Wrestling with Cybersecurity

Have you ever wondered what cybersecurity companies are dealing with these days? Well, here we go. It's my pleasure to welcome Jon Schipp today to today's podcast. Uh, Jon is a product strategist at Rapid7, a global cybersecurity company, and he focuses on innovation. Welcome to our podcast. Jon, they call you the Ric Flair of cybersecurity. I shook your hand. I have an idea why that might be, but what is the real reason?

Woo!

Okay.

So, no, it's actually pretty funny. By the way, thanks for having me, guys. I'm excited to be here. Ric Flair, as you guys know, the pro wrestler in Tampa, Florida. His boat says woo down the side downtown Tampa by the Marriott. And I have a big personality and I yell when I'm speaking at conferences. And so I got coined that at work, actually, by one of our Salesforce teams. So I kind of stuck with it because it's just a fun thing.

When I met Jon, I always— people say there's always bigger fish in the sea. It's— I felt his handshake and I was like, I was known to be a big guy. Jon, I think you lift double my weight. How much do you bench?

Oh, so actually I'm not that great of a bencher, but 310 was what I got. It was my best one. I was a better deadlifter. I got 550 deadlifting, but I tore my labrum during a bench press as well, so I need to build it back up.

Okay. My God. Tell us about that. How did you tear it?

Yeah. So I was in the gym. I was going to do a maximal lift attempt that day because I've been doing a block of training and I was getting ready to try and see how strong I've gotten. Right. And I had a spotter there. We communicated, hey, this is going to be a maximal attempt. Your goal is to— once you see me struggle, the bar velocity slowed down to stalling, take the bar. But he didn't listen even after the conversation. And he did the forced rep with the two fingers and I pushed through it and I thought my leg bar— shoulder pop, went to the doctor, tore my labrum. And then anymore, with the way it sits, it's where the bicep tendon is. It goes across that where the labrum is, where it's specifically called a SLAP tear. And when I move my arm, I feel my tendon slide back and forth and it was painful. And so they cut the tendon and they attached it to the lower part of the arm now. And so I haven't gotten up to that point. This literally just happened this year. It was earlier this year. But I'm now at a point where I'm starting to get— I'm sorry, late part of last year. Now I'm at a point where I'm starting to bench again. So hopefully I'll get back and actually beat that 310 and get 315.

Yeah. And I want to find that spotter.

Yeah.

Well, it seems you can protect and secure systems manually, but we're talking about other things today. So, so maybe you can tell us a little about what your job at Rapid7 is.

Yeah. So I like to break up my career in like 3 different segments or eras, if you use a Taylor Swift reference. And so the first one, I was a cybersecurity engineer or analyst. I did the hacking thing for a bit, the hobbyist, learning, learned from scratch, learned for myself a long time. And then I kind of got into startups. So I was, I had my own company for a while, a consulting company. And then I also joined a company called Command, startup company in Boston. We built one of the earlier SOAR solutions and then we sold it to Rapid7. And then you fast forward to the third era, that's me at Rapid7, global publicly traded company, as you mentioned. We have one of the largest MDR businesses in the world, and we're known typically for vulnerability management solutions. And so from there, I've got opportunity to lead very large teams. I've led teams of 100 people, product managers, software engineers, design and operations, and kind of done several different things over the course of my almost 9 years now. But specifically today, I focus on product strategy. I work closely with our CEO and our executive leadership teams to figure out, as well as our customers, to figure out where are the opportunities in the market, where are the new technical challenges that we're not meeting today that we know are going to happen? Think about AI and all the things coming with that, that we either need to go build some technology ourselves to help our customers in those cases or go partner or buy those technologies. So I actually focus a lot on the business side of mergers and acquisitions, partnerships, and how that intersection— or that intersection with product strategy nowadays. Okay.

So these days when we say cybersecurity, what do we mean by that? And what are you trying to protect in cybersecurity? What systems? What things?

