Kansas City IT Professionals - InfoSec Night w/ Keynote from Symantec CEO Enrique Salem

I'm Mike Gelfman. I'm the founder of K-State Professionals, and thanks so much for being here. Just wanted— the support you guys have given to this community is just amazing, and thanks for coming out to this stuff. So kind of want to go into a little, little history about us and kind of where we're going and some lessons learned. So 2008, we had small beginnings. When I started this, I never really knew where we were going with it. I never intended for it to be anything at all. It's just grown and grown and grown. We've turned into a grassroots tech community of almost 8,000 people. So we've got IT professionals, IT leaders, and entrepreneurs that are part of this community that come to our events and contribute content to our community and help each other out. So we've done all types of different events. This has been the one we've— best one, biggest one we've done so far, but we've got some stuff in the future that I know you guys will really enjoy too. So keep in touch with that. I also want to give a shout out to some of the people that have helped out. We have a philanthropy initiative where we've donated over 300 hours of IT services to nonprofits. So if you've volunteered, can you stand up? I didn't tell them I was going to do that, so— So I want to talk about why we do this. I think this group's found meaning as we've gone along, and just through some of the stories of the things that have happened. Connecting people changes lives, and here are a few of the people that we've really impacted. There have been people that have been out of work and had their houses foreclosed upon, and people have pitched in to help them find opportunities in a short amount of time. We've also had a soldier from Kansas City that was deployed in Iraq who joined the group, and now he's back in Kansas City and, you know, We're all here tonight for the same reason too. We would not all be here because of this group. So I've just learned some really good lessons. You know, constraints aren't a limitation, they're an opportunity. So if you take a look at people in history that have done things like the Wright brothers, who overcame all odds. There are people that were funded, you know, trying to figure out this problem of flight. But these guys did it because they got people to believe in them and they got them to help, you know, So they didn't have these resources and they found a way to make it happen. So that's one thing that you need to do when you have your idea. And then don't fear failure, fear regret. And I don't know if you guys know this caricature, but he's the honey badger. And it's all about not fearing, just doing the things that you want to do and not fearing failure. Regretting the outcome. I would have never, a month ago even, I would have never gotten in front of this many people to talk, but I believe in this idea enough and it's gotta happen. And then I want to thank our sponsors. We basically turned this event around in around 4 weeks. Found out that Enrique Salem is coming in on this date and we basically have had people jump in to support us. And I want to thank all of these people. And I, you know, go to our website, you can see all the sponsor logos. These are the people that you need to take a look at in terms of business or in terms of working for them. So our sponsors like definitely like deserve a round of applause for supporting this community. At this point, I want to turn it over to Dr. Calloway. Mr. President of Johnson County Community College. Thank you.

Welcome. Welcome. [FOREIGN LANGUAGE] Good to see you all here this evening. Welcome to Johnson County Community College, and we're very, very proud to have you sitting in the midst of our Nerman Museum of Contemporary Art, one of the top 10 museums of contemporary art around the country on a college or university campus. It's a great place. Hopefully you'll have a chance to walk around and visit. But you also had your reception today in our Ranier Center Atrium, which is our college's initiative related to workforce development, economic development, business partnerships and the like. And it's truly a place where we think that business has the opportunity to work with business and education. And we really appreciate the opportunity we have to work with all of you, with the Kansas City IT Professionals Group, and certainly Mike and all the folks in the room here to provide great programs like the one we have this evening. I have a very, very special honor this evening, first to welcome you, and then secondly to introduce our guest speaker, our keynote speaker this evening, who will, I know, be just a pleasure to hear from with great information. I've had the chance to sit with Enrique Salem for about, oh, 10 or 15 minutes, and one of the things that I very quickly learned about the man is, the nature of him as a person. He's a very, very humble individual. His resume is about 15 pages long, and he asked me to be very brief and be seated, and I said I can do that too, so that we can get started on with some of the really important messages that he has to share. But there are some really important things about Enrique Salem that— Salem, I'm sorry, Enrique Salem— that I would like to share with you. And one is, of course, as you know, he's the President and Chief Executive Officer of Symantec, which is really truly the global leader in system security and just one of those companies that we all enjoy working with and having the opportunity to partner with, all of us, I'm sure, in this room. His career has been broad-based, but when I asked him what— how he'd like me to introduce him, he said, please introduce me as a serial entrepreneur. He's a man who truly understands business and what business needs to be successful. And I know he'll be talking a little bit about some of those things this evening. He was recognized by Ernst Young as the Entrepreneur of the Year. He was also received the Estrella Award from the Hispanic IT Executive Council, which recognizes individuals for achievements in the IT industry. I think that speaks so much to him as both a person and a man where You know, these very, very important and prestigious awards are things that he just wanted to kind of pass over. He is truly one of the industry leaders. He's one of the people who's been involved in helping us all drive new ideas and new opportunities throughout our country and throughout the world. They truly are the global leader, and we're very, very honored to have Enrique Salem with us today at Johnson County Community College and here with the Kansas City IT Professionals. Enrique, Welcome to Johnson County Community College, to our community, to Kansas City, and we look forward to hearing all you have to say.

