User Risk Prediction, Is There Such A Crystal Ball?

Action.

Action. Hello everyone and welcome to Top Secret.

Yes.

Where we talk all about insider threats and intelligence. Today's discussion is going to be somewhat different. We've got my co host, Sean Free and we've got a special guest, Mo Ku from dtech Systems. Welcome my friend. Before we dive into the key of the, the message that we want to talk to regarding predictions, what we want to start off with is if we go and step a few step backwards. Mo, can you give us a little bit of a background of who you are, what is dtex all about and we can take it from there.

Yeah, for sure. Well, thanks, thanks for having me, Boaz. Sean, great to be here with you guys. So I'm, my name is Mo. I'm one of the founders and, and I'm the CTO for DTECH Systems. You know, it's a, a company we founded here in, in Adelaide in Australia many, many years ago at a time when it was very difficult to be a startup company in Australia in, in the tech, in the tech space. And so we pretty quickly moved the company to, to London and that's kind of where we really grew it. And, and our focus was always right from the beginning, being able to provide a completely different data set. We were starting to see even back then the early security operations centers and the early security operations teams were struggling with too much noisy data to try and make decisions with either risk based decisions or decisions around security and how to protect their organizations. And so we realized early on that we needed to do developer a different type of data set which was clean at source, eliminates the noise. And then therefore you don't have to rely on the buzzwords of today like artificial intelligence and machine learning. If you've got the right data, if it's clean and if it's well structured, then that's at least 70% of the battle because you should be able to deliver most of the use cases that a security team needs with basic statistical analysis if you've got the right data to start off with. And I think there's a, there's a lot of organizations out there. You might have seen the news about our new partnership with Splunk come out today where everyone's starting to realize that garbage in, garbage out story. Right? Which is really fairly logical. Correct. But it's taking the industry a very, very long time to realize that, you know, you can't take crappy data and then put it in some whiz bang engine and get gold out the other side. That's just doesn't make sense from a physical perspective. Right. So, so anyway, we, we, we spent a lot of time in, in London and so because of our, our background in Europe, we've taken a quite a different approach to most other security vendors in that privacy has always been a big part of what we do and what we have to be sensitive to. So we've always kind of, you know, it's a bit of a passion of mine where you get, you know, security and privacy, where you get overlap between security and privacy, that, that intersection is actually where you get safety. And so early on we kind of developed this notion that actually cyber security is really should always be seen as just an extension of occupational health and safety. Right. It's no different. Right. And if you, and if you, if you see it that way and you respect your employees, you treat them with respect and you're protecting their well being while also protecting the company, then you're going to get the most engaged workforce. And if you have an engaged workforce, that, that's a loyal workforce, then from an insider threat perspective, you're, you're kind of conditioning everyone to be, you know, on the same page and, and looking after each other and looking after the business, looking after the shareholders, looking after the customers. And really that's where you're going to get the best, best results from an enterprise security perspective. And so, so we were, we were in London for, for many years and we kind of grew the business there. But then in 2013, for, for, for those folks that kind of have been around cyber security for, for that kind of time, we'll remember when a company called Mandiant who was the kind of the, you know, always recognized as the early, you know, first responders that you pull in if you've had a breach or if you suspect a breach. And you know, man, it's the one that, so Mandiant and FireEye merged together in the US and then they went IPO in late 2013. And when they did that, it was the biggest IPO of all time in cyber security. And the series A, B and c investors in FireEye exited that business and, and they reached out to us in London and they said we, we think that the next wave in cybersecurity is, is going to be around moving from treating the symptoms to identifying the root cause and treating the root cause to change inherently how cybersecurity is done from a behavior perspective. So understanding the human behavior that is the root cause to bad things happening, whether that be outside infiltrators managing to get into the Network or insiders, whether they be malicious leaking stuff out or accidentally leaking stuff out or accidentally compromising systems, you know, there's always an underlying human behavior that's the root cause. And so in 2014 we moved the headquarters to Silicon Valley and, and those investors jumped on board with us. So we have a lot of the original pre IPO fire IDNA around our board table. So four of the original six FireEye board members and