Mitigating Cyber Threats Through Artificial Intelligence Enabled Cybersecurity: Gaurav Banga

Informing your decisions with intelligence analysis and insight. Brought to you by the team@ooda loop.com.

Hello, I'm Bob Gourley. I'm the Chief Technology Officer of OODA llc. And today on the oodacast. Gaurav. Banga Gaurav. How you doing?

I'm doing very well. How are you doing?

Doing well. Good to have you on the oodacast. Let me tell people a bit about your background. And you have an undergraduate degree in computer science from Indian Institute of Technology In Delhi, a PhD in computer science from Rice, and right now you are the CEO and founder of Balbix. And this is a company on a mission. And I want to talk about that mission. It's a mission to automate the ability of enterprises to reduce breach risk. Now, you and I go back for a ways. I met you years ago. You had time at NetApp and then you founded Bromium, a company that made some dramatic positive difference in the cybersecurity space. Another thing I found out about you reading up for this is you are a prolific inventor. You have over 70 patents to your name. And I think that's pretty cool.

Yeah. Thank you, Bob.

So before getting into this, I want to get a little more about your background and kind of your foundational story. And let's start in the early days and I wanted to ask if you who were your heroes as a kid? Who did you look up to?

Hey, that's a very interesting question. Not a question that I get asked a lot. So as you had mentioned earlier, I grew up in India. And when I was growing up outside, my parents, who were obviously heroes for me at that point of time, my dad was a pilot in the Air Force there in India. My heroes, my earliest heroes were scientists, you know, people like Marie Curie and Laplace and Newton. And I was just very, very fascinated that just everything around us would be called human life. The benefits of human life, some of the creature comforts or the necessary inventions, they were all a result of science. I wouldn't say all, but many of them, most of them, the tv, the airplane, they were all a result of science. So that was very fascinating to me. And I, I just got very, very fascinated with people that had been able to create, you know, almost like black magic using science. So that was my initial hero worship phase, if you will. And then later on I started looking at people who were delivering products, not just inventions. I found that, you know, it was one thing to be able to create something, to discover something, but was a whole different level of appreciation when you could package all of that up, that invention up, and put it in the hands of people and then make it very widely used. So I started getting fascinated with business people at that point of time as well.

Cool. Yeah. I want to ask about some current heroes and mentors you might look up to now. But on that point, I tell you, for me, that is where real innovation comes from. It's not just the science and the engineering and the thoughts. It's the, all right, let's create a product that scales and goes to market and does something. So it's kind of like one of the secret ways if you want to track the future of technology. Look at what the builders are productizing and who inventors like you look at people like you and what companies you're creating and what venture capital is investing in and what's coming to market and what the market is, Is.

Is.

Is bringing. So I like that approach, too, of looking at what's being productized.

Productized, That's a good word.

Yeah. Current heroes or mentors that you work with. Anybody come to mind there you'd want.