So I think it's in general, you have to think about there's just so much out there in terms of what you have, your mobile devices, your servers, your applications, your data, your credit card numbers. You have to understand you have— you can't protect it all. So you got to figure out what's important to your business. And so what we call that is your crown jewel. So every business, even us as humans, as people that are in a cyber world and operate every day, we got to think about what's important to us. Right. And so these are the things that we have to protect. Now, when it comes to the types of ways that you protect them, it depends on how attackers can actually attack or gain access or compromise those things. And so in today's world, we see a lot more identity-based attacks. So your online user identity, right, your username and password, your username and key. A certificate, whatever it is that's proving that it's you. These are the type of things that get attacked today, especially as you think about— look for the consumer world for just a second, like logging into LinkedIn, logging into Facebook, you know, all these are, you know, Instagram, all these different tools you have a username or password for. And so those are the things you want to— if you want to protect your reputation online and what you're posting, that's what you'd want to protect in that case. Right. And for businesses, you're protecting different things. Typically your reputation is actually important to a lot of businesses. That's usually an angle that you have to have. But in general, you're going to try to take care of and protect the different types of data that run your business, your employee data, your customer data, and then also the services and software that you're actually providing to customers. You want to make sure those are functioning right and they're doing their jobs, which is what customers are paying for, right? And so those are just some of the gamut of things you have to think about. There's a lot more, uh, we get into the weeds, but in general, that's kind of like my answer. Think about the crown jewels. I think some organizations try to secure it all and put the same— they only have so many time— much time and resources If you have 10 people on your cybersecurity team, you can't say, you know, do it all. You have to think about what the ratio is. I might need to have my basics on this part of my business, but the crown jewels, I need to put 75% of my security controls around my crown jewels, right? And so that's kind of the strategy and the game of chess you actually have to play to be effective.

So how, how do you stay in tune with the field? Meaning an attack hasn't happened yet, a new type of attack. So how do you plan for something you don't even know yet what it might be, if that makes sense?

No, it makes sense. It's really hard. So one of the things— this is one of those industries where you're constantly learning. There's other industries, of course, that you're constantly learning, but I've never seen anything like this. Like, things change so quickly and not even— I know we talk AI so much, but even before AI, there was new tax coming out almost every couple of weeks, right? And zero-day exploitations. And by that means what there is a, there is a vulnerability or piece of software out there that is vulnerable to an attack. And the people that own the software don't yet know that there's a vulnerability in the software. The attacker finds it first. And so we call that a zero-day, like kind of like a, you know, day zero of the coronavirus. Right, right. Patient zero. And so that's kind of how you learn. But so what you can't do is you can't really protect against those kind of things in the traditional sense. You have to have a defense-in-depth kind of approach. We talk about this a lot in cybersecurity. And you think about like, you know, if you have a castle, right, you're going to have probably some very sharp objects out sticking out in front of the castle. You're then going to have a moat around the castle. There's going to be a drawbridge that comes down, right? And there has to be— the door has to be open for people to get in the castle. And so then in the castle, you probably have to have a number of secure rooms, right? There's going to be different levels. Some of those are going to be hidden passages. And so those are the kind of defense in depth approach that you have to have. So in a case of an application that could have a zero-day exploit available, making sure that only the people that need access to that application are accessing it, right? Don't make it open to the world, for example, that anyone that can try out that zero-day exploit. And so these are the kind of things that you have to think about when it comes to securing the unknown or what's going to come.

Okay.

So yeah, you mentioned chess. You had me at chess and AI. So if you don't mind, with the developments in AI recently, how's this game of chess changed between attackers and defenders?