our CEO Bahman Marbod is, was one of the, the key founding engineers at, at FireEye. And so we've always been a very product focused organization rather than a sales focused organization. And, and that's why we decided to bring in barman as our CEO because prior to FireEye he, he was on the founding team for FaceTime Communications which was then acquired by Apple. So always heavily product focused and always focused on the user experience and the customer experience. And so you know, that's, that's the history. And then in 2018, well actually 2016 was the, when I first met the very first cyber security Minister for Australia, Minister Dan T. And it was an interesting encounter because he called, called me up in, in California, his office called me up and, and asked me to come and have a meeting with Minister tn and when I sat down with him he said well the reason I'm reaching out to we, we really need to build the industry, cyber security industry in Australia and we need to build the capability, but we need to stop people like you. And I said Minister, I don't understand what, I don't understand what you mean stop people like me. He said well you know, the ones that actually make a success of it in cyber security, they leave and they, and they take all the IP with them and they take all their best people with them and, and you've done exactly that. You know, what, why, why like, and how do we stop people like you from doing that in the future? And that's when I said yeah, well I, I mean I put it back on him and I said well exactly. If, if we, if we had in Australia a much more mature capital, capital structure and capital economy to build around the entrepreneur, maybe I wouldn't have had to leave to go and find the money. If we had customers, you know, enterprise and government customers that would be more open to helping startup companies, Australian startup companies to test their products and try their products and help shape their products, then why would I leave in the first place? I never wanted to leave Australia. I was forced to leave because no one would support me in the mission that I was on with such a big vision, you know, to do something that's very different. If we don't have that support infrastructure and the mindset of the Australian organizations and the economy and the ecosystem around the entrepreneur doesn't exist, we have to go. And that's been happening for several years. And he said, well, that's very interesting. And so we started a dialogue at that point. And it was then that he introduced me to Stephen Marshall who was then the, he was the opposition leader in, in South Australia. And you know, you know, I engaged with him. We did a few interesting cybersecurity projects and things. I went back to, to, to the US and then in 2018 when Premier Marshall came into office, it was interesting. He called me up and he said, look, would you come, would you come to my, would you come to my house for dinner? I would like to introduce you some people. I was in California, I said of course I'll be there. So I got on a plane, came back home and, and you know, he introduced me to six other entrepreneurs, all from very different backgrounds. You know, one from the space industry, you know, one from the telecommunications industry, one from the media and television industry. And it was really, it was really interesting because he said, look, you know what we're going to do here in South Australia. And for those of you who aren't familiar with South Australia, the economy here suffered for many, many years after the Holden factory shut down. So we were heavily dependent upon motor manufacturing or auto manufacturing here to drive the economy. And when that shut down, lots of people lost their jobs and we had the highest unemployment rate in the country for many, many years. And so when Premier Marshall came in, he said to us, what I want to do is I want to transform the South Australian economy and we're going to do that through entrepreneurship. And so I would like you, the entrepreneurs to tell me how we can, how we can transform it through entrepreneurship. So we, we actually formed a board that right there and then that day he cooked us, he cooked us a three course meal by himself with no help and allowed us to help us ourselves to his cellar, which is a very nice seller. And we proceeded to discuss the topic of entrepreneurship and how we would build an ecosystem around Australian entrepreneurs and particularly South Australian entrepreneurs to help them kind of flourish here. And we bought, set, set up, set about setting up the office of the chief entrepreneur. We appointed a chief entrepreneur, the first ever in South Australia. And, and the first three pillars that we were focused on was defense based and cyber and so, and so that's been a really interesting journey over the last couple of years because, you know, I think the landscape now, what we have here in Australia is very different to when I started the company. We have a supporting infrastructure. We have companies that are willing to invest behind Australian innovations. We are competing on a global scale. And people are starting to realize that our venture capital here is still quite young, but it's maturing quickly. We can do more to accelerate that maturity. But I think we've got a really good opportunity now, not just in cybersecurity, but in tech in general and entrepreneurship in general. So it's an exciting time to be home.