To mention to us? Oh, of course. A person is nothing without the people around them, and particularly their mentors. I have had. I've been very fortunate as an adult, as an entrepreneur to have the, you know, the blessings to be mentored by many, many people. And some of them are people that you and I both know about right now. I can tell you I am honored to be mentee of John Chambers, the former CEO of Cisco. He is, like I said, I introduced him as my mentor, and then he's also an investor in Balbix. He's my mentor, and therefore he's an investor in Balbix. That's the way it works. So I am learning how to be a better CEO from John. And John, as you know, it took Cisco from tens of millions of dollars of revenue to 30, 40, 50 billion of revenue and saw every possible challenge that a CEO can encounter and was able to deal with most of them, if not all of them, fairly successfully. There's a lot I learned from John every day, and in particular in the pandemic. In the crisis that we are in right now, we are just about exiting, hopefully. Fingers crossed. John has been instrumental in shaping how myself, our company Balbix, and also other portfolio companies of John, other CEOs that John advises. How have we have been able to look at this pandemic and be able to steer our companies, our businesses through this pandemic and emerge hopefully stronger at the End of it. Another mentor I have who I absolutely have to add, as you can imagine, that different areas where you want to grow, you have different mentors, or at least that's been my philosophy. So when I'm learning about sales, I talk to go talk to good heads of sales. And I'm trying to learn about marketing, I try to talk to good heads of, you know, heads up marketing. And then one thing I've found is that at the end of the day, it's all about people. And one of my mentors who I would like to mention in here, which taught me a lot about it's all about people, is Naveen Chadha. And Naveen is, he's our investor. He is the managing partner at Mayfield. As you know, he was the first investor in Balbix. And I've known Naveen for a long time. I've known Naveen since we were both college students. He was a couple of years my senior at IIT Delhi and, and we didn't have an opportunity to really work together as closely as until now. And one of the things that I learned from Naveen every day is about products and companies and customer experiences are built by people, not the other around. And if you kind of think about what you need to know as kind of like a North Star that you can use to guide your decisions every day, what you do, it's important to know that, right? It's important to know that you're not going to get a good customer experience until you have the people delivering it. And how do you find the people? How do you invest in the people, how do you support the people? But at the same point of time practicing radical candle with those people because you want the best of them. But it's always that whole people focused approach. It's one thing that I have learned a lot. And I only bring up two things, CEO and people, because that's really the two things at the top of my mind. And I have other mentors. But then I think we'll end up taking the entire video call on that.

Well, this could be worth taking the entire call on because this is, these are great lessons. You know, John Chambers I got to meet personally a few times when I was a CTO and with many, many, many other people. But he always made me feel like I was special, even though I was just one of millions. And I just, he has that kind of personality that connects with people. And as the CEO of Cisco, I note that he was flying all over the place and meeting with presidents of all the Countries of the world and other major corporations. But then to talk to people is just a down home human being. It was pretty neat to see.

That's exactly right. I mean both John and as well as Naveen, the one thing that makes them fantastic mentors is at the end of the day they're just very good human beings.

That's good, that's great. Well, let's talk about another human centered domain and that's cybersecurity. Because there too you know, our adversaries are humans, their targets are humans. And it's just this complex infinite game that never ends. And I know you play directly in that in several ways. But I want to start with your view on the state of cybersecurity today. How do you characterize the world of cyber conflict right now?

I think cybersecurity is obviously a topic that is top of mind for a lot of people these days and it should be. But if you look at, it's not a new topic. Security is almost like, I'm not going to say this word over here, but it is the second oldest profession, the first one being hunting for food. The moment once you started eating and you had something valuable, maybe you had hunted down that animal and you were about to eat it and you were the caveman, I'm sure there was a caveman that wanted to take that kill away from you and they attacked you. And that's security and that is what we're trying to protect. And cybersecurity is just the descendant of security in general. It's a 200,000 year old game if you look at, and even older if you look at our ancestors species. And cybersecurity is always will be here as long as you have something to protect. We will have some form of security challenge because there will be people. So that kind of is profound. Right? Because if you look at, you know, how long we have a particular technology or a particular approach for and then you look at 200,000 years, it kind of brings you a little bit of humility in you and saying like not here to solve this game. There is no silver bulletin here. The best I can do is stay maybe one, two or three steps ahead of the adversary, the attackers. And once you, once that, once that thing dawns to you, then you start really looking at okay, what kind of advantages can we get in the business of cybersecurity and how long will those advantages get? And then also the flip side of it, which is what are the disadvantages that we have at this point of time? And you Start thinking in terms of the symmetry and the asymmetry of this battlefield. And unfortunately, over the last, I think, 15 years, we have seen that cybersecurity has become almost lopsidedly asymmetric. War and crime have just come online. And most people don't realize this. War and crime are pretty serious business. Very lucrative for the people that. And very important. War is not necessarily lucrative in the same way that crime is. And if we don't realize that, that, you know, what used to happen in the physical arena is now happening in cyberspace, and we choose to take our eye off that ball for even one second or choose to delegate it without serious thought, that's what's getting us into trouble.