It's a good one. And so I think we're still learning actually, because it's still new. Everything is just kind of growing at an intense rate. So you think about phishing. Phishing has gotten so much— okay, let's back up. Phishing from the attacker perspective gotten so much better. You think about the Nigerian Prince kind of messages you get, right? Broken English. Well, guess what? It's no longer broken because they're using AI now. And you see the percentage of phishing attacks exponentially increase. I think where I've seen reports or 1,000% just in the last year, which is nuts. And so those are getting better. It's harder as a human, as a person who just is trying to manage their digital safety online, really trying to do their jobs, to understand what's phishing and what's not. And then with the deepfakes, understanding that you can actually impersonate someone with AI technology, have them just look and sound like them, their recorded voice or picture online or video, um, it becomes very difficult to actually understand what is a malicious thing and what is the real thing. And then on the attacker side— sorry, on the defender side, we have to get much faster and better and we're working on it, right, as an industry. And so we're using AI in different ways. We are using AI to kind of understand and write better detections to detect these kind of attacks. Right. And be more dynamic. They're not so static things that you look for, but we can actually in, in real time kind of detect how things are changing in the environment. So it's used a lot in the endpoint detection response area, identity threat detection response, other types of areas. And then really AI is also used on a huge use case that I'm seeing a lot more now is in when it comes to risk identification, identification of risk in your third-party management program, third-party risk management or supply chain program, uh, answering questionnaires, collecting a bunch of data for your organization so you know who your riskiest vendors are because supply chain attacks are going up significantly, right? And then I know there's a number of other areas that we're actually investing in AI to help make and contextualize alerts, help contextualize vulnerabilities so you have more information about them that helps you to prioritize as you need. And so I think there's just a lot of things going on right now. It's really challenging, but it's also a very exciting time. Because we're just seeing what the technology can do. It's really early, but the amount of investment going on in the industry is enormous.

So is it like an arms race? So if I have two AI agents, one is trying to attack a system, the other is trying to defend, and it's almost game theoretical, meaning— that's an acronym. Okay. Sorry, that's jargon. So meaning each agent should think, if I did this, what would the other agent think? So then I risk So what does it look like in reality? Really, it seems like an arms race to me between—

it is a bit of an arms race. Yeah, it is. And I think it even extends far beyond that. Think about outside of like the agents having to get, you know, each one has to know where to go next, their chess move, if you will.

Yeah.

Think about just being a consumer and you're logging into an online shopping center. One of the most interesting things I heard this year was there was a chatbot that they have that you talk to, right, about your order, getting order information. Hey, what product would be good for me based on what I want? I want to add this to my cart kind of thing. Well, there was a person out there that actually manipulated the LLM that was backing the chatbot feature to get free products and have it shipped to the house. They convinced the LLM that they owed the products to that person. And so they got— they bypassed You know what would normally be common controls in place if a human was there, they would check on and the company's accountable. They have and the company's accountable.

Wow. Yeah, that's interesting.

So it just like the, the evolution is it's just so different now. And so I bring that up because I don't think people really thought about that. You mentioned the agents going back and forth, game theory style, right? They're just trying to figure out the next moves are. But there are other types of avenues or attack vectors that are going to come out that we just don't even we didn't even think about as we built this stuff because we're building at such a fast pace as we're trying to grow our businesses to scale.

So Jon, could it even be that you had, say, an AI agent to attack a system and it's evolving, if you like? Okay, so literally you would call it release the agent, so to speak. And then depending on success and whatnot, it begins to— it's literally evolving. Is that really what's happening by itself, if you like?

Yeah, absolutely. I think they are evolving. I think we actually have to evolve our data though to make, have the AI make better decisions. I think that's a big problem today, especially when we think about the enormous amount of data that we have in our organization like Rapid7. You know, we have, I say trillions of points of telemetry, individual specific pieces of information about our customers, about their assets, their users, the configurations on those devices. And how do you have the AI agents make sense of all those things? You have to have structured, system with a taxonomy, a data taxonomy that allows it to interpret in the right way so it knows what to do once you give the agent the right outcomes that you're looking for, right? I think that's a big challenge that we're seeing because a lot of our companies like us and other, even outside of cybersecurity, just to pave the way to use these agents in today's world, to use them effectively to solve business problems and customer problems, we have to re-architect our data strategy. 'Cause we didn't build it that way, right?

I see. Speaking of data, so, um, what, why is securing data in the cloud so difficult, uh, especially for, and even for serious organizations?

