doing really interesting and cutting edge work in the field of secure communications right now?

Michael (29:12):

Mmm, good question. So I think it's too easy to just say, Hey, we're going to throw out the old with the new. So let me give two answers to that. One, you know, it's important that we still are enabling and empowering existing companies that aren't able to move to some of these that we've been talking about because you know, I'm still going to have, for example, I might have legacy devices that I can't go install some SDP agent on. They still need a way to get in there. I'm going to have situations where I don't have control over that endpoint. Like maybe I'm not dealing with an employee, I'm dealing with a contractor or a consultant and there's something that's not going to allow me to install something in there. So I still need a way to be able to continue on with some of these technologies like VPN technologies.

Michael (30:15):

So Attila, who I'm on the board of, you know, they're really answering that challenge by having, you know, taking that technology and making it accessible in a way that it wasn't before in very small, hardware based devices that are very secure. And so they're able to answer some of those challenges for companies that have situations where they're not going to simply be able to just move to an entirely new paradigm. And then on the SDP side, Zscaler I think is really the market leader there that they've really pioneered a lot of this and made it so that it's very accessible and very easy to deploy. And you know, I think they've won a lot of people over, who have seen that, Hey, you know, this is where we're headed in the future. And you know, now with this workforce that is just a completely different workforce - it is remote and mobile - this is a new paradigm that we need to move to work.

Kathleen (31:13):

Yeah, no doubt about it. I think it's going to be hard to put the cat back in the bag at this point. Well, thank you for joining me this week Michael. This was really interesting and I loved hearing your thoughts about zero trust and where it's going. If you are listening and you enjoyed this episode, please consider leaving the podcast a review on Apple podcasts or wherever you choose to listen. We do want to hear from you and if you have an idea for a future episode or you think there's somebody we should interview, tweet us at @attilasecurity. In the meantime, thank you, Michael. It was great chatting with you.