Yeah. Gaurav, there's some huge issues here that you're bringing up. One is, if you look at it from an evolutionary standpoint, animals before humans evolved with security in mind. In 200,000 years of human evolution, physical security, we have eyes. We see the world around us. All of a sudden, online digital networks pop up and it's a different world that's hard for us to see and understand. But crime is there. Humans evolved. There were no digital tigers back then that we had to be aware of. We evolved with physical understanding. And in this cyber domain, it's so easy to misunderstand or ignore or you get attacked, you fix the last problem and you think it's gone away. This is a key issue.

Absolutely. You talk about visibility. Several things come to that. You can't protect what you don't know about. You can't protect against what you don't see. And you can get highly confused or misinformed easily by something else. These are some of the asymmetrical things that are happening in cyber. If you think about your house in the physical domain, and you can probably count the number of doors and windows in it, and your threat model is something that you can. You don't expect a tank to suddenly show up in your front yard from an enemy country. That's not what you expect. You expect. You've delegated that problem to the US Government to worry about. You don't have anti missile batteries on top of your house. Hopefully not. Right. I don't at least. Right. And so your threat model is well understood. Your doors and windows are well understood. And therefore, with a small amount of cost, maybe the cost of a lock and an alarm system, you go about doing your business in cybersecurity. We don't see any of that. We don't even know how many doors and windows A house has actually. We don't even know how many people live in there or how many assets you're trying to protect. And this is some of the asymmetries around visibility as a core topic that come to mind. And this also is. It's a fascinating topic. It's an absolutely fascinating topic. What would happen to asymmetry once we get better visibility?

All right, all right, so let me ask a couple other cybersecurity kind of questions, because another thing I've noticed, and you've already hinted at this, this is not the kind of thing where you can just fix it. It's not the kind of game that has a ending. It's an infinite game that will stretch on far after you and I are gone. And as humanity goes to the moon and Mars and beyond, there'll be cybersecurity issues there. We know it if there's people there. So in this infinite kind of game, there's also this topic you've talked about of attack surface, which is also huge. How should we view our attack surface in this infinite game?

Yeah, I mean, so the attack surface is a very, very good word because it does bring to your mind, you know, you can immediately start putting in your head together, okay, that's the place that I can get attacked. And the way we like to think about it, the way I like to think about it is you just imagine the number of different permutations and combinations that things can happen and kind of instruct us to think about. On one side, you're protecting all the different assets that are important to you. And it's important for you to be able to enumerate them all, like that laptop and that application and that data and that if you miss out one, that's a problem. If you. If you are not accurate on that, that's a problem. And then the second side of the attack surface, the second access, if you would think about, is the number of different attack vectors, the different methods like phishing and credential and, you know, lack of encryption or a misconfiguration, a software vulnerability. There are hundreds of them. And again, it's important that you keep in mind that they all operate in parallel in the sense that the adversary doesn't particularly have a favorite attack vector or a favorite asset on which they have to launch a stone. They're just looking for anything. They. When you're hunting for a deer, you don't particularly care whether as long as it's big and important seems like, and it's running slow, you want to get through that. If you kind of ignore the attack surface, then you have a problem, because then you, then you will get supplies and then don't complain about it. So task number one for everybody should be to be thinking about enumerating their attack surfaces, understanding it, gaining better visibility into their attack surface than the adversary has. And this is where you start building the. Building back the home advantage, the asymmetry, you know, kind of restoring a little bit of balance in there. Because remember, the adversary has to steal information about your attack surface, whereas you, you own the attack surface. So in theory, you should be able to do a better job about visibility. Now, if you do that, then you're suddenly back in the game.

I noticed the way you talked about that was not in extremes and absolutes. You talked about doing a better job, not doing a perfect job. It seems like as. As good as you do at trying to enumerate. And I really do believe we all have to get better at this. There's going to be some way that an adversary gets in through some piece of the attack surface that you didn't know you had. Maybe it's an employee that plugs something into the network or something else. So what do you do about that? You can't have perfect knowledge. The attack surface, you can do a whole lot better. But the adversary is going to get in, aren't they?

