Fraud Detection and Post-Quantum Cryptography – Patrick Donahue, Cloudflare

This is texturing TV. Hey everyone, welcome back to techstrom TV really happy to have my next guest. His name is Patrick Donahue.

He is from cloudflare and he's going to tell us a little bit about himself and well most of you already know cloudflare, but got some exciting announcements coming out of cloudflare. We gonna cover one today. Hey Patrick, how are you?

I'm doing well. How are you? Thanks for having me on it's our pleasure.

It's our pleasure. Since you brought it up early. I wanted to point out Patrick had some cool city maps.

Behind them there of all the cities he's lived in but were you coming at us today from Patrick here in Austin, Texas Sunny, Austin, Texas already. Absolutely South by Southwest Austin, Texas, but it actually just ended a couple weeks ago, I guess anyway Patrick. Thanks for joining us.

Besides Austin, Texas, tell us a little bit about yourself and what you do with cloudflare. Sure happy days. So my background is in computer science and academics but while in college I you know, I needed a campus job.

So I ended up running the the networks at school and kind of manage the network security appliances. And so you know back then this was early 2000 you'd put all these pieces of equipment in Iraq. You had a router a firewall a package shaper intrusion detection load balancer, etc.

Etc. And so whenever there was a problem, you know, I'd walk through the snow went to school in the Northeast over the data center and fix it. So that was kind of when we started me on my passion of networking and security.

It was great. I'm sorry. That was my day exactly.

Yeah. Yeah. People don't remember, you know, your fingers would get you know, sore from from racking and stacking.

Well, you always had to have your screwdrivers over here. If you're lucky had a little power drivers take that baby out no time. Yeah these cool kind of special issue screwdrivers.

I was you know day one. Yes, absolutely. It's just great learning experience, you know eventually if I'm a way to cloudflare and I I thought it was such a great fit for my interest and you know, what we do is essentially virtualize all of those boxes that you would, you know, historically put in a Data Center and give you a single dashboard, you know to manage it and so our mission is really just to help build a better internet.

And so to do that we run a really large Network around the world, you know, there's almost 300 cities we have presence and more than 100 countries. And then we use that Network to protect around, you know, 20% of websites on the internet but also businesses and their employees as they go about their day and that's sort of the threats that they face apps, you know apis really anything connected to a network we can help protect absolutely. Do you know performance and and privacy and some other focuses, but my focus at cloudflare is on the security side.

And you know, hey, we're a customer too. So, you know, you should mention that and full disclosure though. It won't affect our interview today.

Happy to have one. Oh, yeah, we're happy to have YouTube believe you me. But you know, I mean you mentioned the stat there kind of off the cuff, but it's something worth repeating twenty percent of fifth of the entire internet is on cloudflare.

And and that is that's quite a number, you know. 10 years ago at the RSA conferences America's growth Capital used to put on an event like the Monday of RSA before RSA opened just before that all the Monday stuff and I used to host their Cloud security panel. Every year and we've had people like Jay chaudry who is the CEO of these scaler.

We also had the CEO founder of cloudflare and I'm blanking his name right now, Matthew Princeton. Yep, Matthew you would come on and what a great panel those words and I I was the moderator. So it was an amazing time to you know, yeah learned a lot that was early on when cloudflare was more of a CD and anything right and but now of course the security Securities just blown up right?

It's become job one and Absolutely. Yeah, and it's funny when I was looking at clockwise saw some of those went back to see what interviews are out there with Matthew and might have actually seen you in action back then. So yeah.

Our mission is security, you know, there's there's threats new threats every day. They're sort of the threats that people have been dealing with for many years and then, you know threats of all as you defend against one, you know talkers will come up with some some new methodologies. And so it always keeps us on our toes to build products to help, you know, companies like yourself and businesses of all sizes.

Absolutely. All right, let's jump into it. You guys get some new announcements.

We're gonna I think we're just covering one of them today, right? Yeah, I think we're gonna talk about our fraud detection go for it. Let's hear all about it Patrick.

