Episode 7: A Conversation with Bob Flores

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda loop.com.

Welcome. In this oodacast, I'm going to introduce you to my good friend and associate, Bob Flores. Bob was the former Chief Technology Officer of Central Intelligence Agency, where I worked with him when I was at the Defense Intelligence Agency. Since leaving government service and retiring, he's been consulting with a lot of companies and has formed his own companies, delivering capabilities to both small businesses that need his professional advice and some of the largest enterprises in the globe, including doing security assessments for large enterprises and also serving as ciso. So welcome, Bob.

Thanks. Thanks, Bob. I feel like I'm talking to myself every time I talk to you because we're both named Bob. But that's all right. I know.

And some of the most pleasurable assessments we've done, we've done with another Bob. So it was Bob. Bob.

That's right. That's right.

I appreciate the time, Bob. And first, let me say what else should I have emphasized from your background that I skipped over too quickly? You know, another thing that people don't recognize about you is you have a great background in statistics and numbers.

Yeah, I have a couple of degrees in statistics. The other thing I think that's interesting, you know, some people know about me, but others don't, is that I'm a longtime volunteer firefighter and paramedic. And that's just sort of left over from one day I decided I was going to go to med school. And at the end of about six years of college, I decided I'd had enough college, so I wasn't going to go to med school after all. But instead I decided to become a paramedic, and that led to becoming a firefighter. And so I've been doing that for years.

Bob, this positions you very well, all of that background to talk about some aspects of this current crisis that we're all in. And I do want to talk about your views on the future of technology and artificial intelligence and cybersecurity and so many other things. But maybe it'd be very helpful if we start with your context on this current crisis. Like, have you put any thought into how this current situation may change the way that we work?

Yeah, I have, actually, and I'm not alone. I've read some articles, too, from other folks discussing the same thing. But early on, once they started, all the lockdowns, not so much Even in the U.S. yet, I thought, wow, this is going to change permanently the way people work. I think businesses are going to Some businesses are going to realize that they don't have to have a building that has a bunch of offices in it for their people. They're going to discover that the people were pretty much just as productive working virtually as they had been working side by side with one another. This has some kind of profound ramifications down the road, one of which is company can save a lot of money on rent. But the other is that today, if you live in an open office kind of thing where there are no cubicles or anything like that, any kind of disease that comes into the office, it doesn't have to be a fatal disease, but any kind of disease that comes to the office can rapidly run throughout the entire place. You know, so you, you know, maybe you look at, look at school teachers, especially elementary school teachers, when they first start out, they get all kinds of illnesses because the kids bring them in. Eventually. A lot of those teachers create antibodies. And it's kind of interesting to note that over time, they get less and less sick less often. But now you've got, let's say your daughter's a teacher and you see her frequently and she's got a cold. She brings it in, you get it, you catch it, you go into the office and you got 150 people in the office, and pretty soon they all get it. So you won't have any of that if everybody's working virtually. And that means now you get 150 people that are sick with the cold or flu, whatever, and that's 150 people that are off work. You not get very productive when you're doing it that way. So.

Right.

Yeah. I think it's going to be really, really interesting as time goes on here.

So that will also have impact on things like the cost of commercial real estate if companies are realizing they don't need so many cubicles.

Yep.

And then there's also the impact on, you know, parking spaces for the cars that are not there. So lots of other unanticipated consequences and effects.

Yeah. One of the nice things is that, you know, cities might realize that, gosh, maybe we don't need that new building over there. Maybe we can convert it to green space instead and put another park in instead of an office building.

Now, what are your views on the impact of technology that this may have? I mean, I want your views on the future of all aspects of technology regardless. But what about the impact that this crisis may have on where technology is going? I mean, obviously everybody is now more familiar with the collaborative tools and distance learning Tools and things like Zoom. But what kind of long term impact do you see from the pandemic on tech?

