Surviving the Cyber Core Collapse

Hey everyone, this is Alan Shimel. And Mitch Ashley. " After all these years.

Yeah. Mitch, it's good to see you. I know you were out in San Francisco this week, weren't you?

Yeah, I was looking for all those 60 billion people from the RSAC. Where were they? They didn't all come to the Salesforce conference.

They scurried out. Well, a lot of them went up to Napa, because I saw a bunch of them up there. Oh, that's where they were.

Okay. No, it was kind of nice. Nice to have a little break from that many people.

So, and then we're headed, by the time people watch this, you and I will be in Prague, right? We will be. Yeah For SUSECON.

Yep. And security's going to be top of mind there. Ooh.

Sovereignty. Sovereignty. All of that's going to be great.

A lot of stuff. Yeah. But Mitch, we've got...

Well, people can see this, I bet. But we've got some guests. It's not just you and I today.

Let me introduce you to our panel. Some of them may be familiar if you watch us on Techstrong often. I think they're friends as well as...

Friends and guests. Friends and panelists. Seemed different.

Yeah. There you go. Panel members, friends, and guests, lend me your ears.

Our first guest is, he's not wearing a scarf. You may not recognize him, but he's our friend Chris Blask. Chris, welcome.

Chris, you might be on mute. Chris, oh. Good to be here.

Good. Mute the other thing. There you are.

So we're happy you at least have a shirt on. Yes, that's nice. For now.

It's warming up. I can't promise for later. That's why he wears the scarf.

Oh, okay. Kind of like the judge with the robes, but let's not go there. Next up, let us introduce another Techstrong Gang anchor, stalwart, our own Kate Scarcella.

Hey, Kate. Welcome. I'm happy to be here.

I'm really happy to have you here. And making his debut on a Techstrong video show. I'm happy to welcome, and I'm going to mess up his name, but we do the best we can.

John Herrema. Close enough. Yeah.

Hi, it's John. I think I'm a guest today, but hopefully I'll be a friend by the time the- By the end of the show Sure, yeah. That's all- Already it's too late now.

And John is the chief product officer for Absolute Software, that you may not have ever heard of Absolute, but you have BIOS and everything on your machines, and it's in there. So you don't know it, but you're using Absolute. But we're not really here to talk about Absolute Software today.

John was nice enough to come on and join the panel to have the discussion we wanted to have. We talked about it on the Techstrong Gang this week earlier. We've spent the last two weeks clutching at our pearls, running around, saying the sky is falling.

Other friends of ours in the security world are saying, "Forget about it. What's the big deal? " But this whole Project Mythos and Glasswing, at the very least, has caused us to examine what is the future of the cybersecurity industry?

What is our end game? Is it a job security play, where having all these vulnerabilities and being able to find them means we stay employed? Do we really want secure software, and all of the infrastructure we've built up for the last 30 years, 35 years, becomes obsolete?

There are people on both sides of that. Kate, I know you have very strong passions on this subject. And your background, security research, working at IBM many years.

Working now as part of the CD Foundation, and speaking out on matters in cyber. Tell us, what's your take? So right now, everything seems extremely chaotic.

And I know that when I look at this personally, I'm like: How do we wrap our arms around this at all? " And the idea is, I don't know why we're surprised. So there are two components that are making up this scenario, and it's the dogs didn't get out on their own, and we opened the gate.

And we're surprised because right now, AI is still in this puppy stage. And we're surprised that it's like we're saying, "Let's see if the puppy bites. Let's see if it chews up the furniture.

" And we already know this is going to happen. And so then we're surprised at the behavior of the AI, and it's something I don't quite understand why we're surprised. Why are we surprised that the puppy chases the squirrel, and the child is running after the puppy that's running after the squirrel, and they all end up dead in the street.

" We have this catastrophic event, and we're wondering, how did this happen? So right now, when I look at this, it's interesting, because I've really started to do a very heavy analysis and deep dive from a thinking perspective, because I think we need it. And as a person who's been doing this for over 20 years, I look at this andI see this is like Groundhog's Day for me and it's crushing me that we still haven't gotten this right after all this time and it's the same scenario.

And so as an example when I think about this, I think about identities. Of course I blame Mitch here about this with the hard-coded credentials because we have to blame somebody and the static identities and the flat network and everything else. Well, I don't blame him for the network.

