RSA Conference 2011 Keynote - Letting Go and Keeping Control: Beyond the PC and Data Center

Good morning. This is my third opportunity to be a keynote speaker here at RSA, and I got a little ways to go to catch up to Art, but I'm coming after you, Art. What I want to do is I want to take you back in time a little bit on a visit to a day a little bit in the past. We're going to go way back to July 13th, 2010. For avid cyclists like myself, it was a day wondering how Lance Armstrong would do in the Tour de France after another vicious crash. For math geeks and puzzle lovers, July 13th was a day celebrating the birthday of Ernő Rubik, the creator of the Rubik's Cube. It was also day 85 of that tragic oil spill in in the Gulf. But the biggest story that mattered to most of the people in this room wasn't making headlines or even national news. Yet for the global security community, July 13th would prove to be a very significant day. Because it was on that day that we got the first word from an infected computer in the Ukraine that a new attack was spreading. That attack would soon be known as Stuxnet. At first glance, everything about it was suspicious. How and where it exploited the host, its sheer size, it was a half megabyte of pure code. It contained SCADA strings. It also had a very unusual geographic distribution. So what did we do? We immediately took action. We did two things. One, we reverse engineered it. We tried to figure out how it was working, what it was doing, what it was trying to get accomplished. And the second thing we did is we figured out where its command and control servers were. One was in Denmark and the other was in Malaysia. And we click— quickly were able to redirect them to a controlled server at Symantec's Dublin facility. What did that do? It gave us unique visibility into what the attack was doing. We quickly found that there was over 100,000 infected machines. And what we did is we started helping those companies, whether they were our customers or not. As you know, every day there are over 2 million different attacks. And so it takes a real skill to be able to figure out what are the real threats and what are the ones that we don't have to pay as much attention to. That's something that we excel at, differentiating between real malicious attacks and ones that aren't. And Stuxnet was clearly very, very significant. So what was it like? Malware that has one, or exploits one, zero-day vulnerability, That's meaningful. Stuxnet used 4. That's unprecedented. At Symantec, we helped uncover 3 of those 4, and what we saw was it had 2 PLC-specific vulnerabilities. The first one was a piece of malcode that was hiding, uh, STL code that basically allowed you to take over the industrial control system. And the other was the first ever PLC rootkit that was hiding that STL code. It also used 2 stolen certificates to sign its files, another first. It also had 7 forms of replication. Most malware has 1 or 2, it had 7, so this was an unprecedented type of attack. The other thing that it did is it combined these characteristics in a very special way to create a weapon that was very sophisticated, it was elaborate, and it was meant to destroy. When you look at Stuxnet, it will be remembered as the attack that moved the game from espionage to sabotage. It was the first virtual weapon that was designed to do physical destruction. So what, what did Stuxnet do? How did it work? Well, the first thing is, It basically took control of a programmable industrial controller just like this one. As it took control of it, what it did is it triggered a series of events in a very specific set of uranium enrichment centrifuges in a very specific set of facilities in Iran, and it forced them to spin at very high speeds where they literally destroyed the— themselves. So now you wonder, how could that happen in a very secure, well-monitored facility? And that's because Stuxnet used the first rule of the art of war. It used deception. It recorded normal operation of the centrifuges and then it played them back. So it's like a scene from a bank robbery movie where the guards are watching the fake tapes as the robbery is going on. But you also think that at some point the noise would have alerted the people on duty that something was wrong. But what we know is that Stuxnet also had the ability to disable the kill switch. Remember, this is a sophisticated, elaborate, and meant-to-destroy attack. Now, what was the impact? What we've seen is that Stuxnet took out as much as 1/5 of the nuclear centrifuges in Iran. That set back the development several years. What we've also come to understand is that Stuxnet is something that we have been expecting for a number of years as security professionals, but now we've seen it, and it has very, very profound implications for us. Now, SCADA attacks are not new. If you might recall the attack in, uh, Siberia where compromised industrial control system caused an explosion of a specific natural gas pipeline. But now imagine that the attack wasn't the uranium enrichment centrifuges, but that its purpose was to cause an explosion. In France, in Japan, or even here in California. Imagine now that criminals and zealots can reach out across cyberspace and wreak real physical damage, not just attacking your information, but actually destroying physical property. This is a real threat to our economy, to our prosperity, and to our lives. But whatever the target, And however successful Stuxnet was, what we now know is what it was capable of. And what it creates is a starting point for other attackers. They'll follow in what Stuxnet has done. And so this is a brave new world, and we at Symantec, we take this very, very seriously. As we think about our role as the largest security company in the world, we're engaged in helping individuals, companies, governments that rely on us every day to help us keep their information, their infrastructure, and their interactions secure. But more dangerous attacks, more targeted attacks, more lethal attacks are just one of the many trends that security professionals have to deal with every day. And it's causing a change in the landscape. For many years, on stages just like this, many of us have talked about another big trend, the notion of consumerization. What we're seeing is in the workplace every day, consumers are bringing new technologies, their habits, the way they interact, and we're also seeing a lot of this change is being driven by a massive proliferation of mobile devices. They're programmed to access data. Sometimes that's authorized and