Fantastic.

Please give him a round of applause.

Thank you very much. That's a great introduction. Thank you. Thank you. Thank you. That's a great introduction. And the reason my resume is 15 pages long is because I can't hold a job. I've done, as you just heard, I've had the opportunity to do a lot of startups and Quite frankly, even though I run a $7 billion company, I tell our employees every day, I want us to act like a startup. And that's what's important to me, is because startups is where a lot of great innovation happens. And so that's what we want to be about. I put up a— I'll just start with something here real quick. Probably most of you have one of these, something like this. Yes? Yes. Yes, we do. How many of you have lost one? I have. Yeah, most of you have 2. And so we did a little experiment the other day where we went out and we lost 50 of them. We literally would go to malls and we would just set them down just to kind of see what people would do. And invariably, a few times as we set them down, people would come over and say, "Hey, you forgot your cell phone." And we were actually trying to leave them behind to see what people would do. Because what we did on these cell phones was we actually put some tracking software. So we put on some business applications, we put some personal data, and then we also put some things that would let us see what people would do. 89% of the phones that were taken, people accessed the personal information on the phone when they picked it up. 83% of the phones, they accessed the corporate information that was on the phone. And so this world is changing, right? Every day there are more and more smart devices that are being put into the marketplace. In December of last year, there were more smartphones sold than computers. And we'll do more and more of what— our work on these devices every day. And so that creates a whole new set of opportunities. You know, we talk about the Google project, the Google Fiber project. I think that's a great opportunity. I think it will create tremendous new business opportunities right here. And I know that the— where the border is, you know, I kind of know where the county line ends or where they wired and not wired. It doesn't actually matter because you can do all the innovation right here. You can still work on these new exciting projects that take advantage of that broadband. And if this works, I think you'll see lots of new companies right here in town that will spring up as a result of this new connectivity. I've been in technology or working around technology since the mid-'80s. Started my career in financial services. And, you know, I learned a few lessons at that time about what the importance of security is. Why is security so important? You know, when you deal with a big bank that has on any given day $10, $15 billion of fund transfers, you quickly realize how important security is. But what really got me excited about security was when I started working for a guy named Peter Norton. I was Peter's 8th software developer, and he hired me to work on a project called Norton Utilities. Some of you may, may have heard of Norton Utilities. And then he realized that while utilities was interesting, there was all these new threats coming in. And these new threats were moving on floppy disks. I don't know the last time any of you saw a floppy disk. It's been a while. And he realized that this would be a big problem, that it would change, that bad people would try to use computers to come right after individuals, small businesses, in governments. And Peter was right. A little later in my career, I had a chance to start a company that was in the email security space. And this is really what got me excited about doing what I do. I was at my daughter's back-to-school night, and I walked in and I said hello to people. How are you? Enrique, good to meet you. And next person I said that to, hi, how are you, Enrique? Good to meet you. He said to me, she said to me, so what is it you do? And I said, well, I work for this small little company that's in the email security space. And she kind of looked at me, she kind of used email. I said, well, we're trying to get rid of all the spam in the world. And she looked at me and she said, God bless you. And so, So that's what— that's why we do what we do at Symantec, because there's a lot of bad people out there who will steal that cell phone, or who will send you spam, or who will try to break into your network, or who will try and steal your identity. And so our job is to protect you and your information. And by the way, that gets people excited. When I talk and try to recruit an engineer to our company, and I say, do you want to do something that is meaningful to changing how people use computers? Yes. You're hired. So the point is we're doing something that I think has a very positive impact on everybody's life and everybody's business. But today we're