I guess I'll blame you, Alan, for the flat network. So- But we built systems with all this built in and then we were surprised at Glassworm, right? I mean, Chris and I were talking about this.

We were surprised that Glassworm took advantage of all these things that were a part of the system and so what's the surprise? And one of the things that really started making me think about AI is really, Chris, you and I have talked about this because he has mentioned numerous times about canons. And I've really thought about can it be that easy?

And so as I started to think about canons, and what does this mean, first, we don't have a framework. I mean, that's one of the first problems that we have. We don't have a framework, and when people tell me about zero trust and everything else, zero trust to me, I'm sorry folks, but it's actually not a framework because zero trust is something that seems to sort of like this rubber band that really when I think of a foundation and I think of a framework, I think of an actual something that you can build your house on and not something where we're going to add another product and we're going to expand the idea of what does zero trust mean.

And so I think we actually have to, as I've said, throw out everything. And we have to get serious about the framework that we put down and so what does this look like? And for me, because I also wanted to add in some other tools, some open source tools, because I think it's important because how do we just implement it?

But some of the things that I wanted to bring up is we need to understand identity boundaries. We need to understand data provenance. And I know, Chris, I am talking your language when I talk about data provenance.

We need model transparency, and we need governance that is built in, not bolted on. I feel like we are bolting on security since, like what the heck folks, since 2000 easily. We need to stop, especially with AI, around bolting security.

So we don't need fear, we don't need panic. AI is acting as it should, and we need to put down a serious framework and stay within the framework, and it has to be easy. And one of the things that, I'm sorry to go on here, but I'm going to say one more thing, that when we started this journey in cybersecurity and especially with IBM, we talked to multiple CEOs, and what I'm fascinated by is that the three things that we talked about to CEOs was who was coming into your network, and this was before enterprises, what are they doing once they're there, and how quickly can you prove it not only to yourself, but to your auditors and to your board and everything else?

And I feel like we're almost at that same type of transition where the framework is intent defines what must and must not happen, identity binds every action to a real actor. So four things. System, number three, constrain what the actor is allowed to do.

Behavior reveals whether those constraints hold. Those four elements, I believe, is the framework that we need to go forward with. So I'll stop there and probably I'm going to pass it over to Chris because I have loved talking to him about this and hey folks, and I think AI is going on-prem, so that's as a part of this.

I think cloud will disappear. Alan, I know that you think I'm crazy when I say this, but hey, mark my words, one year from now, cloud will not be what we think and it's going to be because of AI. I'll take that bait and just well said on every level.

So see if I can weave together what you have said, Alan, and all that you just said, Kate, which is most of it, but you mentioned the burgers. Look, it's a burger, but as you said, Kate, we've been raising cows for a long time now. This has been- Yeah ...

you can smell it. It's been on the barbecue for a long time. This has been coming.

In this, as I say on the Techsplaining Gang, I've really enjoyed that. Well, how long has it been, Alan? More than a year or two.

Every week get together and keep reviewing the same things, and on that show, you can just go back and get the transcripts. We've been talking about this all along, right? So now we're at this point, AI is doing exactly what you expect, right?

And where you ended with it, let me just say canon and local. So yesterday I got to give testimony to a Canadian parliamentary committee on civic resilience, right, where people are trying to figure out how we keep coherence given the world we all know as it is. Right?

We can literally take AI and put it in the hands of churches, synagogues, mosques, temples, communities, businesses, everything. And you have your canon, the information you actually need to do what you're doing. Kate and I and Alan and us idiots who show up on shows like this try to love to solve all the world's problems.

" Right. Alan, I don't know, you may remember that in December, I wrote a LinkedIn article, "The Day the UI Died" to the Don McLean song, changed the words. Mm-hmm.

At every level. In the green room today, just getting Zoom, "How do I get a Zoom record going? " It's these huge, brittle systems that are all centralized, and Google or Apple or somebody is going to solve all our problems for us.

And again, it has worked so far, right? DNS, PKI, all these structures that the idea was not to have three or one or two. The internet was meant to be a mesh, a pervasive infrastructure that things could be on.