Absolutely. And I think you bring up the second point, second core, the idea your goal is not perfection. Your goal is you can't make the assumption that the adversary is not going to get in. You can only make the assumption that your objective is to minimize the top of the funnel, so to speak, for the adversary. And then you need to. You bring up the second concept, which I call resilience. And you have to design, you have to arrange things in your network in such a way that if one thing fails, then the impact of that failure is limited in time and in space. Now, this is not a new concept. If you think about the way we have designed a constitution, this is exactly how we've designed it, right? A good system of governance, either that of a country or a company, a good set of checks and balances and process and workflows, they all rely on this basic assumption that for an institution or an organization to thrive and survive and thrive, you cannot have single points of failure. The same rules apply in cybersecurity. We have to be able to reason about the resilience. You have to be able to calculate the resilience of our attack surfaces simply because there will be Times when there will be local failures. And our objective should be to prevent systematic failures.

Great. I think now you're getting us closer into what the magic that Balbix brings. But before going there, I wanted to ask another question that is I know you work with a lot of CISOs and you got a lot of friends in the community, and I just wanted to ask what those guys are asking you for. What kind of problems does the Chief Information Security officer of today face?

Yeah, and I have a lot of friends and a lot of customers and a lot of prospects. And hopefully one of them, all my prospects and customers would be my friends. That's my, that's my, that's what makes my job really, really fulfilling, if you will. And it's interesting because I kind of think of them as friends. And my friends are asking me, can you give us better visibility? Visibility into what? Visibility into the gap between us and a more cyber resilient setup, more cyber resilient cybersecurity posture and then help us navigate the gap. That really is the act. So the big picture. And this is the problem. The problem is that if you are, if you are a seasoned CISO who has made a lot of investments over the last decade or so, they bought, maybe they bought Dromium or Crouch Fireeye and they have a good team, they have set up all these processes at some point of time. So you have 27 tools and 30, 40 people and you're managing this attack surface at some point in time. You ask where am I? What are the gaps? It could be very, very complex if you're the CISO of a Fortune 1000 or Global 5000 company, to be able to answer this very simple question. Now in the old days, the CISO used to be able to look at a bunch of spreadsheets, maybe three or four dashboards, and go to his board of directors and say, I think we are good. We are at maturity level, seven of nine engaged on a threat model. I think we're good though. Days have a long gone. You have too many tools, too many things to look at. And the ask is for a mechanism, a platform, a product to bring all of this information together into a unified view of risk. Which is not theoretical, which is not just math mumbo jumbo that a spreadsheet, math as they call it, right. It is actually linked to the real on network state. So that's what are my friends and my customers and my prospects are not my friends yet, but will be soon have been asking us for great.

So that gets us to Balbix. Would you please tell us what is Balbix and what do you offer?

So Balbix is an AI powered platform platform, a cyber security platform. What it does is on one side, the input to Valbix is information about your attack surface. So we gather data about your attack surface. We can get it from your existing sources of data via some connectors and then we can get in get it directly from your network via our sensors. So sensors and connectors extract data, they examine where packets are flowing, what their software installed, how it is getting used. It figures out all of that information and that becomes a digital intake into a platform. In our platform you use some specialized machine learning techniques to build what I would like to call is a digital twin of your enterprise. It also includes a digital twin of your attack surface. And there we can do calculations about different types of breach scenarios. How likely is one scenario, how likely is second scenario, how likely is third scenario, and so on and so forth. And that allows us to surface extract risk. The insights about what are the riskiest scenarios or most likely scenarios, the one that you should work on first. And also what possible mitigating actions are possible, whether you should patch something or reconfigure something, or put a compensating control over there, or all of the above. And then the third portion of Ballbix, the output is both in forms of APIs and workflows that give you visibility and APIs and workflows that drive automation. And just one point to be clear over here is Valbix starts off as being the output is intended for human beings to look at. Hey, I got a problem here, I got a problem here. But then the fix of it as we envision it is maximal automation. The fix is not go fix something now. The fix is to get this machine in place that will help you stay one or two steps ahead of the adversary that machine is. We want to set up an automated workflow that will continuously keep discovering these new issues that come up as your enterprise changes. And then Sofa is it the our objective is the fastest meantime to resolve for security issues as they emerge.