Okay. This might be a surprise to some people. Um, it's actually not harder to secure data in the cloud. Oh, this is actually a myth in my view. Mm-hmm. Um, if you think about it, you look at any of the cloud service providers and the the actual infrastructure as a service or software as a service capabilities that they provide, they built security into all of it. Whereas if you were doing this on-premise, you typically, you have some controls that you can make, but you also have to implement your own security on top with a device agent, right? You deploy a piece of endpoint agent on a device. You'll deploy a firewall and rules and all that. You can, all that stuff is really built out in the cloud. What's challenging, I think, for people, why this myth is more prevalent today, is that the cloud is still new to a lot of people. Yeah, we have 11,000 customers at Rapid7. Just to speak from my own lens, the majority of those customers, probably 90-something percent, are hybrid environments. That means they have on-premise and cloud. Okay. A very small number of that actually are cloud only, and they're the more sophisticated ones in terms of they actually know the cloud. I shouldn't say sophisticated, that's probably not the right word, but they actually have a— they actually understand the cloud operations piece better because that's what they've done only, right? They've had more time on that. And so I think once you start to understand that cloud is just like on-premise in the terms of the things that you do, the types of software that you deploy, you know, it's not just, it's not just an application you're deploying, uh, clusters. We did clusters on-premise. I worked on a supercomputing center and we had, uh, we did this at the University of Illinois, is funded by the National Science Foundation. It was called Blue Waters. And we had a cluster of 200,000 different nodes and you run clusters in the cloud. You'll do it with Kubernetes as an example. And so we did a lot of this stuff already of load balancers in the cloud. They're just baked in, right? You can easily spin one up to divert traffic and the right resources. We had that on-premise too. And so it makes it— cloud makes it a lot easier to deploy and control your costs. And so outside of that, the security stuff, because of the, the way that the attackers are increasing and the demand for security, well, AWS doesn't want you to call— or Azure and Google don't want you to have their stuff compromised because it could affect their costs on their side, right? It affects their platform reputation, all this stuff. So they built in security and they built in some of the more modern security directly into the cloud. And you can add that on to if you want more security features, you can just add that on directly in the cloud and get that visibility. And so anyways, long, long-winded story, but it's a myth that it's harder to secure in the cloud.

Jon, here's what I really need help with. I've recently surveyed a ton of my students on the question of privacy, and it's more and more— and actually two rounds of students, uh, prior semester and the current one. And I'm finding a trend. People are caring less about privacy. And the common sentiment I'm getting is they're sort of saying, well, my data's exposed anyway, so why should I really care? What would you respond to that kind of sentiment?

Yeah, no, this is a good one. Uh, I think that it's just funny how more of our lives are online now. And so I understand that from the student's perspective, right? Everybody has a TikTok account now, right? And they're just posting whatever. But in general, I think my response is It is not true that you're going to get like, you're going to get compromised, potentially compromised. Some of that data is, but it's not true that you can't control some of the aspects of that. Let me go back up with an analogy. So the flu or the coronavirus or any viral infection that's going around, I'm not going to say, oh no, I don't care about viruses. I'm just going to do whatever I want anyway. Are you not? If someone's coughing sitting next to you, are you going to make the effort to not sit to them next to them? Right. And so there are risk-taking approaches that you have to think about. And so I think most people just say that off the cuff. It's kind of a lazy— it's kind of a lazy statement if you ask me, because you're not really thinking about the total risk of the decisions that you're making. And so when you think about it like that, yes, you should actually make a choice, just like you would probably not— if Peter was coughing his ass off right now, I probably wouldn't sit on that side of the table. Right. And so there's just a little— that reduces my risk to get it, to get it, to get a virus. Infection as an example. And so there are things that we can do to limit our exposure. I think the second piece of that I would say is like, what do you care about? Because, um, do I care about my address getting online? Yeah. Do I care about my bank account numbers getting online? Hell yeah. That's when I care about those. Cause most of our addresses are public information anyway. You could probably find it with enough research online. And so it depends on what you care about. And so for a simple example, as a person that's talking or bringing that up, if you think about shopping carts, there's always a button that says, would you like to store your credit card for future use? A most basic thing that you can do is just say no. It's inconvenient because next time you log in, you want to buy something, you have to punch in your credit card again. But if they're doing their job as a business and they're actually not storing it on the backend, that limits the, the surface attack or the attack surface for that particular credit card number.. And so there's little things that you can do along the way, just like there's little things you can do along the way to avoid sickness, right?