And we happen to be at the right time. I'm really, really glad we have AI right now. I was figuring, looking out in the future to where we are now, that we'd have systems like this to help us solve these problems, but the problems we're having on AI.

The smell of the hamburger has been there all along. There's a gap between what we've deployed and what is secure, and it's everywhere. It's in our software development life cycle, it's in our deployed systems, it's in our device configurations, and now is about the time people are going to be able to see it all really clearly.

So this, as you said at the beginning, Alan, Mythos and all this is like shocked. Shocked I have to find gambling going on here. So what are we going to do next with this?

That's the question. Kate and I and others, and you, we've all been thinking about this for a long time, and I'm concerned things will crash and people will get hurt. But in infrastructure and IT, and as I always try to come back to the electrical linesman.

The electric grid you think of as this nice, stable thing. People die keeping your lights on all... The question isn't if, it's how few.

Right? And these issues we're dealing with right now are serious. Don't let me make light of them.

It seems that there will be lots of breaches in systems, and there's a lot of global conflict to make it really, really serious. Right. But it's not the end of the world.

I think we know basically how to make this not have these problems. All right. And what do you think, John?

Oh, sorry, Alan. No, go ahead. Well, I agree.

There's definitely a burger there. I think, as a product company building things, I think anybody that's taking these tools right now and applying them to the software that they're building, we're finding things, right? And so I think that for me, one of the most interesting shifts is for the longest time, the way folks would respond when vulnerabilities, other things like that, were found is really through sort of a change control mentality.

Like there's Patch Tuesday, and then we're going to look at what comes out on that day, and then we're going to take some amount of time to decide which ones we're going to go deal with, and we're going to... You were saying about the pearl clutching. " Things like that.

I think one of the biggest things we're seeing is that that whole mindset just has to shift. We can't treat this as a change control mentality and that kind of speed and pace anymore. We're going to have to move as fast as the machines are finding the exploits.

We're going to have to become comfortable with patches that are also being auto-generated. We're going to have to be comfortable with sometimes those patches might cause a system to crash or something like that, and really just shift the mindset in that kind of resilient sense. "Okay, if that does happen, how do we respond?

" Because we can't take the time to be perfect anymore or take this sort of change control mentality. That is over, and anybody, whether you're an enterprise or a product company or both, I think that's the most interesting shift that we're seeing in terms of how folks grapple with this. You just have to move in a different way, different speed, and be comfortable with some potential breakage along the way.

And then knowing that if things break, what's my plan to get back? And so a lot of folks are... " And not be in this paralysis, change control kind of mindset.

And I actually-- It's heresy, what I'm about to say, but I actually hate the word resilience, and I think that that word also needs to be thrown out. We use it a lot, and I think resilience is out the door because resilience basically says we're going to go back to the way it was, and I think it's not about going back to the way it was. I think it's about working with what responds, and honestly, at the end of the day, I don't think it's bad that we're dumping stuff that needs to be dumped.

And I think that it's about time that we need to become leaner, we need to become faster, and we need to understand as long as things are working, that's the most important part. But they may work differently. We may add on new products, new features in order to get the best result, and not necessarily with something that's broken, just leave it in the dustLet it go.

It's time for it to be buried. For me, we need to build a strategy on what responds. That is one of the most important things.

Yeah. And that, to me, does not mean resilience. Yeah.

Well, I would agree with you in the sense that I don't think being resilient means that you... Because often people say it's like this notion of snapping back. I don't think that it's the idea that you're going to snap back necessarily to exactly where you were before, or that part of being resilient, in fact, is doing things differently.

Because, in fact, that could make you more resilient by not bringing along all the baggage, taking all the same approaches as before, because that would be the classic definition of insanity. So, I agree with you. I don't think that resiliency rigidly means I'm returning to exactly that state that got me in the place where I had the event, where I needed the resilience in the first place.

Yeah. So, I think those are sort of mutually compatible concepts in that some aspect of doing things differently the next time around has to be part of becoming resilient, as well. Let me give another perspective on resilience, because I went through this same kind of mental, how do I deal with this?

There's another perspective on resilient, which is, it's not rigid. In other words, you can withstand, withstand, withstand until you finally break. Right?

Resilient is about not necessarily not falling down, but degrading gracefully as much as you can. Right? It's withstanding some of the things that are happening.