Well, so an interesting thing, I think that will happen. I mean, Zoom has some great capabilities and it has some competition, but I think that as people continue to work virtually, that will ferment even more competition and people will invent better ways of collaborating virtually than we do today. If you, you think about it, you know, what, what Zoom provides, Blue jeans, you know, WebExs, all that stuff. It's actually fairly primitive. I mean, yeah, we can see each other if we want to be seen, we can hear each other if we want to be heard. The moderator can do certain things that the attendee can't do. We can share screens. But, you know, that's not really any kind of, you know, magic, if you will. I think as COMPUTE gets more and more powerful, which it will because of Moore's law, it's going to lead to much more interesting ways, you know, for doing these kinds of virtual meetings, virtual conferences. I think there's going to be all kinds of changes to that technology. The other thing that happens here, of course, is that anytime you start talking about how you change technology, you got to worry about the security of that technology. And so I think the way we deal with security, specifically cyber, it's going to change. It has to change. If you just look at what's going on right now, most companies, well, they gave, it depended on the company. But most of the small companies, they didn't care too much about security when their people were working from home. I mean, they cared, but they didn't put a lot of money into it or anything. Yeah, okay, here's a VPN you can use, but that was about it. Well, now we've already seen bad guys exploiting the way people are working from home. And I mean, virtually every day this week there's been a different kind of an attack against stuff. And so this is gonna, this steps up the game for guys like Zoom and guys like Bluejeans to make sure their platforms are more secure. But it also means that, you know, companies now can move from figuring out, gosh, you know, what kind of firewall rules do I need for my on prem network to how do I better protect my workers who are working virtually. So we just have to think about things a little differently. And basically what it ends up being is every single person becomes a piece of that Internet of things change. And we've often said that, oh, by whatever date, there's going to be 20 billion interconnected devices around here? Well, there really are. And. And it's not just going to be the, you know, the smartwatches and things like that. It's going to be you and me with whatever devices we're carrying so that we can collaborate with one another. Right. And I don't think anybody's really looking at it that way today, so.

Right, yeah. And Bob, another thing that this pandemic is doing is having us all pay much more attention to medicine, technologists like us paying more attention to medical technology. And we have both been tracking the security issues with medical technology, excuse me, for years. It's going to become even more important as more of us are instrumenting ourselves and instrumenting our homes with medical technology.

Well, you're right. And if we, you know, especially if we continue to be. Sounds kind of morbid, but if we continue to be in an environment where certain parts of the population have to be locked down, almost said locked away, that sort of means something different. But then it's going to be vitally important that those people have medical devices in their homes and so. And invariably those things are going to be hooked up to their home Internet systems and things like that. So. Yeah, you're exactly right. Those things have to be much more rock solid than they are today.

Right. And we were just talking with our mutual friend Tony Cole of Ativo Networks, and we were talking about the fact that it's really disgusting how the adversaries are taking advantage of this current crisis. Now, it's to be expected. That's what bad guys do. But still, they're at their worst. And it just shows that, you know, they're attacking at this time. They're going to continue to attack no matter what. And you bring in these devices into your home meant to help with your health or your family's health. If the bad guys can find a vulnerability, they are going to exploit them. And it's just. It's a disgusting thought, but it's just reality.

Well, they will. But I also think that they, in the long run, they're doing us all a service because it makes us all realize how vulnerable things are and then we can fix them.

You're an optimist, Bob. That's why you say so. No, I think you're right. They are. They're waking us up sometimes.

That's right, they are. It'd be nice, you know, for us to say that, hey, we've got our act together. And, you know, when we just go to design something, we can design all the security that's ever needed into it. But we don't tend to work that way. You know, everybody wants once they have speed, and instead of. Sorry about that, wants to have speed instead of perfection. So speed wins because the faster I can get the thing out there, the faster I can start selling it. Right, so.

Right, yeah. So another point I wanted to mention, Bob, is that you and I have advised a lot of companies together. We're on a lot of advisory boards and corporate boards together, including some great cybersecurity firms. One is Balbix that is applying machine learning to enterprise capabilities. And I want to get an update from Balbix on, you know, what they're doing that could be better serving this world of distributed users. Another is Accredo, which is specifically built to help layer in security in this world of distributed computing and mobile applications. So I think that's another group that I want to get a good update from is Accredo and how they're shifting to better protect this new world of ubiquitous computing.

Yeah, and of course, Accredo and Balbix, they're very different companies. Credo is mainly going after the interconnected devices that we talked about a couple of minutes ago. You know, Ballbix is really interesting because they can not only discover everything that's on your network, but they can help you prioritize the risks associated with all those devices with their machine learning algorithms. So fascinating stuff, actually. Right, yeah.

And another that you and I are both very familiar with is centripetal networks, of course, which is working at a. At the network level, deliver clean Internet instead of having to, you know, clean it after the malicious code gets in your system.

That's right. So it's, it's the, it's the washing your hands part of the Internet. So what it is that's good.

