Asheem Chandna | The Long Game in Cybersecurity

Hi everyone. Welcome to Gray Matter, the Podcast from Greylock, where we share stories from company builders and business leaders. I'm Heather Mack, Head of Editorial at Greylock. This episode is the audio version of Greylock General partner Ashim Chodna's column in Forbes, which is entitled the Long Game in Cybersecurity. You can read this column on Forbes and we have also republished it on the greylock website under greylock.comblog. you can find all of the Gray matter podcasts on SoundCloud, Spotify, YouTube, or wherever you get your podcasts. The Long Game in Cybersecurity by Ashim Chandna I have followed the evolution of CyberSecurity for almost three decades. The one constant is that as quickly as the underlying technology advances, so too does a cyber threat. To understand how things might play out in the coming years, I spoke with four cybersecurity experts, each each of whom brings a different lens A national security leader, a pioneer and technologist, a veteran CISO inside one of the most sophisticated technology companies, and a prominent cryptography professor whose students will invariably shape the course of the field. They are unified on one point. Cybersecurity has never been more central and more complex. No one can afford to fall behind the national security dilemma. Richard A. Clark's experience in cybersecurity and counterterrorism stretches across three decades of service at the State Department, the Pentagon, and as a counselor to three U.S. presidents. Today, he remains an indispensable advisor to countries and businesses on cyber risk and is one of the permanent thought leaders in the space. As a national security matter, Clark believes the US Government is well organized for cyber defense, but persistently falls short of providing adequate funding. In a recent conversation with me, he suggested that most informal criminal hacking organizations around the world could probably be shut down by a combination of the nsa, CIA, FBI, and Cyber Command. But he says, if only the US Was willing to expand the resources it nativost to counter cyber warfare. Nation state cyber terror is a different issue, he says. Iran, Russia and China all have cyber vulnerability, but so do we in the current conflict between Russia and Ukraine. He worries that every non cyber move by the US Say shutting down Russian access to the Swift messaging system could trigger a damaging retaliatory strike across US Critical infrastructure. Clark says. The problem is that we don't know how to handle the escalation of cyber warfare between countries. New strategies need to be developed. He cites the 1965 seminal work by strategist Herman Kahn on escalation, which addressed how major powers could contain and manage the risk of nuclear conflict. We need a similar roadmap for managing escalation and cyber attacks, clark says. Clark's concern for businesses is a repetition of the SolarWinds attack that went undetected for months. The biggest threat to most companies is a cyber attack that comes through the software supply chain, Clark says. That's what happened to SolarWinds. Today every company gets a staggering number of software updates every month. Companies are vulnerable with no clear place to seek help. The US Government would likely come to the aid of a major defense contractor hit by a cyberattack, Clark said. Large banks might also expect support. But other companies need more clarity about whether or when U.S. government resources would be deployed to help them recover from an attack. The problem of cybersecurity complexity Nir Zuk, the legendary founder and CTO of Palo Alto Networks, remains frustrated by a fundamental truth of cybersecurity. Customers have no credible way of knowing whether the products they purchase actually work. Failures are only discovered after an attack has breached the security. Zuck believes this is one reason why cybersecurity conversations have moved up the ladder of the enterprise hierarchy, from engineers to the CISO to the CEO and the board. He sees growing awareness at all levels of business that simply buying the latest vendor solution is no longer a viable strategy. Enterprises must understand why cybersecurity is growing both more sophisticated and and more difficult to manage. According to Zuk, operationalizing cyber systems is the bottleneck. Customers can't keep up with the volume of information generated by cloud and machine learning technology. An alert about a potential breach might show the whole chain of the attack stretching back into the architecture of the interconnected components in the cloud. It's very hard for any human to absorb and respond to all that information, zuck says. This dynamic makes automation of security crucial and inevitable. But Zuck worries most vendors and companies will get it backwards. Rather than adding one more automated feature to human tools, he advocates thinking about automated security the way Tesla thinks about autonomous driving. First create the autonomous products, then add the human factor. Two threats concern him. First, ransomware continues to spread with impunity. No foolproof system exists against an attacker who only needs to be lucky enough to breach your system once. The best antidote, he argues, is to turn the tables by focusing on how to detect a breach once it has penetrated the system. That's when the attacker must hide 100% of the time. But he quickly concedes that a good backup and data protection plan may still be the best strategy. Supply chain attacks are the second major threat and are hard to prevent because the enterprise that is victimized is not the first target of the attack. Instead, hackers are going after the vendors in the supply chain. Exactly