sometimes it's not. They're using social media sites. Increasingly, social media sites are being accessed from inside your environment, and that trend is just going to increase. We're also seeing a massive data explosion. Data, information, backups are growing at as much as 52% year over year. We're also seeing analyst reports that say by 2015, virtualization will represent as much as 60 to 70% of all servers. And of course, there's the move to the cloud, both private clouds and public clouds. And we'll talk a little bit more about those implications. But just like the technical specs of Stuxnet are meaningful, all these trends, when you bring them together, what they do is they combine and they suggest, like the uranium enrichment centrifuges, that things are starting to spin a little bit out of control. It wasn't that long ago that you as security professionals and IT professionals had control. You had control of the desktop, you had control of the database, you had control of the applications, the servers, and to some extent, you even had control of the users. Computing was done inside of your four walls. The four walls of your office, you had control of your environment, You made all the rules. But now what's happening is those days are over. Because all kinds of devices are coming into your office— USB drives, notebooks. And many of them aren't your devices. They're your partners. They're people that work with you. They're bringing them into your environment. And what are they doing? They're accessing corporate email. They're logging on to their Facebook page, their Twitter account. Social media has overtaken email by both time spent and volume of data. You're seeing that Facebook now has over 620 million users, growing at 51% year over year. Facebook has surpassed Google as the number one destination on the internet. Social has replaced search as the number one reason to go online. And all of these different things create opportunities for people to get inside of your environment. But it doesn't stop there. This year, there'll be more cell phones sold than desktop computers. And these handheld devices, they're connected to the cloud and they're used to access information. The average cell phone use, 70% voice. The average iPhone, 45%, and the rest is data. So this is just the crest of the tsunami that's going to descend on us all as we move into this brave new world. Mobile traffic is expected to increase 4,000% in the next 3 years. That's 4,000%. Soon, millions of people will have their smartphone as the number one way that they connect to the cloud or to a virtual environment. All of these entry points, all of these endpoints need to be protected. And one of the things that's making matters worse that we know in the security industry is that a lot of the attacks are what we call micro distribution. That means 75% of the attacks we've seen over the last year only targeted 50 computers or less. And so what that means is that we need a new approach. We need to change how we work. The idea of a blacklisting approach is no longer going to be effective. And the idea of IP-based reputation, where we track the IP addresses, is not good enough. You need real-time contextual tracking that looks at a series of attributes, that looks at things like file age, download source, file prevalence, and brings those all together. Today we're announcing Symantec Endpoint Protection 12 that's in beta. And it'll be the only reputation-based solution that is context-aware. We have 175 million endpoints that are giving us telemetry on 2.5 billion files. And what do we do? We combine all that information into a score that gives you a safety rating. As the files are moving across the internet, we can continue to track them. And what does it allow us to do? It allows you to know what's good, what's bad. No one else is doing this today. Now the proliferation of air endpoints is causing something else to happen. It's causing the walls to fall off your data centers. Key information and applications no longer sit inside of your data center. Processing is happening everywhere. Applications that once existed in your data center are no longer just in your data center. Just contained inside of those four walls. The information is being accessed from planes, from trains, from automobiles, from bars, from beaches, everywhere. Key information and applications no longer just reside inside of your data center under your control. And so we have to come up with a way to manage and protect the people and the information regardless of the device and regardless of the location. So what do we have to do? We have to change. We have to adapt. And change is hard. You know, we've all been doing this for a while, and what we know is that something that challenges conventional thinking is sometimes hard to embrace. A lot of people will say, "No, as that change happens, it's not for me. It doesn't affect me." I know you've heard that in your offices many times, where somebody talks about a new idea and there's a bit of resistance. But this is a time for change. And how do we do that? How do we adapt where the information that we deal with is passing through all of these devices, where it's being stored, it's being accessed from devices that are connected to the cloud, and so we have to change. At Symantec, we're no stranger to the cloud. Today, we back up over 60 petabytes of customer data in the cloud. We protect 7 billion emails every day in the cloud. We protect 5 million identities. The largest clouds in the world— Amazon, eBay, and many others— use our security technology to protect themselves. Our DLP technology protects both private and public clouds around the world. So how can we help? How do we create a safer environment for your information, your interactions, and for your people? Well, we do it in two ways. First, we do it by providing you services from the cloud. We deliver a set of premium services as, as delivered from the cloud as DLP, encryption, message filtering, backup, recovery, and a whole host of other services. We're calling this initiative Symantec.cloud. The second is delivering security for the cloud. But we need a new approach for protecting the cloud. And why this new approach? Well, the reason is the following. You can have chip-level security, but there'll be a hack for that. You can have security from the device, but there'll be a hack for that too. You can have operating system security, but there'll be a hack for that. You can have security in your network, but there'll also be a hack for that. Maybe you can