Bipul Sinha & Nicole Perlroth | The Zero Trust Strategy

Hi, everyone. Welcome to Grey Matter, the podcast from Greylock, where we share stories from company builders and business leaders. I'm Heather Mack, head of editorial at Greylock. Today's episode is hosted by Greylock general partner Ashim Chandna, who invests in enterprise software, including cybersecurity. He is joined by Bipil Sinha, the CEO and co founder of Rubrik, a zero Trust data security and recovery company. Also joining is New York Times cybersecurity reporter Nicole Perlroth, who is the author of the book this Is How They Tell Me the World the Cyber Weapons Arms Race. You can read a transcript of this episode on our website greylock.com blog and you can find all Gray Matter episodes by subscribing on SoundCloud, Spotify, or wherever you get your podcasts.

Hi, everyone. Welcome to this edition of Gray Matter. I'm Ashim Chandna, a partner at Greylock. Very privileged and fortunate to be joined today by two friends and colleagues. Nicole Polrath, an award winning reporter at the New York Times and author of an amazing book on cybersecurity that has been nominated for the best business book of the year by both the financial times and McKinsey and Bipil Sinha, CEO of Rubrik, a rapidly growing late stage, privately held zero Trust data security company with close to 4,000 customers. Today we're going to talk about the state of the security market, evolution of cyber attacks and cyber arms, the underground ransomware trends, and where things may be headed. So let's start with introductions. Nicole and Bipol, if you could perhaps just introduce yourselves.

Sure. Well, thanks for having me on Gray Matter, one of my favorite podcasts in the Valley. And I got started in cyber, sort of fortuitously. I had been covering venture capital at Forbes, and I was the one who perhaps made a huge mistake in resurrecting the Forbes Midas list, which ranks venture capitalists by some of their deals. And so I was writing some cover stories about some people who had invested early in Facebook, like Peter Thiel. And the New York Times caught notice of this and they basically called me and said, we're looking at you for this job, but we're not sure you're going to want it. And I said, how bad could it be? You're the New York Times. I'll take whatever it is. And they said, it's cybersecurity. And I remember just thinking, oh my God, I've gone out of my way to learn as little about cybersecurity as possible, but I will go. I will do these Interviews. I will tell my grandchildren that the holy New York Times invited me into the building one day, but I brought a list of cybersecurity reporters that I thought that they should hire instead of me. And so I went through 13 interviews that first day of half hour interviews. And over and over again I said, here are some names of really qualified cybersecurity reporters that you should hire. And a couple editors finally said, listen, we know you've brought this list. The truth is that we've actually interviewed everyone on your list and we had no idea what they were talking about. So you're hired. I think they thought I could cover cybersecurity on some corner of a blog on the New York Times website, which is what I did for maybe a couple weeks. But then the New York Times was hacked by China. And I had this incredible opportunity to essentially embed with our security team and Mandiant at the time, which was a little known security startup. And we watched as the guy we called the Beijing summer intern rolled into the Times network every day around 9am Beijing time and rolled out around 5:30. And that was really my first experience with, wow, this is what American companies are dealing with now. They are expected to defend themselves from advanced nation state backed threats. What are we doing about this? Who is coming to save us? Where's the cavalry here? And that basically began a totally different beat. And you know, I still call myself a cybersecurity reporter, but the truth is I'm really a digital espionage and digital sabotage reporter. And the number of countries that have come into this game is just endless. Really. I say that every country in the world with the exception of Antarctica is now stockpiling hacking tools and zero day exploits for a rainy day. And if they don't have the talent themselves, there's now a whole market that's crept up to meet their demand. So every week my job changes. Just when you think you really know this space, you realize something happens over there and you realize you didn't know it at all. And it's exciting, it's never boring, it's new things are happening all the time. But unfortunately, too many businesses and even government agencies are still woefully vulnerable when it comes to cyber defense. And that continues to be the same story over and over again.

Yeah, thanks Nicole. That's fascinating. And I feel like I should also mention in the introduction that it's been amazing to kind of watch you over the years at the New York Times and you've literally broken every major story that's happened in cyber around the globe. So yeah, I'd say a huge thank you just on behalf of everybody for that as well. Bipil, introduce yourself and also maybe just tell us about the Rubrik journey and what's taken you towards today's focus at the company towards zero trust data security.