in a special time because in those 30, 35 years that I've been thinking about technology, we're going to see more change in the next 5 in 5 years than we've ever seen before. Last time we saw this much change was when the PC hit the marketplace. When PCs first hit the marketplace, everybody thought they were gonna be toys. That they wouldn't really be that useful. Today, while we're moving in what I call the post-PC era, PCs are a central part of everything individuals, small businesses, large companies, and governments do. We're at that same point now. There are some changes happening that I fundamentally believe will change everybody's life. I'll give you a couple examples. We do a lot of studying, not just the local short-term trends, but we think about the really long-term trends. What happens in 10 years, right? Because when you look at a big company, You got to be thinking about what is going to be meaningful, not next year and the following year, but 10 years out. And so one of the studies we did was we were working to understand what we call the digital native generation. Digital natives are teenagers today. How do they work? How do they think? What are the things they care about? How do they want to communicate? And so the first thing that you quickly realize is digital natives, they don't use email the way we do. Quite frankly, if they have an email address, they probably rarely check it. When they want to solve a problem, they reach out to their network and they collaborate. Right, they have a large number of resources that they want to figure out if they want to see a movie. They don't go read the newspaper. They may not even check a website. They just say, what do you think? And they reach out to the network. And often when they do that, they find faster and better ways to do things, to solve problems, to get information. When you look at how folks who are graduating from college right now that live in a city, they don't have a landline at home. They just use their mobile phone. Quite frankly, I don't use my desktop phone anymore. I got this fancy, and this is not a dig at Cisco, they're a great company, but that nice Cisco phone on my desk. I don't use it anymore. Because if today I talk to one of you and you say, "Hey, give me a call," and I put you into my cell phone, I'm gonna call you from this device. I'm not gonna go over to my desk phone, pick it up, and dial it. And so what we're trying to understand is how are these behaviors changing? Email is gonna be a thing of the past. We will collaborate completely differently. Now, there's another side to it. 'cause I actually have a 15-year-old named Mariel and I have a 10-year-old son named Chris. And Mariel today, when she interacts, the other night we were at dinner, we're sitting there at dinner and she sits to my left and as we're sitting there, she finishes, she's a quick, I chat with everybody else and she's kind of done and she's on her iPhone and she starts banging away on her iPhone. I said, Meryl, what are you doing? She said, I'm just updating Facebook. I said, Meryl, people don't care that you had mashed potatoes. That's not interesting. But you know what, she is constantly connected, so I've had to talk to her about saying, Meryl, you can't tell people when we're out of town. That's not a good thing because people will now know, people will now be able to say, oh, maybe we should go over to the Salems' home. Right? She can't put her pet's name online because she has a little dog, because the answer to one of her secret questions is going to be her pet's name. And there is so much information available about people that that makes everybody a target. Makes every single individual a target. Because at a business, I can't keep you from talking about yourself. You can say anything you want. I tell people all the time, I'm an avid cyclist, I love to ride my bike. You probably say things about yourselves, things you enjoy, hobbies. I could construct a profile, I guarantee you, on everybody in this room within 5 to 10 minutes without really working that hard, without doing anything illegal. And a criminal armed with that information can then easily create a handcrafted message that goes right to you, and you're pretty likely to respond. I could spend the rest of the afternoon or the rest of the evening talking about how targeted these threats are, and I'll just give you an example. We were working with a big company the other day where the CEO, and the company had just finished an acquisition. It's pretty common, right? Companies acquire other companies all the time. They put out a press release when the deal closes, right? Company A has just bought Company B. Everybody sees that. So the CEO of this company, Company A, big company, got a message. And the message said, "This is a message from the IRS. We saw that you bought this company. We want to make sure that you've appropriately accounted for it