Sure. So I'm the area that I focus on is is protecting our you know customers applications. And so I'm really anything coming into their applications.

We want to make sure like requests that they want to see right. So we kind of progressively filter them out think of like a funnel we're talking about DDOS earlier, you know block block DDOS attacks and other sort of requests that are over certain rate. Then you kind of get into the you know, the contents of the requests.

8 billion dollars, which is up 40% from the year before and 400% since 2019, you know people spend a lot more. I think some of the reasons behind that are people spending a lot more time online, especially, you know entering the start of the pandemic people are more, you know isolated which makes it more vulnerable. I know, you know, my parents get calls from call centers attempting to defraud them and you know something that I worry about It's also something, you know, our customers ask us about a lot and they say they said to us.

Hey Cloud fire, you know, you sit already in line with this this traffic and help protect our applications and you've got a great, you know bot management solution. That detects is something human or automated and let us control that but can you help us get a little bit deeper into the intent of those requests and say how do we identify things that that might ultimately cost us money not Beyond sort of just the server cost right or the networking costs. And so we we have a very broad customer base and that gives us a lot of data and we can get into that of how we do the the fraud detection, but essentially said to us we trust you we want you to do more for us and that was the announcement, you know, we made a couple weeks ago where we said.

Hey, we have a network in the way. It's designed we can do this very quickly for you. And so if you if you talk to marketing team at a company you The security team at a company they often have very different, you know incentive structures, right?

So the the marketing team doesn't want to restrict anybody coming to whether it's a bank or e-commerce or you know tickets they want to keep the sales as high as possible. But the security team says hey, wait a minute, you know, there's some real cost to us if we let the wrong things through and so that was the the focus of our announcement and we wanted to make it as kind of frictionless as possible. And and not slow down that transaction, you know when you're in a in a store and you're buying something with your credit card, you know, you expect to wait a few seconds for that to process right?

But if you're doing something online you want that that experience not to degrade in any way and so that really high level is is you know what we announce and happy to go into more details in a particular areas. Yeah. No, but we should dive into it because I'll tell you.

This just happened to me this weekend. I I was I was out of town. I was up in the New York area.

And I did a transaction. I forgot what the heck I bought but For whatever reason it got flagged because it wasn't my normal G I guess was a geofence kind of thing maybe. Because it wasn't my normal IP and it was and I did it late at night early morning.

So I maybe that was a red flag, too. But anyway it got flagged and I didn't feel you know, this is like 12:31 o'clock in the morning. I didn't feel like getting on the phone with someone and dialing him.

It's me. But what was nice is I got an SMS message reply one for yes two for now and both done, right? It didn't hold up my transaction or anything which was It was big for me.

Now that actually happened to me when I moved to Austin A co-worker convinced me I needed to get a you know, nice pair of boots and I don't think that fit the the profile they had built on me, right and yeah Patrick's night about guy. Yeah, exactly. So, you know, I got that one pair.

But yeah, I mean that happens a lot in in that's the exact the experience that we are trying to to make better. And so I was talking to a customer last week and you know, they're really a big into sneakers and so, you know, Bots go and buy up all the the sneakers or you know, I think you're you know Yankees fan and you're maybe trying to get tickets to a playoff game and you know people maybe all those bostonians buy up the tickets and so trying to you know identify what is automated not but I think the thing to to go level deeper that's important to understand is fraud is often human driven too if it's lucrative enough and so you can absolutely, you know, right scripts and and you know to try to defraud sites and we see a lot of that and we've been dealing with that time, but if it's lucrative enough It makes sense to hire a bunch of people and and sort of give them instructions of how to try to you know, defraud online businesses. And so you see banks, for example people, you know opening either trying to get into an existing account.