Thank you. Ashim, great to be back on Gray Matter. Nicole, great to see you and amazing to hear from you. My name is Bipul Sinha, Co founder, CEO of Rubrik. My quick background is I'm an engineer turned venture capitalist turned entrepreneur and Rubrik is a zero trust data security company. We are focusing on helping businesses around the world to protect themselves and recover from ransomware and other cyber attacks on data as well as other natural disasters and operational error that prevents application from working properly. In terms of the Rubrik journey, we started our company about seven and a half years ago with this thesis that data and security has to intersect. Because if you think about with the advent of cloud, with what is happening in the world around us, infrastructure has become commodity. And if you think about what businesses truly own in terms of their IT asset, it is really their data. And data is the core IP for every business. And they are buying a number of tools and technologies from prevention to detection to everything else to protect that data. But all the tools and technology and average enterprise have 4050 tools and technology to prevent a cybersecurity attack or to detect it is failing. So our vision was can we take this inside out? Think about data as your core asset that is cyber resilient and assume everything else is compromised and in a zero trust manner, can you re silver your infrastructure with the data when attack happens so that you are never down and you always recover? And that has been the vision of the company. In the last seven and a half years, we've gone from zero employees to over 2,000 employees, close to 4,000 customers across 55 odd countries. And we are helping businesses and governments around the world prepare and recover from ransomware.

Thanks Vipul. That's an amazing mission. And sometimes folks ask like, hey, what's the top challenge as companies go to the cloud? And I often think like, you know, perhaps the top challenge is data security, you know, for large companies as they go to the cloud. Nicole, maybe you know a couple more questions, you know your way just because of the work you do. How do you protect yourself on the Internet? Are there things you do which you would encourage others to do as well?

Yeah, I mean, I think at some point on this journey I reached this fork in the road. Where you decide, am I going to live off the grid with a tinfoil hat on my head the rest of my life or am I going to just do the best that I can? And I think what I decided a long time ago was, and I think this is a question everyone and every company and every government agency should be asking themselves, which is, what are your crown jewels? What's the one thing that if that gets hacked, it's game over. And for journalists like me, that one thing is your sources. And so I do go to tinfoil hat extremes to protect my sources. You know, there are some people, I will only meet them this one place, on this one date, twice a year. We don't drive, we don't Uber, we don't bring devices, and we never communicate digitally. And you know, that is the extremes I'm willing to go for. That one person during the pandemic, that was really difficult. And so it became using signal for my really sensitive communications, making sure that I have Two factor Authentication enabled on as much as I can, making sure that it would be really hard for someone to trace me back to a sensitive source, that kind of thing. And then for the rest of my life, I just do the best I can. And usually that means never clicking on a link or attachment without carefully inspecting the sender, or making sure Two factor authentication is enabled and updating my software and doing all the boring things that everyone has told us forever that we needed to do, like backing up our data and making sure that that data is protected so that when we are hit with a ransomware attack, it's not game over. But that's my advice to everyone. If you do those basic things, if you're backing up your data, if you're using multi factor authentication, if you're being vigilant about who you're sharing information with and which links and attachments you're clicking on, you're going to be better off than 90% of the people out there. And so that's what I say is, you know, perfect. OPSEC has always been a pipe dream, but that doesn't mean that we shouldn't do the best we can. And unfortunately, I think one of the sad realities is that all this news I've been covering the last 10 years gives people this impression sometimes that there's nothing they can do to keep out a nation state threat or a ransomware attack. And as the poll can speak to, that couldn't be further from the truth. That's my advice, is think about what your crown jewels are and think about the best ways to protect them and then do the best you can for everything else.

In your book, you talk about groups such as shadow brokers and you talk about how these groups are exposing just how vulnerable nation states are to attack. These groups are also dumping hacking tools online now. So how does this change the game? And also, do you think groups such as Shadow broker can ever be caught?