and are going to pay taxes appropriately." Handcrafted, everything was spelled correctly, they had the right information. And so what does he do? He says, "Oh, this could be legitimate." And so he sends it to the CFO, who sends it to the head of tax. In that process of going from the CEO to the CFO to the head of tax, it immediately gained tremendous credibility. Right, because everybody said, "Oh, you know, it must be legitimate." As soon as they clicked on the link, they basically made themselves vulnerable. And now the attacker was inside. They call us up and they say, "Help us. Help us clean this up." But once they are inside, part of the challenge is how do you really know you have cleaned it out completely? And so we get this call numerous times a week, big companies who have been hit because there is so much information about individuals, about businesses, that they can come right after you. And so one of the big areas that is changing is this notion of threats. I told you the story about when I worked for Peter, threats come in on a floppy disk. Well, now threats are highly targeted and customized to you or your business. And so our job is to figure out how do we deal with that. Second thing that is changing is I remember the first time I got this device. This is a— yes, you might consider me a dinosaur. This thing is an iPad 1. [Speaker:ERIC SCHMIDT] I know. Maybe someday. So when you look at this device, I got this pretty much when the 3G version came out. So I've had it pretty much from day one. And first time I got it, I went in and I said to our CIO, I said, you know, I'd like to use this for corporate information. I want to start getting my email on it. I want to put my PowerPoints on it. I want to get our— I want everything. It's because I got this BlackBerry in my pocket. And when somebody sends me a spreadsheet, it's useless on this device. While when I put it on this device, no problem, right? I could read it, no problem. So David looks at me and he says, okay, well, Enrique, there's a few issues with that. And you probably will quickly gather the way you get into this job is you're really patient. And so I said, David, explain to me. And he says, well, I got to change the firewall, I got to do this, I got to do that, I'm not sure I can secure it in these ways, I'm not sure I want this information. And I said to David, David, I just want you to look at the org chart. I don't use that card often. But— and so one of the biggest changes that's happened in our industry is this notion of what we call consumerization. Right, the technologies that you use at home were quickly becoming better than the technologies you had in the office. And so you started saying, I want to bring those technologies into my office and I want to start using them. Whatever they are. And so this notion of consumerization is putting a lot of pressure on IT. It is putting— it is making IT have to think very differently. I've been, as I said, in security, and historically the security people were the people who said no. All the reasons why you can't do something. And so we got to change that. We absolutely have to change that because this notion of consumerization is going to transform how we think about IT. I draw a picture, and usually I don't use PowerPoint, PowerPoint slides. But I draw this picture that says on one axis, corporate-owned device, and then personal-owned. So imagine a 2x2, just a kind of a 2x2. And then on the other axis, the data is in your data center inside the four walls of your business that you have complete control over, or at least you believe you do. And the data is in a public cloud-based service outside. And so I go around and I ask chief information security officers, and I ask CIOs, where do they think they are going to be in 2 years on that matrix? Where do they think they are going to be in 5 years? Most people will tell you that in the next 5 years they expect the devices they are using in their business to be personally owned. It is not, you know, the company issues you a laptop and you use that device. So you will see, I believe that Again, it's a majority, 70, 80% believe that. When you look at where the data will reside, a lot of people believe that a lot of their employee data, customer data, intellectual property will still be inside their firewall, but some other information will start moving outside. And so this notion of consumerization starts putting a lot of pressure on IT. I talk to CIOs and they tell me, I say, how many cloud-based services, public cloud-based services, meaning outside your firewall, do you think are used today by your employees? Most of them will say, I don't know. And that's an honest person. Because any of us today can easily go and use some external service and use it as part of our business. It's part of doing our job. By the way, we're not doing it maliciously. We're actually doing it because we want to do our jobs