Well, let me ask two questions. So it seems like one kind of user is the human being and the other is automated systems. What kind of human users do you have? What kind of decision makers use Balbix? And then the same kind of thing for the automation. What kind of automated action can you drive in an enterprise?

So there's two questions there. The first question is who are the human users of Balbix? And the second Question is, what kind of automation are we talking about over here? So first question, our users are the risk owners in the enterprise. So who are risk owners? It's pretty much everybody in a position of responsibility. So Balbix will produce different views, different dashboards, different workflows and depending on your role. And there is a role for everybody because everybody's a risk owner. So let me start with a simpler. As an individual, you are responsible for your smartphone and your password on LinkedIn. And if you happen to choose the same password between LinkedIn and corporate, now you have introduced a risk, which is bad for you, but more worse, more importantly, bad for the enterprise. So I want to be able to suggest to you that, hey, you have just introduced $5 million of risk for the enterprise. Could you please choose a different password? And by the way, you might want to consider this company, paid password manager, where you can download on your own. And here's a license that we have, the CISO has already purchased for you. And that's the kind of an interaction that we would have with an individual risk owner. At an aggregate level, if you're a business unit owner, you'll have your own dashboard, you're an IT owner, you'll have your own dashboard, you're responsible for patching or for reconfiguring and all the way to the top. When you're a CISO or a business unit owner, you'll have your highest level dashboard, which is kind of like a roll up. The important thing is all of these dashboards are different views of the same digital twin and what is happening around the digital twin, both from an external perspective as well as from an internal perspective. It combines three contexts. IT context, cybersecurity context, and business context. And these are all different views of that. And then finally, we even have a view for a board member, which is an audit committee member, where you get the highest possible view of the company. Where we were, where we are and where we ought to be. And it's not PowerPoint, it's not PowerPoint, it's a dashboard.

That's good.

So you're back to your second question. What kind of automation do we drive? So the first important thing to note is when we talk about automation, I want you to imagine the Tesla factory, I don't want you to imagine the robot from Terminator, whatever. 3. We're not talking about complete automation. That thing cannot exist, not in cybersecurity at least, as you rightly pointed out earlier, that it's about human versus humans. So we're Talking about maximal automation with just the right amount of human supervision that is necessary. So if you look at that, you have workflows, automated workflows that basically for those things that do not need to be tested, which can be purely patched automatically as soon as a new piece of software is announced along with the vulnerability, you can go through the entire process of evaluating it against your company's policies and whether just this particular software can be automatically patched on these assets, but not on these assets, and needs to be tested on these assets. And based on the output of the test result, it can be patched on the vast majority of it. This whole thing can be automated.

Yeah, awesome. That's very helpful and unique because on the first piece, the human piece, you got multiple teams in any corporation. Every corporation is different and you're serving multiple humans from the tactical level all the way up to the most strategic for the automation. You've really got my mind going here because there's so many pieces you can automate if you drive the right action to get to the right action. You said you are a AI based company and what do you mean by that?