Oh yeah.

How do you overcome the nudges? It's so interesting you say this, and I know I'm going to interact with shopping carts and I know students that are listening here would, and there's all these nudges that make it inconvenient ever so slightly to say no, to reject cookies. What would you advise us to think about a little bit more so that we're a little bit more cognizant so that we can and will do that?

I would, I would say like there's a lot of different technical controls that you can implement like in your browser, by the way. Today, the browser, the way that we've evolved technology, is your— is effectively your new operating system. Everybody's working out of the browser, right? That's where you interface with most of your shopping, your social media. Everything is in the browser. And so when it comes to things like that, there are browser controls that you can implement. I actually don't worry about a lot of those. I think make sure that you're not being— you don't have malicious browser extensions installed, right? Make sure that you have some of the basic browser features. I think any more browsers implement features automatically. I see. And then the other thing, the really big one, just making sure your browser is up to date. Oh, I honestly think that's one of the most important things. Cool. The cookie thing is a little bit more about privacy typically.

I see.

And so if privacy is the concern, that's where you might want to minimize the amount of cookies used from different websites. Maybe there's some websites and this, you have to get a little more detailed, but you have to be like, oh, well, I would allow cookies for this one, but not minimize the cookies for this one. I don't just as a person that's busy with life, like almost all of them, I don't really worry about that. I see keeping my browser up to date, keeping my operating system updated on my computer, whether it's Mac or Windows or Unix or Linux or whatever it is. I think those are some of the most effective things that you can do. And then just making sure that you're being just street smart with what's going on in front of you. If this website looks like it's not very legit, just don't, don't click on it anymore. Go find an alternative. Things like that, I think, go a long way. Excellent. The other thing I want to mention real quick, I apologize, I just, something just occurred to me about your question around that from the students. Um, the other thing I would ask is some people have come to me and be like, so Joe, I don't really care. You know, my comp, I have my laptop here. I don't really care to secure, to put a password on it or anything. Like my data here is not that important. I play video games on it. Right. But one thing people don't think about, and this is my response to this one, is would you care if a terrorist organization used your computer? Or would you care if an individual organization put CSAM, child explicit pornographic material, on that computer? At that point, you become an accomplice in a way, not intentionally, because if you're not securing your computer, someone else is going to take it over because that's what they do. It's what cybercrime groups do. They compromise hundreds of thousands of computers out there that are not secure, and they use that to attack your own government. Like the United States government, and they use that to proliferate all types of illicit material. And so now do you care? That might change the way you think about it.

Excellent. I think there's another question that people don't ask themselves, and that worries me actually myself. So that data in the cloud, whether my own data or data stored about me, may outlive me. And then there's basically two Two parts to that, two pieces to that. One is it may forever remain encrypted, but simply be forever there. And maybe some organizations can use it because some is maybe privately held.

Okay.

I have no more control over this. I'm gone. Some people might say, I'm gone, I don't care. Well, I care because that data could affect other people who are correlated with this data, right? With friends, family, and so on. The other one is if it outlives me, Who can possibly delete it on my behalf? So do you have any sort of practical advice? It's, it's sort of very sincere note. I understand that. But do you have any practical advice around that?

Wow. Um, you know what, if I'm being just straight on, I haven't actually thought about that. Yeah.

See, there you go. Yeah.

See, I think this is just, especially when you think about quantum computing and the evolutions there, how, you know, if there's things have been encrypted in the past and it wasn't quantum resistant in terms of the cryptographic algorithms that were used, you potentially decrypt that in the future.. And so I think that in general, just as a simple rule of practice, it just makes the most common sense, common sense for the data that you own and the data that you can control of that you, again, it's on your hard drive as an example, it's on your mobile device. So maybe it's not synced to the cloud, delete that. And you can't tell when you're going to die. You don't really know that. So we have a plan, I guess, in place between your family and have them make that decision. Hey, I'm going to, I'm going to burn this hard drive. I'm going to destroy it, whatever it is. It's much more difficult, as you guys know, in the cloud. I don't know that we have a good solution for that today. I really don't.