better. But what ends up happening is the CIO, the IT team has no control over that. Probably in this room there's people who use, you know, when I got this thing, first thing I did to move files around is I started using a thing called Dropbox. Probably some of you have used it. About 5 months ago, all the passwords, all the credentials, all the access controls were disabled. And so everybody had access to all your data. So if you're a CIO, you do not want your corporate information out on Dropbox. And I'm not trying to take a dig at them. I use it. It's a nice little service. But I'm not going to put really confidential information up there. No way. Because we don't have enough control. So this notion of cloud is going to change how we do things, not only because where we're storing the information, but it's also gonna change who makes decisions. And I'll give you an example. I was just with a big company. Their head of HR said, "We used to use an internal HR system on-premise. We've decided to go to a third party called Workday." They're a new company that's doing hosted cloud-based HR. And we decided to move to it. IT didn't decide to do that. The line of business decided to do that. And so one of the things we have to think about is where decisions are made on technology will not necessarily be where they traditionally have been made. And so that will create a new shift. So these are some of the changes that I see happening every day, right, consumerization, cloud computing, this notion of threats being more targeted than ever. But all is not lost. You know the story about our job is to eliminate all the spam in the world? Well, our job is to make it possible for people to say yes. How do we make IT be successful, not reactive? And so what we've kind of thought about is what is it that matters? What is it people are coming after? What do the bad guys want to steal? Why can't I use my iPad on raw corporate data? Well, the reason is because we need to have better control of our information, of the content, of the intellectual property. See, 'cause at the end of the day, the device is irrelevant. Who cares if I have an Android device today or an iPhone tomorrow or a Kindle Fire or something we haven't even dreamt up? Who cares? That's not what it's about. It's about my data. It's about my stuff. It's about the pictures I've taken of my kids. I want to— I'm not— my daughter is never going to be 10 again. So my personal things, I want to be able to keep them. My corporate things, I want them to be secure. And so what Symantec thinks about is it's about the information. That's the secret ingredient that matters. It's about protecting you. When you go online. And so across these trends, that's what I want you to think about is how do you create something that, quite frankly, you can have a big positive impact on everybody who uses technology. And I think from a— you know, I mentioned I— we said in the introduction, I love being an entrepreneur. I love thinking up new ideas. I love trying to understand when there's discontinuities and when there's changes and when people are afraid. And when there's new interesting things to go do, what can we do that solves a big problem? And I think what you're gonna learn with the local broadband project across the way is there's gonna be a whole new set of big interesting problems to go solve. I think it's gonna create a lot of opportunities in this town, in this city, that will, quite frankly, be a point where I believe you're gonna get a lot of national attention of people trying to see how's it working. What are you learning? And I think it's a great opportunity for this community. I could talk all night long. I just wanted to spend a few minutes to tell you about how the world is changing from our vantage point. I'd love to open it up and take a few questions on anything you want to talk about, business, leadership, my favorite wine, anything at all. So if anybody has any questions for me, I'd love to And Gary, you don't get to ask about my favorite wine. Yeah. I want to ask about your favorite bike. My favorite bike? Sure. Oh, fantastic. All right, so I can tell you bike stories all night long. All right, so I actually ride a Giant TCR SL. It's a reasonable bike, but I cycle to stay sane. Right, when you finish a week at work, And I love what I do. It's what clears my head. And so I ride on a little team. There's about 6 of us and we race all summer long. We do some crazy things. But every year we have this one race we do around Lake Tahoe. It's 72 miles. First year I did it in 2006, it took us 4 hours and 6 minutes. It's not bad. 72 miles, 4,000 feet of climbing. But every year we've improved. We had a goal, you know, we set to improve. And last year we actually set out to break 3 hours. We came in at 3 hours and 2 minutes. So this year we're going to break 3 hours. That's the bike I ride. Yeah. Sorry, you had a question, yes. What