Okay. It kind of sounds like my life plan these days, Mitch. Well, it's kind of me for about the first 20 minutes when I get out of bed in the morning.

That's funny. If I can stand up, I'm doing pretty good. Mm-hmm.

It's not some mythical self-healing, it can handle anything, and it's resilient, it's impervious. It's nothing like that. And I think the concept of it, what's valuable about looking at it that way for me is, you just don't want to build brittle things.

You want to build things that can handle some unexpected conditions as well as expected- Mm-hmm ... as much as you can. Yeah.

And then hopefully, returning back to some normal operational state, whether it's exactly what it was before or whatever the new state is, is much less of an act of heroism to get there. Yeah. So that's how I've kind of mentally balanced that in my mind, Kate.

I don't know if that helps or not, and you still think that's hocus pocus but- Yeah, no, but it's funny, Mitch. Talk about being on the same mindset. So I'm doing a TED Talk, and my TED Talk is about the human operating system.

I call it the Human OS. And basically, it's after catastrophic update, whether it's, in my case, it was a personal catastrophic update. And it's one of the reasons why I have come to hate the term resilience, because what I found, it's about building on what remains.

And there are no rollbacks. There are no life rollbacks, and there really is now coming a time when there's no systems rollback either. And so, how do we deal with not being able to roll back?

And that's what my talk about, and that's why I have become so passionate, not only because of the personal things that I have experienced and have this correlation with systems and the human OS system. But at the end of the day, we build on what remains. Yeah.

And it actually is not bad. It's this idea of you can never be at that state again, right? You won't be.

That time has passed. You're in different conditions. Those exact conditions could never exist before.

Exactly. Yeah. And that's how we have to think about life.

Chris. Sorry, Chris. No, I love everything about this- I came in, by the way, had to save our pergola.

It's snowing here in Colorado and just it decided to- Collapse ... jump on us. So anyway, go ahead.

Well, I love everything about this conversation. Let me see if I can weave it all back together. So Kate, as you say, there are moments where the unacceptable happens, and some are foreseeable in life, with mortality and so forth.

" It's like, "No, it can't. " And I happen to be wearing this, I think you see this, Kaspersky Securities Analyst Summit. Security Analyst Summit, yeah.

Yeah, it's such a great metaphor right back into your world, John, I think because it was Eugene Kaspersky, used to at least, I don't know if he still does, but probably not, get a couple of hundred of the best security people on some remote island. There's an Tenerife in the Canary Islands, and ply them with massive amounts of alcohol and nothing funny about that at all. But I was talking to the guy who had, until that moment, this may be 10, 15 years ago, whatever, but he was the person at Intel that checked the microcode and did the security of the microcode and he had to explain to the board and the company and everything else that we'd reached that point where we can't.

" It's like, we cannot do that anymore. And John, you live right there down there in the firmware, and you get all this, "Well, we have to have this much," but everything scales. You get to the scale where you can't anymore, and it's much like regret.

" No, you're not going to anymore. And you're back to where you said, Mitch. It's like, this is the way the world is now.

We're either going to all collapse and so forth, or some new system will arise. And that's how I like to see resilience. Not clinging on to what's not working anymore.

It's not there anymore Yeah. Well, it was an interesting turn of phrase there maybe. So maybe it's less about roll back, and more about roll forward.

Like, how do you actually move forward from that event? And again, if you were strictly speaking trying to exactly roll back, chances are the same thing that got you in the bad place could recur somewhat by definition, if you were strictly rolling back to that same state. One of the things that I found is that by having a framework, even if it's a personal framework, but by having a framework once you see the framework, you can start to build on it.

And I feel like in cybersecurity, and it's also because of the vendor space that I found within IBM. And nothing against IBM, they've done some great work. But the framework never seemed to be solidified, and so it's like building a house.

" And that's what happens, and we end up with a really ugly house. Cybersecurity is the same way. We have a really ugly house and we really need to have a pretty house now because AI is taking advantage of this outlook that we didn't prop it up appropriately, and so it's going to collapse if we put weight on it and everything else.

And so that's what's happening, and so that's why with AI, it's so important that we adapt a framework that can't be changed. And when I say that, we have universal laws. Gravity is a universal law.