Brilliant. Thanks, Merle. That's great introduction. I think what I find interesting is when you mentioned that the guys from Mandit and Fireeye sort of approached you to look at the problem from the root cause, but has the industry changed? Have the sinking change, or they're still looking at symptoms today.

So the industry, broadly, Boaz, is still addressing symptoms today, but I think it's changing and it's changing from the top down. And what I mean by top down is, you know, typically, typically change in technology kind of goes around the globe in a specific way. You know, by and large. And I'm, I'm generalizing, but by and large, this is a, this is the rule, right? Like, you know, a lot of technology change gets invented on the west coast of the US Right. Silicon Valley is the heart of where a lot of that innovation and, you know, that disruption occurs. And then it takes sort of maybe 12 to 18 months, maybe 24 months to make its way across the US to the east coast, to New York and, you know, past Austin and, you know, now D.C. the D.C. beltway. There's a lot of innovation that happens there too, but it kind of has generally worked its way around there. Then it will makes its way around the globe to Europe, and then it slowly filters down through Asia Pacific and down to Australia. So typically, you know, over the last 20 years or so, Australia has been kind of an adopter of technologies, sort of at least three years behind where it's invented in the west coast, by and large, again, generalization, but by and large, that's the case. Yes, yes. What we're seeing is the shift in cyber security, because cyber security is changing so much and everyone's getting hit so badly in the same way right across the globe that down here now, that that curve of adoption, particularly in cybersecurity, instead of just following the trend and slowly being behind that curve of how it flows around the Globe, we're now starting to accelerate and jump ahead to be on par with where everyone else is. And that's exciting for Australia and I think Covid has helped with that as well because it levels the geographic playing field and enables, enables Australia to be on that level playing field. Whereas before we were so far removed from the bigger markets like the US and Europe, it was always hard for us to compete or to be at that level. Whereas now that playing fields leveled, obviously you have to be prepared to wake up early, like I do, very early and start your day on those time zones. But, but if you're prepared to do that, then you can complete on that level playing field. And, and I think in cyber security, what we're seeing happen right now is a lot of consolidation because no longer can enterprise organizations continue to deploy point solutions to solve point problems. It's, it's, it's too hard to manage, too hard to operate. At the same time, we've learned our lessons from the likes of Symantec and McAfee. You know, where, you know, no one's thinking today that they can have one cyber security vendor that they can rely on for everything. You know, I, I start, I've been starting to hear a lot more that Microsoft is being relied on heavily for a lot of different security things. And you know, well, it's easy and it's cheaper and, and it's, and it's aligned with the CIO and what he's trying to achieve from a cost saving perspective and from an operational perspective. And I get that. And, and I definitely think Microsoft has come leaps and bounds ahead in where, from where they were from a security standpoint. But really that's just the foundational parts of security, right? Absolutely. You should be having Microsoft security stuff that's belt and braces, that's table stakes. You have to absolutely have those baseline things in place. But to say that Microsoft is my cybersecurity strategy, that's a failed strategy. Right. You have to, then you build that, you build that foundation, you make sure you have all those building blocks in place and then you add on top of that, you know, the best of breed solution stack that you need, but not point solution solving point problems more those solutions that work well together seamlessly. And so you look at the end to end stack that you have and build appropriately. And that's what we're seeing as the shift where those organizations that have been doing this for a while and consolidating for a while are starting to get to that point now where they can say, yes. We're not just addressing symptoms after the fact. We're now addressing root cause ahead of the, ahead of time. We call it left of boom, to use a US military term. Right. Because you have to be, you know, otherwise if, if you're after the fact saying, okay, the horse is bolted, here's how it bolted and here's how it event is, here's who was responsible for opening the stable door. That's one thing. You know, three years ago, we were very focused on moving from after the fact to real time. Hey, hey, the horse is bolting. That's too late as well. Like to be able to stick your hand up and say that the horse is bolting, it's going out. The stable door now is gone before you get there. Right. No matter how you react to that. So, so today it's really all about being predictive. So understanding what the root cause behaviors are that lead to bad things, detecting those root cause behaviors and being able to then decide left of boom. How do we want to respond before the breach happens? How do we want to respond before a data leak happens? How do we want to respond before a bit of malware gets dumped on that machine? Because if CrowdStrike stands up and says, hey, you got malware here? Okay, great, if they can contain that and restrict that, perfect. But why did it get there in the first place? Right? That's the big question. Why did we allow that piece of malware to execute on that device? Right? Something allowed it to get in there, some vulnerability. And it's usually a human vulnerability. It's usually somebody either being targeted or victimized or making a stupid mistake. And that's, that's how it all becomes.