about zero-day attacks? Yeah. How are you guys looking at that? [Speaker] What is a zero-day attack? [Speaker] Zero days, yes, so a zero-day attack is something that exploits a vulnerability or has not ever been seen before. So that's our kind of definition, it quickly exploits a vulnerability, gets inside, never been seen before. So what we've had to do is change our model, because we used to be reactive, we used to see an attack, give you a solution. When I started, we used to update our definitions once a quarter. All right, so I'm old. I mean, what can I tell you? We went to once a month, we went to once a week, we went to once a day, we went to once an hour, we went to multiple times an hour, and we couldn't keep up because these zero-day attacks By the time they hit you, it was too late. So what we had to do is we had to invent something new. We had to think about the problem differently. When you think about security, I like to use what I call the 3 I's model. You want it to be invincible, you want it to be invisible, and you want it to be inexpensive. So let's go through what they are. Invincible means as strong as possible. So when we work with the government on a classified network, Their definition of invincible is a pretty high bar. So it's kind of fit for purpose. Number 2 is invisible. I can make things very secure, but I don't want to change how you work. I have to make it invisible to the end user, because if I have to change how they work, they are not going to do it. They are going to disable it. They are going to try to figure out ways around it. And so you want to make it as invisible as possible. The third I is inexpensive. Security doesn't need to be expensive. You have to make it inexpensive to manage. Every time you have what we call a false positive, meaning you make a mistake, you think something is malicious and it's not, it takes a lot of time and work to try and go clean it up. So inexpensive means it's gotta not cost you a lot of money to manage it. So when you ask about zero days, What we've had to do is really think about those 3 I's. We want to be as strong as possible, not change how users work, and not make it expensive. And so we've invented something we call reputation-based security. And reputation-based security is all about knowing the reputation of every application that you're running. So if you download something off the internet, because we've been collecting data from our global intelligence network for about 5, 6 years, we can actually tell what the reputation of that program is. So if somebody writes a custom piece of malware, like that example I gave you with the IRS spoof, that was a custom piece of malware, that will have a low reputation. And so we'll say you shouldn't run it. And so we've had to invent new ways to deal with zero-day attack, 'cause otherwise you weren't protected. We were reacting. And so we had to do some invention, which is part of what's great about this job. Yeah. [FOREIGN LANGUAGE] So the reality is yes and no. And that is not my political answer because I am not a politician, I am an engineer. What we were not surprised by was that there would be a malicious targeted attack on critical infrastructure. That is not surprising. Power and energy, financial services, healthcare, They're all big targets. What we were surprised by was how sophisticated Stuxnet was. If you think about what Stuxnet did, it used zero-day vulnerabilities. It used 3 different zero-day vulnerabilities. Most pieces of malware use 1. It used 7 forms of replication. Most use a couple. How many, actually, maybe I'll describe Stuxnet. Stuxnet, was an attack on the uranium enrichment capabilities of Iran. They attacked what's known as a PLC, it's a programmable logic controller. Most of us don't have those at home, trust me. And so it was one of those attacks that was very sophisticated. What they did was they were going to send messages to centrifuges that were spinning at let's say 3,600 RPMs and make them spin to spin 2 times or 3 times as fast. And in that process, they actually recorded the normal readings of a centrifuge. They recorded that, and so after they sent the command, they played it back. So if somebody was monitoring it, they wouldn't be able to tell that something was wrong. The second thing they did was— because you'd probably hear the— noise from the centrifuges, they disabled the kill switch. So if you went to shut them off, you couldn't shut it off. And so ultimately, that's what was surprising about the Stuxnet, was the level of sophistication that they were able to achieve to go after that infrastructure. I will tell you, my expectation is that will keep happening. We saw Dooku, who names this stuff, I don't know. But Dooku is a variant of Stuxnet, and instead of bringing something down, it was just doing intelligence or reconnaissance. And so we expect to see a lot more attacks on critical infrastructure.