Oh, you are, but you're dispelling misconceptions. Uh, the, the other one then, I think you can also probably tackle this is, okay, so you've dispelled the misconceptions about why should I care, and maybe it doesn't immediately affect me, but it can affect my society. The one that people bring up, and it really is with the advent of AI, they say, well, and we're seeing papers come out that AI can predict things about you based off of benign pieces of information, like something I said on Reddit here and something I said somewhere else, each of which is not really privacy kind of infringing. And if somebody really believes that and says AI can really predict everything about me anyways, what would you respond to that?

Well, I think what do you want AI to predict about you and what are the outcomes with that? So I think if I'm an organization, a commercial organization, And my intent is to predict what my future consumers would buy.

Yeah. Yeah.

You know, I think I need to, uh, I'm going to do is I'm going to look for your public social media and anything I can find about you. I'm going to buy information that other companies have about you, like we do with advertising and things like that. And I'm going to try to put together a portfolio. And so you have to ask yourself, what do I want known out there about myself on the public-facing internet that can be used to advertise and potentially use my money in the future? Now, for me personally, I love— I like to— hey, I'm not shy. I like to buy things. I'm actually a big spender. It's probably— it's a little bit of a problem. But for me, I— so I love when people advertise things to me. I don't care that much in that area, but that's just the line I make in the sand about myself, right? There are things I do not want out about my life on the public internet. But in general, if you're going to recommend me a new surfboard or you're going to recommend me a new guitar or you're going to recommend me, you know, whatever. I'm generally okay with that. Okay. It really, it really depends on your risk profile. If you're a secret agent, it's probably going to be a little bit different. If you're just an average Midwestern guy, like, like myself, who likes to lift weights and play guitar and surf, it's going to be a little different. Right. So it just kind of really depends on what your, what your goals are. I think from a family perspective, I do care very much about what's publicly out there online while I'm traveling, um, from away from home. As a specific example, I travel a lot for work. I am gone all the freaking time. I have 5 or 6 trips coming up in the next 2 months. And so I do not post online while I'm away. And when people don't know where I am typically, right? And so those are just kind of the things you have to think about. It's all about your risk profile and what the thing— again, going back to the age-old security problem is I have too much shit to protect. So what matters the most to me? Well, and then how can I reduce the risk of the things that matter most to me?

Okay, that's so potent. Actually, I tried something last night and I couldn't believe how easy this is, is that take any picture of you, or like I take a picture of you right now, immediately I can take a reverse face search and I'll know who you are. And I think that you're right, it changed how I realized I might want to go about doing things, which is like when I travel now, if I, if I don't want people to know where I am, what do I have to do differently? Where somebody just snaps a picture, they know who you are and where you are.

Yeah.

And we have to make those changes pretty quickly.

Yeah, yeah, yeah.

So Jon, you said you're a big spender, but you're also a small spender. I think you brought a couple of items today. Can you talk quickly about those? So you have a passion for those, I think.

Yeah, so I was going to give a little bit of an overview of the history of cybersecurity in a way. And so early on, this is kind of how I started out. I was a hobbyist. So I was just really enamored with technology. We got our first home computer. I think it was Windows 95, right? And I was in elementary school. And, um, I was just kind of thinking about some of the trajectory of the industry and how it's kind of evolved to today where it's gonna become a potentially a trillion dollar industry in the next 10 years. Right. Mm-hmm. And so, um, one of the first things that came out in how cybersecurity started was really around, uh, academic culture and hobby culture. So at MIT early in the '60s was the, the Railroad Club. They were the first hackers, if you will, that tinkered with technology to kind of figure out how it worked and how to break it. You fast forward a little bit, then you have, um, where technology in the early, early to mid-'80s, technology, uh, was a little bit more prevalent. More people were owning computers at this time, right, than they were in the '60s and '70s. Personal computers were starting to take off. So then new hobbyists kind of came into place, and there was this, uh, ezine called FRAC, short for Freaking and Hacking. Freaking is the essentially the hacking of telephony or telephone systems, which is more prevalent back then. Because we were still growing with the computers. And this is actually a hard copy of FRAC magazine. Uh, they did it for the anniversary edition, and this is one of the only hard— I think there's one edition that they have before that was hard copy. Everything else was ASCII text online on their EASY. And I used to print this out the school computer until I got banned. I printed out like 40 issues.