So let's talk about the elephant in the room. Something that no organizations don't want to talk about. Right? It's like a Pandora box sits in the corner of the office, in the room and for. In the organization, and nobody, they know it's there, but they're afraid to open it because they scared to deal with the consequences or don't have the skills to understand how to mitigate that problem. And he mentioned that that's the human factor. So when you talk about all these horses that runs out the stable, or let's talk about bullets, the industry is so saturated by a lot of different products and solutions that provide different shields and protections against huge amount of different types of bullets. But do organization ask or refer to who is actually shooting these bullets and how to deal with the finger that pulled the trigger instead of how to protect against these bullets. Because once the bullet left the gun, there was some intention or there was some root problem that actually started that.

Right. So why Organ?

And this is what Boaz and I, this is what we, I guess we see a lot in the industry and in the market. A lot of organizations deal with the problems and the symptoms and try to shut down and kill fires, but they don't really focus on the actual root cause and target the problem. And when it comes, you know, we always say there is no risk without people. If the risk starts with people, why organizations scare or don't do enough to look at people.

Yeah, and it's a good, it's a good question. And, and I think there's a few different factors there. Right. It's easier, it's easier to focus on machines and data related problems than it is to focus on people problems because it's a much more difficult problem to handle. So let me give you an example. Right? So everybody in cyber security is very well aware of the mitre, ATT and CK framework, right? And if you talk to every single cybersecurity practitioner out there, you know, they understand mitre, ATT and CK framework because you know, it was published as an open source guide to the tactics, techniques and practices that adversaries use against enterprise organizations when they want to hack or target or whatever they do. Very powerful framework. So powerful that actually most of the EDR vendors or the AV vendors use mitre, ATT and CK as part of the core principles of how they develop their product and how they kind of respond and detect things. And they use those, those attack ttps to define that. But MIDA themselves realized two years ago that the ATTCK framework is not suitable for detecting insider threats and human behaviors because human behaviors are so difficult to map. You have to literally understand behavioral science and the, and the things, the motivations behind humans that make them do stupid things, silly things, bad things, evil things. Right. And there's so many different factors that you have to pull in. So, so long story short, MITRE is creating a new framework called the Insider Threat Framework. We're working very closely with them on that right now. And what they're trying to do and how we're helping them is to TR and get more data. And, and this has been the biggest problem is that organizations have not been open to sharing insider threat related incidents and data, even with a trusted organization like mitre. And this is the problem for Gartner and Forrester and all the analysts. Right? Because I think we were approached by, let's just use Gartner, for example. Right? We were approached by Gartner maybe four or five years ago, maybe even longer actually, and they were saying, look, we think insider threat is going to be a big, a big topic, right? But we can't get enough data. Everyone tells us it's a problem and it's a big, it's a big worry for them, but they won't give us any background information to help us build a. What do you call it, the magic quadrant for insider threat. So we, so we don't want to, we don't know what to do because we know it's a problem. Everyone tells us a problem, but no one will help us. So we can't build a framework, we can't build a quadrant. And, and after a year or so of trying to figure that out, they eventually dropped it and said, don't worry about insider thread. That's when User Behavior analytics was born and this, this whole thing of VBA was born, which ultimately failed. Right, but, but it goes back to that point that people are not, A, they don't understand the behavioral problem well enough, and B, they don't, they're not prepared to share because they're, they're worried about what people might think if, if I don't have control of my own people, what is that saying about me? Right? But, but that's the wrong approach because we are human and, and humans just do human things. Right? And that's why for us, like, we try to focus on that workforce engagement, you know.