I just wonder where you see Symantec or anybody going to the protect me model, because I see what you're saying about the next 5 years, but everything Everything we have, from my toaster to my car, is going to be susceptible.

The car has everything that stuff can attack. Absolutely.

It does.

So, and it's the easiest thing to attack.

Skid attacks were around forever.

That's right, in the '80s.

But now I've got, you know, I've got DLP, I've got AV, Yeah.

Okay, then at home I've got my suite and my car. Yep.

So I've got to buy all the— when—

where is the protection in the suite? So when I put this in my car, yeah, it's not this that has a problem, but it's weakness in my car.

When I plug this in my car, now that that is in my car, they retrieve it from my car, but my car updates.

Yeah.

This didn't transfer anything.

The OMP didn't. Yeah, no, you're right. So here's what's interesting. We call this the Internet of Things, right, which is basically everything is going to have an IP address. Part of the reason we went from IPv4 to IPv6 was because we needed to be able to assign IP addresses to everything. I mean, literally everything. You know, my home thermostat. My front door. They all have IP addresses. So you're exactly right. So everything is going to be connected. Everything is going to have an IP address. By the way, don't try to steal my phone because then you can unlock my front door. Gary's over there thinking, "How do I do that?" It's not the wine cellar. So you're absolutely right that Everything is going to be— Did you say steal it from me? I said he's probably updating Twitter. He's like steal— Updating Twitter, all right. I got backup. So by the way, if I was a politician, I'd actually say next question right now and not actually answer the previous one. But no, I am not a politician. So to your point, what we have got to focus on is if everything is going to be connected and we have specific pieces of data about you that need to be protected, let's figure out what they are. Quite frankly, I don't really care if somebody steals my playlist. It doesn't matter. They will know what music I listen to. That is okay. I am not that worried if they figure out what books I read. Not that worried about it. But I am worried about a few things. I don't want them having my passwords to my banks, right, because that is not something I want them to have. I quite frankly don't want them to have my password to iTunes. So there is the key to this protection that you are talking about, about protecting you, is really about protecting what matters to you. What are the things that you can't recreate or could cost you a financial loss? So the key is understanding what is it that really matters to you. Because the reason— some of you remember the WikiLeaks incident, you know, where the information was stolen from a classified network Private Bradley had access to. See, the problem is if you classify everything, nothing is classified. And so to your question, what is it that matters to you? And what are you doing to protect that? And so that's how I want you to think about it. Because otherwise we won't be able to solve it. Because then we'll try to protect everything, we won't win that battle. [Speaker:AUDIENCE] Do you see a day when we'll move to like a private internet, people going and paying for that kind of security? [Speaker:ERIC SCHMIDT] So when I was in my email security company, The protocol for email is called SMTP. And I got asked the question once, so why don't we just upgrade SMTP and make it secure? That's right. Sorry?

[Speaker:AUDIENCE] It won't be simple anymore.