This is the reality we're living in. We're so far away from the cold war world of two superpowers with nuclear weapons. That is just the old world. The new world is we have to figure out how to deal in a world where transnational actors can be just as powerful in some cases as nation state actors, and where even the best of the best nation state agency, like the NSA can itself be hacked from the inside out by an insider threat that could dump its most precious hacking tools online for North Korea to use, for Russia to use, for cyber criminals to use in ransomware attacks. That's the world we are living in now. And unfortunately, I don't think too many people have ever even heard of the shadow brokers. But the shadow brokers were a group, you know, or one person that dumped the NSA's best kept hacking tools and secrets online over a period of several months between 2016 and 2017. And just given the timing of that dump, the initial suspect was Russia, because this was all happening during some of the Russian interference in the 2016 election. And whoever the shadow brokers were were posting these memos online, written in sort of a Borat esque mock Russian tone. You know, they wanted you to think that perhaps they were Russian. But all my reporting suggested that no, this had to be an insider. They had too much cultural knowledge, they were posting too many code words that only people inside the NSA's TAO group would know. And the other thing is, the tools that they were posting were so heavily guarded, they were kept on these things that are called ops discs, although I doubt they were floppy disks. I think they were USB drives. They weren't something that you could just grab off the Internet or off some server somewhere. Certainly some of those tools could be pulled from a server that was used in these attacks, but not all of them to the degree to which they were stolen. So ultimately, the leading suspect is definitely an insider. And I wouldn't be surprised if it turns out to be someone who was a disgruntled employee of the NSA or even tao, because when you interview a lot of these people from tao, you know, they all talk about the mission and then they all talk about the bureaucracy and just how hard it is to stay in that job over a long period of time. Particularly now when they have so many lucrative and exciting job opportunities at Palantir, at Google, at Microsoft, where they are really on the front lines of a lot of these threats. Not in the same way that you can be at the nsa, but I think unfortunately this is a big problem. We really need to think about how to deal with a huge cybersecurity talent shortage. There is half a million vacancies of cybersecurity jobs around the world. How to get those people into government and not just at the nsa, but at DHS where they're working on defense, that's a huge problem. So I think it's going to force us to be creative with incentive structures, with perhaps partnering with the private sector on things like tours of duty, where they would loan out some of their best and brightest to go work on these problems. Might be one idea. So yeah, I think in the end, Shadow Brokers is probably most likely an insider. And it's pretty astounding that it's been five years and we have yet to see charges brought. And that just gives you an idea again of just how vulnerable even the world's premier intelligence agency is in this space.

Well, that's very interesting. And you know, it's also interesting because when I talk to like chief information security officers of large companies and you ask them, you know, what's the one thing that worries them the most? A very common answer, you know, if you ask people just that one thing, people will say they can protect against a lot of things, but protect against insiders is just very, very hard, especially in very large organizations.

Yeah, we saw that at Twitter with the Saudis. They couldn't find out who the people were who were criticizing them on Twitter. So what did they do? They planted spies as employees inside Twitter. These were qualified engineers. How do you, not only as a company, how are you expected to deflect against nation state attacks? How are you expected to now vet potential recruits for whether or not they're a nation state spy? These are crazy times we're living in.

So what are some things you think that'd be interesting for folks to know that may not be widely understood or known just about the cyber underworld?

Well, I think the big thing is, and this is what led to my book, I think people didn't understand how many trade offs the our own government was making on cybersecurity in the name of what we traditionally considered to be national security. I Don't think they realized that US government agencies were actively paying hackers, in many cases to turn over zero day exploits. The code to exploit vulnerabilities in Microsoft Windows and iOS, not so that government agencies could fix these holes, but so that they could exploit them for espionage or counterintelligence or the next. And that's why I wrote the book was let's drag this thing out in the open. Because unfortunately, these days, cybersecurity and national security are one in the same. And we need to understand that the incentives here are not always aligned in favor of further cybersecurity. So that's the big one. And just exploring that market was fascinating and exploring the characters involved was fascinating. And finding out that, yes, you know, it is just like you would imagine in the movies, people are going to these hacking conferences and doing deals in hotel rooms where their nation state agencies or their representatives are buying this code from hackers from all over the world to add to their stockpiles. I think that's just not something that people understand. I also think they don't understand that China, which for a long time was doing a lot of its IP theft using phishing attacks, has now told the nation's engineers, by the way, if you ever find a zero day exploit, you are not allowed to publish it online. You have to give the state right of first refusal. Now, I've been going to hacking conferences for years where teams from Tencent were the ones dominating these hacking competitions and basically presenting the best and brightest of vulnerability research. They don't go to those conferences anymore. They're banned from attending them. Now we're in Covid, so it's a different world. But they are now forced to give the right of the state right of first refusal. We don't mandate that here. So that's another kind of disadvantage we're at as a free market economy in a democratic country. And there is a lot of disadvantages that we're at as a democracy in this space. So I think people don't understand that that component is at play here and that we might have had first mover advantage in terms of our offensive capabilities, but that is slipping. And unfortunately we're still woefully behind on defense.