Wow.

It was thousands of pieces of paper, so they caught me eventually. But anyway, that was a big deal. And so like one of the first things that happened with FRAC was I can't remember what issue it was, but the electronic 911 system was published in FRAC. So it's a pretty important zine, if you will, or journal if you want to use a more academic word, back in the day. And so it's evolved since then. And then we got into, I think it was '88, if I'm not mistaken, the Clifford Stoll book, The Cuckoo's Egg. He was one of the first, one of the first big investigations of computer espionage. He tracked down— he was at Lawrence Berkeley National Laboratory. There was an attack on systems that he was administering, and he tracked the attacker down, and it turned out to be a KGB recruit. So the US government got involved. It was one of the earliest stories of hacking at a national level or a global level. And so that was, that was, I think, one of the cool things. Everybody should read that book. And then you fast forward, you know, I think in the last— I forget what year it was, but there was a book called Countdown to Zero Day. Around the Stuxnet malware that was produced, I think it was between the United States government, the NSA specifically, and Israel, which targeted the centrifuges at the Iranian nuclear plant. I forget which— what the name was. But anyways, it's the one that damaged them. They sped up really fast with the malware once they got it in there and it damages all the centrifuges. And so it helps stop the nuclear production or the nuclearization of the uranium And so with that said, like, that was one of the— that was the first time that there was a, a global level attack like that in another country. And it really focused on not just the computer systems, but stopping an operation that was at a nuclear kind of level. And so that was really important, I think, for our history as a, as a, as, as just in the world in terms of cybersecurity. And of course, nowadays you see a lot more in ransomware. Cybercrime, because of the proliferation of computers and the commercialization aspects, cybercrime is rampant now, right? WannaCry happened, I think, in the— I lose track of my time, but maybe 2010. Someone correct me. But that was one of the biggest ransomware attacks that affected millions of machines online. And then you had the big growth after that. Cybersecurity companies around, but there's not as many as there are today. And now you have one of the biggest cybersecurity acquisitions happen with Google or Alphabet. Purchasing Wiz at $32 million. And so now you're kind of seeing the, the level of investment there is in cybersecurity and the technologies to make us all safer just from an economic perspective. And it's just crazy how we've gone from a hobbyist culture to one where we're kind of playing around, we're doing malicious, but there's really not a lot of money in it because there wasn't a lot of commercial elements. The internet wasn't really widely used. And so the internet's widely used. We have all our businesses up now. We're attacking everything, right? And that's where the cybercrime is running rampant. And then also governments are using it. To get intelligence and to get an upper edge and advantage and even attack and shut down power systems on the internet in other countries. Right. Kind of like what you probably heard about what happened in Iran. We were actually in their networks for a long time learning about things, looking at their cameras, figure out where, where the ayatollah was and things like that. And it's just kind of nuts how well, how interconnected everything is. And so the things that you see in like the Jason Bourne movies is kind of reality in a way. Right.

Mm-hmm.

Yeah. It's, it's, it's incredible.

Yeah.

Yeah.

So, so Jon, what would you say the next few years, 3 to 5 years? I mean, no one maybe really knows, but it's your best guess. So what will be the main themes emerging in cybersecurity?