And while we have different outputs or different inputs, the output is still the same. And I talk about this. We can have multiple inputs.

Two times two equals four. Two plus two equals four. And we can just go on, three plus one equals four.

So we have these multiple inputs, but the output is always the same. We need to understand that. With cybersecurity, it's the same way.

So I'm sorry to go on here. I'll shut up. But I've become very...

Yes, in my head lately. I'm going to school. This is good church.

Appreciate it. Thank you. High road.

Yeah. Sir, may I have another? I haven't said one thing yet though.

I want to jump in here because we're already kind of running low on time, believe it or not. Let's not forget where we are, where we've been, and where we want to go. Because right now I hear this.

You know what that is? That's opportunity knocking. Okay?

Because a lesson I've learned in life is that there come certain points, whether it's political winds, technology, life events, where God throws the cards, or if you believe in God or whatever you believe in, the cards get thrown up in the air, and we see where they land differently this time. And maybe you had a rotten hand before, and you get a better hand now. The wheel of karma, whatever you want to call it, goes round and round, and I really feel like this whole thing is forcing us to potentially get a new deal.

Yeah. Get a new deck of cards, maybe play this one better, right? Correct some wrongs that were built in or that became institutionalized over the last 30, 35 years.

And I think whether we're clutching our pearls about Mythos and Glasswing or saying, "Go play in front of your own house," we need to understand and seize the day, seize the moment, that this is a great opportunity to insist that we do better- Absolutely ... that we do better from software developing, that we do better from working. " Nah, we've done a crappy job.

A lot of security people, they just come off as gruff- Yeah ... critical. The two Muppet, the old men Muppet, Burt, it's not Burt and Ernie, but you know who I mean.

Yeah. Right? Who's just throwing peanuts from the gallery.

We've got to work with our developers, we've got to work with our platform engineers, our SREs, our DevOps people, and say, "Together, we could build a better tomorrow. We know now how bad this code is. " And I think that has to be the message.

And I absolutely agree with you, Alan, 100%. And I think Chris and I have even talked about, this is an exciting time. Because we know and we have seen, all of us, have seen what we've done wrong.

There's no surprises here. And I know that we can do better. I know that I'm positive.

Well, I'm an American in Canada. My co-founder is Yemeni, right? We're not at all confused that the world order is changing at that level, right?

And it's not-It may not be related, but it's maybe ironic anyways, we're doing this similar things in the tech space, but I think the answer is the same. And we all know Mark Carney, the prime minister here in Canada one of the first people to say on that stage, "The world has changed. " And he just kept talking.

Right? And just doesn't go back. And the centralization and so forth, as an American, I like the way things have been, but I look at how it's rearranging and so forth, and it looks very similar.

Right? In the AI world, same sort of thing. There's two opportunities.

We can centralize all of it into one thing, or we can get distributed, and I think we're going in the latter direction now. So that's probably a good thing in the end. And I've been asked one thing, if there was something simple that we could do.

And I think that what we could do simply, and I'd like to know your opinion, especially Chris, because you talk so much about canons. But I think just writing what AI is allowed to do. From a document perspective and governance perspective, talking as a cybersecurity architect, we're not great at documenting.

We in the IT world, we're just not great at documenting. I don't know why. We're just not.

But I think that that's an easy thing that we can correct today. We can correct that one small piece. That we put the dog on the leash.

And what does that mean? What are the boundaries? What are these parameters?

What does this look like? It's one place where we can easily, all of us, start. Right.

And that's been my whole point, and I'll go there since you're bringing it up, because canon. Canon used to be your whole group, the whole church, global. No.

What we mean by canon is yours. You have one. You do.

As a person, as a company, write it down, own that yourself. And these days, you can build that into your computers- Yeah ... and say, "Computers, don't do anything that I say I wouldn't do," and they generally won't.

Yeah. And say, "Leave a lot of receipts so I can see what you're doing," and they generally will. And that's- That's cool ...

going to solve a lot. Yeah. Because you're a small business, you're a large business, whoever you are.

Yeah. You have your issues. They're not the entire world.

They're less. It's a subset. It's not that much.

Yeah. Write it down. Yeah.

Agreed. Agreed. Guys, I try to keep these down to a half hour, but we're past that.