Yeah, so AI is. It's actually a big word that is misunderstood by a lot of people. The way you want to think about AI is we're trying to automate the human specialized domain intelligence in even a pale shadow of it, and particularly a pale shadow of it. So imagine you have your smartest analyst, you show them a packet, you show them, you know, some screenshot, you give them a word. And because the context that they have in their head and the power of Google and the power of the duck, you know, Tor and looking at the dark web and all that, very quickly, within seconds they'd be able to tell you something very interesting about it. They might say, ah, don't worry about it. Or they might say, you saw that? Oh, tell me more about it. I really need to know more about it right now. How do you mimic that? Fairly unique analyst capabilities and how do you. And how do you scale it up? Because even this analyst, if you ask them this question 50,000 times a second, there was a, you know what? I'm going to get my beer or my mind, I'm not interested in this. I can't do this all day. So Valdix is trying to, I'm going to use this word, don't get me wrong, poorly mimic or at best effort mimic. How a good analyst, a knowledgeable analyst, the best analyst that you have would be thinking about these hard things. And this Provide the right amount of supervision so that the analyst can constantly teach the machine new tricks. And not only that, the machine can also learn new tricks by just observing the world outside at scale. So automation of algorithms, automation of intelligent algorithms, smart algorithms, that's what we do. And specifically for us, it means that for all the different problems you need to solve in cybersecurity, pick the best algorithm, pick the best statistical AI machine learning algorithm and put them all together and get them to work and then feed them a lot of data and outcome with magic.

Can you give me a feel for how many algorithms and what kind of algorithms?

Yeah, so we use, we have over two dozen algorithms that we use in the brain right now. They're two dozen ensembles and each ensemble has maybe one or maybe three algorithms working together. An example of that would be for the problem of asset inventory, which is taking some observations about an asset, a packet, a trace, a log and mapping it on to this is a Windows server. These are the assets on it, these are software assets on it, and these are the users. You use it. That's what we call asset inventory problem. I we use a technique called tensor to tensor deep learning and it doesn't really matter what it means. It's the same algorithm that Google uses in language translate and essentially think of it this way, we are translating from the language of packets, the language of Mac addresses, language of logs, to the language of human beings, which is Windows desktop, laptop, whatever. So it's the same problem language translate between German and French versus language translate between machine learning language and the language of English or human beings in general. Another example for breach impact analysis, which is what is the asset criticality analysis of how important an asset is versus not. We use I think eight algorithms that are daisy chained against each other. And I'll just talk about the first stage of this which is called page rank. It's a 40 dimensional variant of the Google's famous PageRank algorithm. That is what Google used to use to rank out of the web. So similarly, as Google looks at what the links into something are, we look at what device is talking to what device, how much traffic, what kind of traffic, whether it's internal, external, what are the users involved, what are the roles, and we put it all together into PageRank and out comes the distribution of asset criticality and then just get fed into the next stage which is, does some magic in there on top of fascinating.

All right, so tell me more about the tech, like your infrastructure. How do you deliver this to enterprise users?

That's a great Point. So there are three portions of the product. One is the data gathering framework and then there is the brain. And then the third piece is the user interface and the APIs, the data gathering framework. And I bring it up because these are kind of like your eyes and your ears, your sensory nervous system. They have to be where your enterprise is. It has to be. If your enterprise is in the cloud, we need sensors and connectors into your cloud. And if it is, you're using some SaaS services. If you have an office, if you have a data center, our sensors and connectors need to be feeding data from there. It's a very interesting problem because if you look at the amount of data at our largest customer, we look at about a petabyte of data per day. This data can't even be stored in memory. Otherwise Balbix, the company and most certainly the customer will go bankrupt just by storing the data. What we do is we do machine learning at the edge to compress this data. This is very similar to how you are, even though you're observing the world in full, no, not 1080p, 5k, 10k, 15k, 24k video. You don't store that video in your head. Your, your, your nervous system is very quickly distorting what is the essence of what you're looking at in your head. So Valbix, even though we are analyzing a petabyte of data, we don't store a petabyte of data per customer at all. So that's the data gathering system, sensors and connectors deployed wherever your enterprises, on your mobile devices, or on something with an access to the data on your mobile devices. The brain is hosted in the cloud. It's a SaaS product, just like a lot of the products that people are comfortable with using these days. Our brain is hosted in AWS and then the user interface. The user Interface and the APIs can be deployed from anywhere because it's SaaS hosted. You can go and look at your representation of your digital twin of your attack surface and your enterprise, your risk model from your phone, from your laptop, wherever you are.

Great, thanks. Good context. And then if there is a client that wants the stuff on prem, can you do that for them? Also.