[Speaker:ERIC SCHMIDT] Well, the problem is it's ubiquitous. And so I said— my answer was replacing SMTP with something more secure is like adding 6 inches of road to every street and highway in America. It's not going to happen. And so when you think about this notion of creating a yet other new Internet, very difficult. Because the infrastructure we've built, we love a lot of the characteristics of the current Internet. And so as we try to recreate it, I think you're setting up a pretty complex, difficult problem. Because what I'm going to want is a lot of the things that are on the old internet. And I'm not going to be able to move all of them over because I'll have some new security bars to come over. So I think we've got to deal with what we've got. And we've got to figure out how to make it secure. [SPEAKING SPANISH] So I'm protected. Same thing with Google. I have Paper 2.0, so I'm protected. [Speaker:ERIC SCHMIDT] The bad guys will figure it out. By the way, I'll tell you— and this is not a dig at Apple at all. I think they've done so much great work. I mean, everybody would agree with that. But there's nothing inherently that's going to keep— I've got in my pocket, I glow in the dark because I've got so much stuff in my pocket. But this is a great device. But when I go out on the internet on this device from Safari, there's nothing that's protecting me from somebody having a malicious site. And so while this device has some things that make it a little more secure, and the Apple Store is curated, you know, the App Store is curated unlike the Android Market, which— by the way, the Android Market will have plenty of security controls. It's not— it just can't continue to persist the way it has. This device isn't necessarily more or better. The bad guys will come after it, and they'll figure it out. Yeah, I got time for a couple more questions. Yeah, go ahead. [FOREIGN LANGUAGE] Where does Norton— where does Symantec stand on things like CarrierIQ and data— software that leaks data like that inherently? Well, what do you mean by leaks it inherently? Well, same CarrierIQ is monitoring things like calls that you make, people that you email to, information in those emails, things that you're typing. So if I say, you know, corporate takeover on Thursday, you know, who's How do we stop that kind of information from being transferred to other, not necessarily non-corporate or non-state actors, but to corporate actors? [Speaker:MR. SCHMIDT] Sure. So basically, how do we control the information that matters? I mean, that is really the question, right? I mean, if you think about it, look, I tell banks, I tell banks every day, your customers are going to come to your website from machines that are not necessarily secure. You cannot trust that that device that that user is logging on from doesn't have something stealing keystrokes. [Speaker] You have to assume that they are. [Speaker] You have to assume that they are, and so this is the same thing. You have to assume that somebody is listening to anything you are saying, and so then the question is what protection do you take? Texting isn't maybe being monitored as closely, but you know what, texting isn't ultimately that secure. You have to think about what you do. And so what I think about is inside of our firewall, we're very careful what we communicate. We acquire half a dozen companies a year, sometimes a little more. And so what we do is we're very sensitive that we don't talk about the names. We acquired a company called Nakona on Monday. They do application wrapping for mobile phones. Basically, I won't get into it. It's— unless you really want me to. No. It basically is a way of protecting mobile applications. But when we acquired it, we didn't talk about the company name. We never said it was Nakona, right? We called it Arial. Because we know that I might be sitting here next to you talking to you about the project, and I don't want the guy behind you knowing we're doing that deal. Now, it's a small deal, but we take lots of precautions, and we think about— assume that somebody's listening. And so if it really matters, take some other precautions. You know, the banks, I tell them, if you are really going to have individuals logging on and doing fund transfers all the time, you better get something better than a static password system. Because by the way, I would be willing to bet if I went around this room and I asked each of you to tell me The password you use to log on to your email at work, you know, your username and password, not username, your password. I could use that password and go out across the internet knowing your name. Okay, maybe not everybody, maybe not everybody. [FOREIGN LANGUAGE] But I would bet you most of you, some individuals not, I could use that password and get onto a few other sites. It's human behavior. Look, trust me, you can't remember them all. I mean, if somebody is— there are password managers, but trust me, we have done some tests. I could put up 10 PINs, 10 PINs that 40% of the people are using today. 1234, 9999. So I would just tell you we have to be careful. So to your question, the main point is know that somebody's listening and you better take precautions if it really matters. Alright, last question. Right here in the front row. [Speaker:AUDIENCE MEMBER] So we've kind of seen a change in the attack vectors over time, right? So in your crystal ball, I kind of wonder what Symantec sees the attack vectors looking like in 5 and 10 years, right? So right now we're seeing not necessarily network-based attacks we're seeing more application type stuff, right? I want to see what do you guys think 5, 10 years looks like. Yeah, [Speaker:ENRIQUE SALEM] well the first thing you want to think about is we didn't talk a lot about what we call an advanced persistent threat, but basically just assume the attacker is patient. Just assume that they are willing to spend a lot of time to get something they want. And so that is the first thing you got to think about. That we believe is not gonna change for the foreseeable future. One of the areas that we are focused on, though, is malicious apps. If you go out on the Android Market today and you look for Bank of America, you used to be able to find 2 or 3 apps that claimed to be from Bank of America, and they weren't. And so I think as long as we've got these small micro apps that are being put on devices— Windows, mobile, Android— Apple devices, that will be a target-rich environment. And we expect that to continue for the foreseeable future, because that's where the world is headed, at least for the short term. HTML5, you know, we've tried to do some things to make it more secure. That's the next way we're gonna write applications, do website content. But I expect that to also be compromised in the target. Those are some of the things that we see. Well, look, I appreciate the opportunity to spend a little bit of time with you. You've got an exciting— Exciting, exciting set of things happening here in Kansas City. Lots of great opportunities. And I really appreciated having this chance to spend a little time with you. Thank you very much.