I want to throw one more question to John, if you don't mind. And then I should have told you, Mitch usually gets the last word on Still Cyber, because I always jump the gun and go first. But, John, Absolute Software sits in a pole position here, so to speak.

Right? Your software is installed on virtually every PC out there. And I'm not knocking you or anything, but I thought we fixed security with BIOS 10 years ago already, or more, right?

Remember when Intel was building it onto the chip, and now with Phoenix, back in the day, Phoenix Technologies was building it into the BIOS, and we're finally going to be secure. But we still got crappy software, and we still got attacked and hacked. Is this a new opportunity to do things right, maybe, that we haven't done before?

Yeah. Well, I think certainly when we think about rethinking certain models, so for example, notions of identity. Actually, in the world we live in, what are the bedrock sources of truth?

And there is something to be said for hardware and TPM and grounding identity back into some of those tools that have been there, but maybe haven't been as utilized as much. So we think that there is something very important in this world when you start with something that is physical and tangible, and if you can bind that to the user, in a very firm, physical way, then I think that starts to give us some interesting bedrock on which we then can start to solve other problems. Because when we think about the notion of agentic and this notion of John and a model of John and an agent of John working in different places, being able to bring that back tangible to that asset that is very physically attached to John, we think is a pretty interesting starting place from which to try to build these things out and rethink some very fundamental things about identity.

And then you were talking about provenance. How do we then bind John and John's data and John's persona back to something physical and tangible and real? So we do think there's some really interesting opportunities there that we and others in the ecosystem can leverage as well to rethink the way we've been doing things in the past.

Passwordless and what is an identity, and this idea that if I just happen to have... I can get you to sort of convince me to give you this string of characters and letters, I can do all these crazy things. There's an opportunity to rethink some of that.

And really kind of a necessity, I think, as well, given the way this is all evolving. Agreed. Agreed.

Mitch, take it home. Taking it home. Well, one of the things that I've sort of come to the idea of is, again, borrowing from manufacturing and DevOps and our experiences there, Alan.

In manufacturing, when you have a quality issue, you set work off to the side to address it, to sort of patchwork it, to figure out how to kind of keep the line rolling. But that isn't where you fix the problem. You fix the problem at the point of origin where the problem occurred, right?

Ultimately, what you're trying to do is figure out where is that, or it's a compounding set of things that leads to the problem. And I think in security, we've always been sort of theWe're dealing with something that's already in motion, so we're pulling work off the line trying to fix it, trying to secure it, while it's moving. And I think the opportunity, the optimistic look at it is, since we're in a world of generating software, not just writing it and pushing it down a pipeline, instead of shift left, I think it's more about looking at across the life cycle of how we create software and systems and all of that, and saying, work at the point of origin, are problems happening, and could we, AI, et cetera, automation, help start to narrow those things in?

Because in the Phoenix Project, sort of the worst kind of work you can have is work in progress, meaning set it aside and someone else will fix it later. That's kind of the responding to the attack that's already happened kind of thing. Maybe that's a model that will help us.

I don't think it's necessarily we get to there 100%. I'll have to go to Kate's TED Talk to see if that might be a direction we would be heading. Let me know when you're doing that.

I'd love to be there. But that's a thought. I think that point of origin, there's a lot of power in that idea.

I love it. Guys, we'd love to hear from you out there in the audience. We talk about things like this, not only here on Still Cyber, but every weekday on the Techstrong gang, and Chris and Kate are on, usually at least once a week.

Mitch a little more frequently. So you could check that out. Wherever you're watching or listening to this from, whether it is a Techstrong property or our YouTube channel, or our iOS or Android or one of the streaming TV channels, we appreciate it.

If you have ideas of things you think we should be talking about, I'd love to hear from you on that as well. These are on LinkedIn, and I think we're going up this week on Podbean as well. So the name of the show is Still Cyber after all these years.

Chris, Kate, John, thank you for coming on. Mitch, as always, thank you. This is Alan Shimel.

And who are you? And Mitch Ashley. I've been reminding him for 20 years.

I'm getting slower and slower every year. Yeah. Where's Nate the cat?

That's the real question. Yeah, exactly. He abandoned me.

And you just listened to Still Cyber. Have a great day, everyone.