Yeah, that's. Wow, that's pretty mind blowing. I mean, one can only imagine like the US Government ever had a policy like that. Yeah, just the uproar that would be there across the population. So maybe let's spend a few minutes and talk about ransomware. Bipil, perhaps you can start and just Talk a little bit what you're seeing around ransomware with large enterprise customers. What can Rubrik do for customers in this area?

So if you look at what has happened in the whole cyber security market, traditionally there has been a lot of focus on infrastructure security. What I call it outside insecurity that how do we prevent attack from happening, how do we detect attacks? And it was all centered around compute and network. But what has happened is with the advent of crypto, with massive digitization that has happened in the last five, 10 years, the surface area has dramatically expanded, but the capabilities of these outside insecurity tools have not. And people are buying tools after tool to plug the next hole and the next hole and the next hole of a leaky bucket. And as the whole cryptocurrency, bitcoin has now started to kind of pick mainstream crypto has become a way to hold things at ransom and get payment without the prying eye. In their view of the government, the data security, which was the core goal of every cybersecurity tool to protect the crown jewel is going unprotected because the attacks have become more psychological. It's a cat and mouse game. So the businesses are now rethinking their security strategy. And many CISOs and CIOs tell me that instead of preventing every leak, we need to think about how do we protect the crown jewel at the crown jewel. And so if you think about the world we are living in, it's kind of like everybody is living on the freeway. The door opens to freeways. Anybody driving on the freeway can come into their house. So you need to have doors and locks and everything else. But where you safe is you need to have protection or shield around the safe, assuming that somebody will figure out how to get into the house. So that's what is the zero trust principles of inside out security in the ransomware folks are now thinking about in addition to prevention and detection, which you have to do because you don't want to keep the door open, but you need to have tools and technology and people around analysis that you will get attacked is not the question of if, the question of when. So when you get attacked, do you have tools and people and processes to analyze what has happened and then recover and containment? Do you have like tools and technology to be able to contain and recover? Analysis and recovery is where rubric plays in. And our vision, and that's what we have been educating in the marketplace, is you need to have tools to tell you what's the blast radius of ransomware tools to Tell you, if the sensitive data, PII and other sensitive content, which could be your ip, could be whatever is important, was it involved in such attack, then do you have the kosher data to be able to go back into an operating mode by re silvering the infrastructure? I mean, take for example, this was a crazy case of attack at Colonial. A major infra company like Nissan Infrastructure oil company, gets attacked even after paying $5 million or thereabouts to the bad guys. They get a decryptor key that is so slow that they have to go back to the backup and recover the whole data from backup. And in fact, CEO went to the congressional hearing and said we could recover quickly because of high quality backup. So it shows that the cybersecurity zero trust umbrella has to go from prevention, detection, analysis and recovery. And for far too long we have been focused on the first two pieces. Now the time has come for folks to assume everything is compromised because most of the large enterprise in the country has already been hacked and there is a footprint of bad intent sitting in every enterprise. The question is from there, when do they get attacked in the sense that real compromise and folks have to really rethink this whole way of planning as we are compromised. Unless there is a trusted entity, there is no trust.

Nicole, what do you think ransomware means for crypto?