And so you can imagine if you know, somebody would log into your bank you've got, you know ability to pay bills you have ability to transfer money take out loans really any number of things in addition to all the data that you've got in your profile and sometimes that data itself is what people are after and so that's what we call account takeover and so a lot of efforts there and try to reduce that risk of somebody taking over the account and then there's the if somebody does take over the account. What are the the fraudulent actions they can take and so what we do is we look for those patterns in compare that to sort of normal behavior and then help tell our customers. Hey, there's something going on here.

That's that's that doesn't fit the model and and either you want to block it out right or you want to Send a signal Downstream to them to maybe take some additional precautions and so it might be you know, you show something in the interface where they have to provide more information or maybe you know, do some sort of check over the phone and so really trying to give our customers the the controls and the visibility that they need and and to the point you made about you know, you're not sure why you got flagged, you know, our customers need to know that too. And so we spent a lot of time thinking about how do we give them the right level of detail that to make it actionable? And so if we say hey, we're we think you should block this transaction.

Here's why we try to lay that out for them. Love it. So Patrick, maybe someone out here is watching this thing.

You know what that sounds great. I'd like to check this out. How did they engage?

Yes, so we published a Blog a couple weeks ago and and there's a sign up form there. And so we're working with the great thing about building products to cloudflare is there's so many people out there that the second we have something they try to just like rip it out of our hands and want to use it and and that gives us really good feedback to to move quickly. You mentioned your conversation with Matthew early a lot of a lot of what he talks to us about is is that learning speed and that velocity of improving our product and so we have some capabilities today and that we announce a couple weeks ago and people can get started with that.

They fill out a form somebody will reach out and sort of make sure that's a good fit. And then we're always looking for you know additional use cases. And so a lot of the the early adopters that we're talking to are the the banks the e-commerce sites a lot of them route through cloudflare the gaming companies, you might not think that they're sort of right for fraud but there's a lot of like virtual Goods that people want to to steal and so, you know, they they can reach out to us on that the thing that I that I really like and you mentioned your customer all of that data that we see about 45 million requests per second that pass through the network and so each one of those requests that come in all 45 million per second.

We score those are the machine learning model and so to do that you have to do that in a very distributed manner, right? tv. Your network connections getting that request is getting routed to the the closest data center to you network was and what we do there is we actually make a very quick scoring decision.

It's called inference on the machine learning model. So drawing inference from that request versus the the data models that we've trained previously so score it and say what is the likelihood this is fraud and why and so the the quality of those models is really based on all the data that passes through the network from all of our customers. Not just you and so we try to perform that that inference very quickly at the edge.

It's something like point two milliseconds is how long it takes. I love it, man. You know what?

We didn't mention a website to go get more. com but within cloudflare, is there a section they should be looking for? Yeah, so if you go to there's there's if somebody's in the dashboard there's a security Center there where we're starting to surface.

Hey, you should look at these things and for products that you're not using yet. We're starting to surface. com is another one where we have a very, you know, steady stream of announcements and we get into a lot more of the technical detail a lot of the the readers.

There are the you know, the Security Professionals the developers that want to you know, go really deep and understand what it is we do and so I'd say those are the two, you know primary sites that people can go to to learn more. We're always happy on the product side. One of the the favorite parts of my job is hopping on the phone with customers and our job is really help them solve problems, right?

So they bring us their problems. We ideally solve them with something we Be built, but if we haven't built it yet. We have a great Network to build on top of and we spent a lot of time thinking about how do we build stuff quicker and quicker?

And so there's there's teams that actually Focus entirely on that, you know developer platform. So if you want to write a application on cloudflare something called clock for workers, you can do that. We all use that same environment internally to to make us move faster and build more features better.

I love it. Fantastic Patrick. Thank you for coming on and educating us here on this new tool.

you know what cloudflare has so many different things in there for my audience either you've got to See the entire gamut really understand where this is why 20% of the internet uses them? But thank you. Hope to see you.

soon and best of luck, man Great great speaking with you. Thanks for having me on enjoy the conversation and hopefully talk to our pleasure Patrick Donnie you from cloudflare here on techstrom TV. We're gonna take a break.

We'll be right back.