Yeah. This, this is one I think about a lot. Yeah. I, I, um, so as, as my role at Rapid7, I, part of my goal is, like I said, I have to understand what the new anticipate, what the new problems are gonna be and kind of solve them. So I have a pulse on the market. I think there's, there's a lot of different things going on, but one, you're going to see an increase in cybersecurity services. We're already seeing this. And one of the reasons Rapid7 invests so much in cybersecurity services like managed detection response— I'm an organization, I do not have the talent or the time or the money to manage my full security program. I want to hire someone else that knows it and can do it at scale and outsource it to them. Right. So that's one aspect. So we're seeing more and more managed service players coming to play. I think I heard 6,000 was a recent number. Now, those are including a lot of small startups in there, but that's an insane number. To where 10 years ago is probably less than 1,000. Okay. And so I think there's also evolutions into— I'm not as close to this one 'cause it's not where we play, but the, uh, post-quantum world, uh, understanding all the different types of quantum technology. There's a lot of startups, like there's a, a quantum, uh, startup called Aisle out there now. It's in Israel. I think they're doing some really interesting stuff. They got some, uh, focused aspects on that. Uh, I think there's gonna be a, uh, a transition into the, a renewed focus on the human element of cybersecurity. Again, I talk a lot about everybody's working out of the browser. That's where the most— your malware is typically delivered by URL in a browser, right? Or there's a phishing link, it's in the browser. That's our interface to it. So you're gonna see more technologies that's focused on the human element. How do we protect you, me from clicking on things we shouldn't click on as well as stopping us in the middle of what might be a malicious activity within the browser, right? And so, and also informing us, educating us why you might want to do that, to teach us along the way so that we actually get better. And so there's companies out there that are starting this. One's called Maro, seekmaro.com. They're just focusing on the human element. I think on the red teaming, on the offensive side, we're actually finding out that LLMs could be used. They're very good with code. You can actually use them to detect vulnerabilities, find vulnerabilities, I should say, the ones that don't actually exist, not on a CVE, but they can actually look at code and actually figure out where the problems are. And those could be used to generate CVEs. But those kind of organizations, there's a whole new proliferation of these types of red teaming companies that are trying to detect faster and then also reduce the amount of vulnerability noise and backlog. So if the backlog is this big of millions of vulnerabilities, I want to get it to this big so I can help my team focus. And so there's a really cool company called right now called Sparnext that's kind of focusing on that. They do things with vulnerability chaining because In terms of attackers, they usually chain multiple vulnerabilities together to actually get to their target end goal, their end state. And so VM tools today don't really help you do that. They just give you the list of vulnerabilities. They help you prioritize them. They don't tell you in sequence which one's going to be used. So this is a technology and there's other ones out there that can help customers understand that, help organizations do that. And so there's just like, there's a lot, there's a lot out there. I have more, but I don't want to take up too much time. I know we're at, we're getting close to it. So I want to kind of highlight a few things though.

Okay, so, and then for the audience, the users of technology, so what would be one practical rule that you would suggest to go by to live securely, to navigate the internet and such securely?

Yeah, so I think in general, let's limit your attack surface. This is a word we use in the cybersecurity industry a lot. You just gotta think about what are all the pieces, all the software solutions, devices that I have out there. So every computer I have, Every mobile device I have makes up for an attack surface. Every user account online that I have makes up for an attack surface, right? Uh, every cloud application I deploy, whatever it is, these all actually, in thinking about today's terms, you may have, uh, a refrigerator that connects to the internet. You may have an alarm clock that connects to the internet. These are all pieces of the attack surface that you have in your home, right? Mm-hmm. And so I think it's just more important just to think about What do I actually need? Keeping them up to date with the right software and controls. Back to basics. Do I have a good password? Right. Don't use a password, use a passphrase, or you have some sort of two-factor, multi-factor authentication solution. You get a FIDO key. There's a lot of capabilities out there. A lot of modern SaaS solutions will integrate with to make you more secure. Right. And so it really is going back to basics. Keep your shit up to date. Implement good passwords. Don't put them on— don't actually— don't share them with people. Account reuse is a big problem. Don't use your passwords across multiple websites because then what happens is, think about your attack surface. If one of those websites gets compromised, those attackers will reuse those across many different websites, and then potentially more gets compromised. So it's really all about limiting that surface. And so just be smart. Street smarts actually would matter here, if you ask me, most of the cases.

Okay.

Excellent. I learned a ton.

I learned a ton too. Well, we could talk for another 2 hours. I'm sure of that. But Jon, thanks for sharing your insights into cybersecurity with us today. It's fantastic. Thank you so much.

Thanks for having me.

I hope you heal well.

Oh yes.

Hit the bench again.

We're getting back to it.

All right.

Awesome.

Thank you so much. Thanks, guys. Awesome.