What we have found most useful is that if they have their own, for example, AWS footprint and either in GovCloud or something, and that's an easy thing to do. What is a little harder is jack lifting, you know, the Bellbix stuff onto, onto the traditional on PREM infrastructure. That is a hard uplift. It can Be done. Just like in technology, anything can be done. We have designed a platform, it uses, you know, Kubernetes and containers and virtual machine. So it certainly can is not terribly hard. But that's not how we normally go to market.

Okay, great. Understand and you know, something might be interesting to think about is and we talked about this infinite game, there's bad guys will keep attacking nation states, criminals, miscreants forever. What happens if they attack you?

How?

What do you have safeguards? No, I know you have safeguards in place. Can you describe the safeguards you have in place that give me confidence that my stuff is going to be well protected and it won't be manipulated once Malbix is looking at it?

Yeah, and you bring up a fair point and this is a point that every SaaS company has to follow. Among other things, we use Balbix and Valbix and a whole bunch of other tools to make sure we are as resilient as possible. Their notion of least privilege. And I think we're doing an okay job on it. We do have a lot of our customers to periodically test us and we welcome that. That help us find all the bugs in our system faster than anybody else can use them. It's the same game though. We have to be constantly aware of all of the safeguards that we have in there.

That's good, that's smart. Another topic I wanted to ask you about is the issue of compliance and regulations because, you know, a lot of us in the security community have known for decades that compliance is not security. You can follow a checklist and it doesn't make you more secure because the bad guys know that checklist and they go around it. But on the other hand, it seems to be a way to get CEOs who might not care that much about security thinking about how important it is for them. So I wanted to ask your thoughts on the compliance and regulatory environment and what should happen there to encourage more responsible computing by enterprises?

Yeah, I think I am of the favor if you kind of look at compliance. Compliance is the One thing that CEOs absolutely do care about because nobody wants to get fined, nobody wants to go to jail, nobody wants a business shutdown. So if you do want to get the attention, this is one mechanism to do it. And I absolutely worry about this as you, as you do too, as I know you do too, is that we still don't have the full attention of the business managers on cybersecurity. Otherwise things like the. I mean, yeah, solar winds is a very complex thing. It's a hard problem. It's a problem that is not easy to solve. It's a supply chain issue. But basic ransomware, the kind of thing that happened at the Colonial pipeline, I mean that, that stuff should not be happening. So when it comes down to getting the attention, compliance is a good way to do it. And unfortunately the current security compliance or even the standards, which is what ultimately leads to compliance, is it doesn't go far enough. I'll give you my favorite best fee. I really love the guys at nist. I understand what they are. So don't get me wrong over here. If you're seeing this and you work for nist, I really admire you guys. I am very grateful to you. But if you look at the NIST cybersecurity framework, it doesn't go far enough. It does not. Imagine I'm reading it. You're letting me. So imagine I'm reading the NIST cybersecurity framework and I'm not as smart on cybersecurity as you are. Maybe I'm the CEO of a company or maybe I'm the delegate of a CEO of a company. You guys give me so much room. It's like you made it into a checklist. Oh, yeah, I have identify, I have protect, I have an asset inventory system. Who cares if it's accurate? Who cares? It's only 90 days. Consistent. I think would be a good wake up call for everybody if we had a lot more metrics in our compliance frameworks which were derived from actual, actual things that people in the battlefield, the cybersecurity industry are working on, like meantime to resolve. How long should it be before you resolve an exchange server vulnerability? Should it be hours, should it be days? Should it be months? We should never be in a situation where somebody who's part of the business community is not subject to some sort of a reasonable standard, days, hours, and cannot just make it 90 days because 90 days is completely meaningless. And that unfortunately is the standard today.

Yeah. And others metrics I like include mean time to detect. And this is impossible to get unless you have good automation and good visibility into your network and what's going on there.

Yeah, absolutely. Meantime, to detect if you have Balbix is hundreds of milliseconds, sometimes seconds for the very largest company, tens of minutes. In the absence of Biobix, the status quo in the industry, meantime to detect is one month industry. Now, there are obviously companies that do better than one month, so don't get me wrong, but others do worse.