Yeah, I mean, when I first covered the first ransomware attacks, they were in Europe. This was eight, nine years ago, they were in Europe. There were individual PC users being told they needed to go to a pharmacy and get an E gift card for €200 and give the cybercriminals the PIN. Then came Bitcoin and Monero and everything after that. And now it's $50 million in Monero. And if you need to pay with bitcoin, there's a 25% markup for that. So, you know, everything Vipul said is correct. You know, cryptocurrency has enabled these very brazen ransomware attacks. And for a while I thought, okay, ransomware is going to be the Achilles heel for cryptocurrency. This is really going to force governments to bring the hammer down. And I think partly that's true. I mean, I think for different reasons, but we just saw what China did with Bitcoin. But what was interesting, and this really gave me a much more nuanced take, is what happened after Colonial Pipeline, after the DOJ and the FBI announced that they were able to claw back some of Colonial Pipelines ransom. I called up some former treasury officials whose job it was at the treasury to do counterintelligence and financial intelligence. And what they said to me blew my mind. They said, yeah, sure, cryptocurrency has enabled ransomware attacks that. There's no denying that. But we're now able to track those payments in real time in a way that would have taken us years of tracking down the front company in the Seychelles to recoup that ransom. And now we're able to just do it along the blockchain and surprise cybercriminals. You know, the blockchain is not as anonymous as you might think it is. And sure, at the end of the day, it still requires good old fashioned police work to get those private keys to that private wallet, but governments have proven they're capable of that. So I think the question is, is what they did with Colonial Pipeline sustainable or scalable? And I don't think we know the answer yet. But one thing that's interesting is that there is a huge new crop of blockchain intelligence companies emailing me all the time who say that they figured this out and that their biggest customers are government agencies, law enforcement agencies. We're very interested in the tools to track these ransom payments in real time. So we'll see where that goes. But I think there's a lot of promise there and there will be, no doubt, a lot of demand.

Yeah. Wow. Well, that's very interesting. So maybe a question for both of you, just a high level question, which is, we're chatting five years from now, do you think the overall state of cyber is going to be the same? Do you think it's going to be improved and better, or do you think it's going to be much worse?

I don't know. This is a controversial take or maybe a provocative statement, but in my mind, ransomware is pen testing the United States right now. They are exposing just how vulnerable we have been. And they are giving us visuals to this vast ocean of cyber threats that the three of us have been tracking for more than a decade. So suddenly, you know, and we've talked about this before, suddenly Americans are asking, how are we this vulnerable and how do we protect ourselves? And they're demanding that the government do something. And we're talking about things like zero trust and an S bom you know, software bill of materials. And demands are being made of software vendors in ways I've never seen before, particularly after the solar winds attack. So I think we are having a moment that's more than just a passing news cycle. I think that we have an administration right now who has put top people in the job. And sure, you know, they are. They face serious structural challenges in addressing these issues. But I think that we're not just going to be continuing with the status quo of America as a, you know, a country that is becoming one of the largest and ripest attack surfaces in the world. I think finally people are understanding that, you know, there needs to be more accountability here of corporations, that we entrust our PII data to vendors, that we give great access to our networks and on and on down the chain. So I think we're still in for a little bit of short term pain, but I hope five years from now we're going to have seen ourselves turn a corner.

Sounds like the sequel to your book is going to be from the N bomb to the S bomb.

Oh yeah, no, no. The sequel to my book is a cookbook or a book about gardening.

Completely different. Bipul, any thoughts on. Yeah. For looking five years out, I take.

The perspective that the technological progress and continued digitization of our professional and private lives will continue to increase the surface area. And as with the increased surface area as we are plugging in holes, the government will get smarter, corporations will get smarter, people will get smarter, but the problem will not shrink. In my mind, problem will continue to be a significant problem, but it'll shift from like a soft underbelly to more of a difficult attacks. But we'll continue to see more and more attacks. Eventually it'll all boil down to cost of doing business. Just like when you swipe a credit card transaction, there's a certain small percentage of fraud in credit card transaction and then company has to go and make sure that they cover that cost and underwrite that risk. Similarly, in all our digitization effort there will be some cost, call it a rent that people have to pay for cybersecurity and it'll continue to be a significant problem. What is more interesting is as the cyber new frontiers in saving or continuing to kind of bolster our nation state, it will lead to a completely new set of attack vectors that would emerge because we are also thinking about like number of satellites and the implication of the satellites and can satellites be hacked? Can the cars that we are driving be hacked? Can these things turned into into weapon of mass destruction? So there's a number of vectors that are emerging. So I feel like future is continue to be like a cat and mouse game with good and bad like fighting each other.

Thanks so much for you know to both Nicole and Bipul for your valuable insights and perspectives. You know, super interesting and really important conversation and look forward to, you know, continuing this again in the future, hopefully sometime soon. Thank you.

Thanks, Hashim.

Thank you so much. It's been fun.

That concludes this episode of Gray Matter. If you liked what you hear, Please subscribe at SoundCloud, Spotify, or wherever you get your podcasts. To find all of our content, check out our website@greylock.com and follow us on Twitter reylockvc. I'm Heather Mack, and thanks for listening.