Well, Bob, another thing I really wanted to get to is your views of artificial intelligence, because this is another that you and I have been talking about for 10 solid years. And now we're starting to see capabilities be fielded, some of which are making a great positive difference in the world. Others seem to be opening us up for threats because AI is being used by malicious actors. AI, your own malicious. Your own code can be attacked by malicious actors and your algorithms can be attacked. And I just wanted to ask if you had any insights on where any of this is going and what we should be doing to accelerate the good AI into our enterprise.

Yeah, well, first of all, AI and machine learning are certainly buzzwords that are thrown around sometimes inappropriately, and it's very common now to see it could be, it might be a cyber company, it might be any other kind of company. It doesn't really matter. Them saying, oh you know, we do XYZ and we're, we're powered by AI when in reality they probably have no clue what that is. So you know, basically what it all boils down to. And you know, I'm a statistician, so this is the way I look at things. They're data driven applications is what they are. And the more massively you can round up and compute the data and determine relationships among all the data, the better AI algorithms you can write. And so I think that again, as compute gets stronger and faster, AI is going to get better and better. You know the, I guess the holy grail is to try to mimic the human brain. God help us if somebody actually ends up doing that. Yeah.

Whose brain?

Yeah, I know that's right. So, and, but I think where it's going to get really interesting is when quantum computers become sort of more mainstream. What's going to happen with AI then? Because I think it's just going to explode and there'll be all kinds of stuff that we haven't even thought about today that will be driven by computers then.

Right, fascinating. So you know, another, since you mentioned quantum, I want your views there too. There's two aspects it's always important to talk about in two very different technologies. The quantum computing and the quantum security. The quantum computing, the modeling, the reality of physics itself and just shows so much promise. And there's been a couple of approaches there it seems at this point in time. Google has made the best breakthroughs, but Microsoft and IBM are just, you know, pursuing different paths that are going to have also great breakthroughs I'm sure as well as many others. But quantum security, totally different thing, which is first of all, how do you protect your information once quantum computers come and can break asymmetric encryption? So how do you write the right algorithms but also how do you use quantum effects to generate high entropy keys like our friends at Quintessence Labs do. So would love your views on both of those and maybe together who's going to win in this, the race between quantum computing and quantum security?

Well, I think that you know, the guys like Quintessence Labs are, you know, they exist today and they're selling product today. So I think in for today's world they figured out a better way of randomizing to be able to create better keys. Now is that going to be sufficient once quantum computers become mainstream? I don't Know, I think it, it might be okay for key generation, but what's going to really have to change is the algorithms that we use to do the encryption. You've got, you know, there's a little company called XQ Message who's doing some work on that today, drawn by a guy named Junaid Islam. And you know, basically what, what they've done is to make an electronic one time pad is really what it boils down to kind of interesting stuff because now it doesn't really matter how powerful your computer is. One time pads are unbreakable. We all know that. So I think you may see more and more of that happening. Right.

So thanks for mentioning Junaid. I'm going to invite him on because he's such a great thought leader on so many areas, including not just security, but leadership and management and how enterprises get stuff done, how to think comprehensively. He's just really a smart guy.

Yeah, yeah, he is.

Well, Bob, I wanted to ask, there's so many other topics that we didn't cover. Is there any final thoughts you can leave us with that would help give insight into the future of technology and what we should all be doing to better leverage this world of ubiquitous computing?

Well, I, you know, this is basic advice that we've been giving people for, you know, ever since I've been in this business. And I don't want to say how long that is, but. And that is that no matter what you're doing, you've got to have security baked into the thing from the beginning. It just does not work. We've seen this over and over again. It does not work to have to go back and retrofit things to add security to them. You know, even guys in the car industry, they understand, you know, security for them is really the safety parts of the automobile industry. And you know, they, various safety laws have been passed over the years and they almost always are passed, but then don't go into effect until two years down the road because the companies have to retool their assembly lines to be able to integrate that stuff in because they know they can't force it in afterwards. We guys who deal in bits and bytes instead of nuts and bolts have to realize that too. And, and that's not going to change. So.

Yeah.

Yeah, Cool.

Well, thanks, Bob. It's great talking with you and I really appreciate it.

Happy, happy to be here. And one of these days we'll get back together again, you know, for real. Not sure when that'll be, but I'm sure it will happen. So. All right, thanks for listening to this OODA Loop production. For the latest analysis on cybersecurity technology and global risks, please visit www.oodaloop.com.