what happened in the solar winds attack the problems Zuck believes, are knowable. The challenge is how companies will respond. The New Corporate Imperative Phil Venables was already an established and highly respected figure in cybersecurity when he joined Alphabet as Google Cloud ciso. He spent over two decades at Goldman Sachs as both CISO and chief operational risk officer. When he looks at today's risk landscape, he sees many companies still thinking about cybersecurity the wrong way. Companies are rushing to invest in cybersoftware without modernizing their underlying technology, says Venables. They are effectively trying to build a fortress on sand. Venables argues the cloud should be viewed as a digital immune system. He concedes this may sound self interested for Google's cloud ciso, but his case is hard to refute. Writing recently in Forbes, he described the cloud's persistent ability to update, adapt, and respond to shifting threats as an accelerating feedback loop for enterprise IT leaders. In the coming years, both executives and corporate directors will need to become more sophisticated, Venables believes. Not about the technology itself, but about how to build security into products and processes. Venables argues business leaders should be prepared to talk about the digital underpinning and security of a product just as knowledgeably as they would about supply chains or customer relationships. Think about secure products, not security products, he says. Venables proposes an exercise for a board. Instead of quizzing CEOs and their teams about patch updates or the latest security scanners, directors should simply ask how often the organization updates its software. Not long ago, IT teams boasted about quarterly updates, Venables says. The leading edge companies are typically updating software multiple times a day or more. That's the reality of an agile approach to cybersecurity. The Next Frontier Dan Bona is a leading professor in applied cryptography and the co director of Stanford's Computer Security Lab. He enjoys a distinct advantage in the world of cybersecurity, he sees. What new problems fascinate his students. Not surprisingly, they are gravitating to a set of problems around blockchain security. One involves the scalability of cryptocurrencies such as Bitcoin or Ethereum, which currently are restricted to conducting about 15 transactions a second. Yet as demand goes up, this limitation is causing transaction fees to rise. The research question is how to move far beyond the 15 transaction per second limit without compromising the integrity of the system. The other security issue with blockchain is privacy. While the virtual ledger offers efficiency and accountability for all types of enterprise transactions, the very nature of blockchain requires that the information can be viewed by others. This is a challenge for companies that want to pay suppliers or even employees through a blockchain system. Researchers are exploring how this can be done securely without compromising competitive or personal information. Bonnet and his students are also focused on a threat that he believes remains overlooked by most enterprises. Adversarial machine learning. For some time, engineers have been refining machine learning algorithms so that a robot or a vehicle can reliably recognize patterns, say, defects in a product or the difference between a stop sign and a yield sign. But Bonet points out that a growing number of results show how to attack these models. Some are breaking into the training data algorithms that make machine learning possible. Others are extracting the model and effectively stealing it so those with malicious intent can query it for the purpose of infiltration. As machine learning becomes more essential to advanced business operations, a new front of vulnerability opens. He sees other technical vulnerabilities in the world of cyber defense how to secure code depositories such as GitHub, or how to protect package management systems that automate the uploading and updating of software. The fundamental problem, he argues, is that the security industry is reactive. It is always focused on last year's problems. His research and students are a valuable counterweight to that tendency. Cybersecurity remains foundational While each of these experts have a distinct vantage point, they affirm that in the midst of much technology innovation, cybersecurity remains foundational, growing and increasingly complex. As they point out, AI and machine learning to the balance of security and privacy, the vulnerability of supply chains, the growth of the cloud and blockchain, and the demand for automation are all fueling frenzied activity in this space. We see it in venture capital. During the past two years, there has been a surge of entrepreneurs with new approaches to cybersecurity, and nearly all of them are magnets for capital. Barely a day goes by when I don't hear from a fledgling cyber startup. Today there are over two dozen pure play cybersecurity companies that have gone public. More will inevitably follow. The demand is unrelenting. The reasons are obvious. Cybersecurity has become a kind of virtuous circle. At one time, a breach of a legacy server inside a corporation was disruptive but its consequences limited. In a world increasingly dependent on interconnected services and users, any single breach has deep ramifications, and the potential to create havoc. Cybersecurity remains a long game. That concludes this episode of Gray Matter. If you want to listen to more insights from company builders and business leaders, Please subscribe on SoundCloud, Spotify, YouTube, or wherever you get your podcasts. You can also follow us on Twitter reylockvc. I'm Heather Mack. Thanks for listening.