build in security into your uranium enrichment facility, but what we know is there's a hack for that too. And so what this requires is a different approach to taking control. So how do we gain control? We have control when we set the rules. In IT, rules are policies, and that gives us governance. But are rules and policies enough? I would say absolutely not. You also have to have visibility, because it is visibility that gives you control of what's happening. That lets you know if the rules are actually being enforced. Are the policies deployed? Do you actually know exactly what's happening in your environment? The other piece that we need is the ability to audit. We need to be able to then report out of what's happened. Did the things we expected actually happen? And that's what allows us to have an auditing capability that delivers compliance. Now there's 3 things. You have to have governance, you have to have protection, and you have to have visibility. When you combine these 3 things together, You get control, confidence, and trust. Now, how do we achieve this? Well, we spend a lot of time talking about the cloud, and so maybe I can use a metaphor that maybe pokes a little fun, but is how I think it works. And so the cloud historically has been a bit of a gimmick, maybe an analyst for people to describe a set of services, maybe a, a cute graphic. But let's think about it this way. What is the layer above the clouds? The ozone. The ozone shields the Earth from the harmful elements and the sun's rays. It's made up of 3 oxygen molecules. And so what we're introducing today is a concept we call at Symantec O3. All right, this is where we let the engineers get too close to marketing. Shouldn't have done that. Shouldn't have done that. OK, note to self. We'll make sure that doesn't happen again. Now what's the goal of this layer? The goal of this layer is really to look at it in 3 distinct pieces. Because if you're dealing with the borderless enterprise, as I described earlier, where devices are everywhere, people are everywhere, information is everywhere, you have to have 3 very distinct layers. The first layer is a policy engine. It basically is a set of rules, a rules engine that allows you to enforce what people, what device, what information should be accessed from where. It's important to note that what we're doing is we're thinking about it in this way. Let's use your existing legacy identities and passwords and credentials to allow you to access not only corporate resources, but to access that social media site, to access that e-commerce site. Because when I talk to our customers, what they tell me is, as they move to the cloud, they're saying, "I'm going back to the same problems I had inside of my own environment. I'm now dealing with the same issues." And so our goal is to bring this together, to create a set of rules that allows you to know what information should be allowed to be transported from where, and to what point. The second layer is a protection layer. Here's where you start authenticating. What employees and what devices should be able to access what information? Is this identity correct? Is this one of the devices we allow in our environment? Is this operating system trusted? Does it have the latest security technology? Is it up to date? Are the access rights correct? And so the second layer is about enforcing protection. And the third layer is the compliance layer. What you need is the ability to have access and understanding of what policies are being enforced. It lets you document and report on everything that's happening. It's a business intelligence platform for the purpose of managing and reporting. It works across platforms, across operating systems, and across devices. It gives you the insight you need to be able to know if your environment is indeed secure. So that's how we regain control. You need a policy engine, you need a protection layer, you need a monitoring layer. That's, that's our approach. That's our vision for what has to be done. It has to be a layer above the clouds. And so we called that O3 because we felt there had to be a unifying force that brought together the different services you're using externally and the services that you're using internally. Ultimately, this is something that we're developing, and it's our approach, but we think that it's important across anybody's implementation, 'cause it's policy, protection, and monitoring. So what I'd like to do is just review for a moment. What we saw in Stuxnet was something that was more sophisticated, more dangerous, and more prevalent. Than any of the things we'd seen previously. Our expectation as security professionals has been that the attacks will become more targeted. They'll come right after each of your businesses, they'll come after you individually, and there's so much more information about everybody online today that the attacks can absolutely be more targeted. But the most dangerous attacks are those that are now starting to target critical infrastructure. And so at Symantec, we're working with the largest industrial control system manufacturers to deliver a new set of security capabilities, and that work includes work we're now doing with Siemens. Let's also not forget one of the biggest news events of this year, which was WikiLeaks, where damage can be caused not just by a well-meaning insider that makes a mistake, but more dangerous is a disgruntled employee, vendor, or partner who decides that they have access to the critical information inside of your organization, and they feel they have almost a right to do what they want. And so we can't forget, we have to know what information needs to be protected. It's a brave new world. What we're seeing is devices are more prevalent than PCs. The walls have come off the data center. We're moving very quickly to the cloud. The old approach that we've been using isn't gonna work going forward. We need to embrace the change. We need to think about what are the new solutions. And so what I've done is outlined what I think all security providers need to think about. We all have the responsibility to deliver these solutions to you. I discussed our approach, but any approach must address security, it must address policy, it must address governance, it must address auditing. This is something you should all demand from us, because these are the solutions that you're going to need going forward. But never forget that we're in this together, because Stuxnet or whatever is next, is still out there waiting for all of us. Thank you very much. Thank you.