We know from the Verizon data breach investigation report, they might be there for.

Eight or nine months and that is meantime to detect you must. So I would love for President Biden's new cybersecurity directive and the directive that went out to all the pipeline owners, which that goes back and I actually read it yesterday, and I can tell you there is not a single metric mentioned in there which is contemporary. And that is, I think we're leaving a lot on the table and unless we can do something about it, compliance will keep it happening.

I noticed also very light on metrics. Let me mention another favorite metric of mine, and that is, can the adversary accomplish their objectives in your network? The only way you know if that metric is true or not is if the adversary is accomplishing their objectives. So there's something you need to do before that, and that is the testing and red teaming. Can a high end, simulated, emulated adversary get into a network? And so I think that's a very important metric that everyone needs to have. One day we'll have this metric and that is, here's a company that has Balbix, here's a company that doesn't have Balbix. Which one could the red team get into and how long were they there before detected?

Absolutely. No, you're absolutely right on that. One day we will have that. And you know, cyber insurance is another area which is kind of like compliance. But this is where we can hit the CEO with because cyber insurance is getting smarter and right now they're paying more money in. They're not paying more, but they're paying almost all of the premiums they're collecting. They're paying into the companies. They're reimbursing from cyber attacks. That's not a viable business. They're not able to offer the kind of coverage that people want to buy, which is also not a viable cyber insurance business. And I think the next phase of cyber insurance is that they will take quantitative measurements of cybersecurity posture and allow give people kind of like the good driver's discount. And that will force everybody to get a better cybersecurity posture because it saves them 25% on premium, 40% on premium, and it gives them bigger coverage. So that's the other area, compliance, cyber insurance. I think those are important areas for us as a company, as a country, as a Western world or the world of rules and rules and laws to kind of progress into and maybe restore some balance in cybersecurity.

Great. Well, thanks. I really appreciate all this and I do have another question for you. Just more broadly related than cybersecurity. And that is I wanted to ask what books you would have to recommend for us. What are you reading now? Or maybe another way to think of it. What have you read recently that's had a big impact on you that you'd like to share?

I knew you were going to ask me this question because, you know, I read a lot. I read a lot and I do enjoy a lot of what I read. But one of my all time favorites book around building value, building valuable stuff is this book over here. And I do have it right here. I don't know if you can see it right here. This is Output Management. Yeah, this is Andy Grove's favorite book. I mean his most famous book. It's one of my favorite books. It's a book that I hand out to anybody who wants to say, well, I want to know, I want to be a manager one day, so I can't give it. This book teaches you how to be kind of view your productivity as a manager, your output as a manager, simply as the output that your team produces and being able to think about it. So I like that book a lot and I've read it many years ago and I've reread it several times and I keep going back to it sometimes. The book that I'm reading right now is this one right over here.

A Thousand Brains, Jeff Hawkins.

So Jeff Hawkins is a famous person in his own right. He's the founder, co founder of Palm and Yo. So we kind of all are know of his work. He's kind of like the father of smartphones, if you will. What is less known is Jeff is a very big proponent of building intelligent machines and he has a very different approach on it than the mainstream. His first book was called On Intelligence, which he, I don't know, 10, 15 years ago. And this is the second book and it's a fascinating theory on how to describe what the human brain, how it works and how it thinks and what we know about it at the macro level and how we might be able to mimic that in the form of, you know, true intelligent machines and systems and processes.

Cool, thanks.

I'm right in the middle of that right now.

Well, I appreciate the endorsement because I'm going to get that myself. I am. And I'll, I'll also put links to both of those in our show notes for this episode. Gaurav, thanks very much for the time. I really appreciate it.

Hey Bob, thank you for having me. And this was fantastic. It's always good to talk to you.

Yeah. Good seeing you.

Thanks for listening to this. OODA Loop production For the latest analysis on cybersecurity technology and global risks, please visit www.oodaloop.com.