Seasoned Executive and Serial Entrepreneur Henry Harrison, CTO of Garrison on Reducing Cyber Risk

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda loop.com.

Hello, welcome. Today on the Oodacast, Henry Harrison, the co founder and CTO of Garrison Technologies. Henry.

Yeah, hi. Very nice to be with you today, Bob.

Yeah, good seeing you. Hey Henry, I've known you for a while. I want to introduce you to my friends, though maybe some of them haven't met you. And I highly regard you as a technologist and a leader and a creator of technology. You've been a serial entrepreneur, a technology executive. You've worked in service to some very hard and significant missions, both in government missions and industry missions. The importance of protecting information seems to be something that is in your background academically. You have a degree in physics. Did I get that correct?

That's right, yeah. Electronic engineering as well actually. But yeah, I think what I strongly recommend is not trying to try and put any kind of logical framework around my biography because it doesn't really make any sense at all. I always tell people I'm not really qualified to do anything except be the co founder and CTO of a tech startup. I think, I think that's the only thing. It's the only way I can get employed. That's why we had to found the company. Cool.

So I shouldn't bother asking you the questions about the logical career progression that you've been through?

Yeah, there was no logical career progression. I can't claim that kind of planned approach to my life, but it seems to have worked out kind of okay so far. Yeah.

It really seems like your background fits perfectly with what you're doing now and I'm excited to dive a little bit deeper into both your background and what you currently do and what your company does. So I've. I know you guys a bit and I would love to say in my words what I think of you and then have you correct the record and.

Tell me what you think. Okay, well, let's see it. That'll be really interesting to see what you come up with.

You know, first of all, you have the perfect company name for a company in the cybersecurity space.

Yeah. The Garrison, you know. Yeah. And so my co founder Dave Garfield and I, when we got together we thought maybe it's time to just give up on security, let's go and do consumer wearable or something. You can do something completely different. And my wife pointed out that if you put our surnames Garfield and Harrison together, you get Garrison. And so there was no choice. We just had to stay in the security Space.

It is, it's very cosmic. And then the domain is perfect. Garrison.com and then if you think of what you really do, the way I always viewed you is you are helping with this ultra secure browsing as well as cross domain. And the way you do that is very unique. So in the old world, people would say, if any of my employees are going to the Internet, I'm going to monitor that and if I see something malicious, I will send an alert. You guys are totally different to the user. They think they're browsing the Internet. What they're really doing is going through something where there's a significant gap and no malicious code can get from the outside in at all.

Yeah.

Did I capture the essence of Gary?

Yeah, I think there's quite a lot to unpack in that, I guess because the first thing you said, you mentioned it very briefly. You do ultra secure browsing and cross domain. And I think is really interesting because different viewers of this cast may take very different things away from that. So if you visit our website, we talk about ultra secure browsing, we talk about web isolation, and that's how the vast majority of the market recognizes us. But some of your viewers who work in the kind of classified government space will recognize the terms cross domain solution and that's what we do for them. It's actually, it's the same technology. It's just described by these two very different markets we deal with in two completely different ways. So I think that's the first thing is unpacking that. And then secondly, you're right that what we are about is not detecting stuff. We're about trying to assume that everything's risky and turn it into something that's guaranteed to be good. Right. That's our philosophy on the world. I have to say. It's not uniquely our philosophy. It's a philosophy that is published. And I have to credit it to its originators, which is GCHQ in the UK through its sub agency, the National Cyber Security Center. And they came up with a pattern which they published on their website. You can go look it up, which is commonly known as transform and verify. And so their pattern there is to say, well, look, detection is too hard in many circumstances. You got to take data that is potentially risky. You have to transform it into a form that can be verified to be good. And so, you know, we're really just, we're one of a number of different vendors that are kind of building technologies on the back of that philosophy because that's the community that we've been engaged with for a while and we know well, and we're trying to bring that kind of philosophy to a broader market now. All right.

And this is a different philosophy, I think. So let me tell you, in my youth, the way we did cybersecurity was try to monitor what's happening in your net. So in the late 90s it was intrusion detection devices were placed on your perimeter and you also watch the firewall and you watch your error logs and look for anomalous activity. And that evolved over time to be very secure, significant devices that are still really just monitoring everything. And I still believe monitoring is important, but that, and it's also now being.

So do I, by the way.

So do I. And it's being fueled by threat intelligence, but it's all, it's monitoring. Your approach is not monitoring. Your approach is designed for security.

Yeah, but I think we can look at it as two ways and it kind of reflects back to those two markets we deal with. Right. So what you describe is a perfect reflection of what's been going on in the commercial market. Right. And I mean, you know, I used to, I'm a big fan of monitoring. I used to sell monitoring, used to do monitoring solutions for folks. But I remember 10 years ago I would go around kind of commercial organizations and we would say, hey look, we've got this monitoring approach where we use big data and then we use analytics to look for evidence of breaches and stuff. And people would say, whoa, what kind of crazy stuff are you talking to me about? This is clearly only relevant for like three letter agencies. And you know, look at where we are today. Right? Anybody who's any big corporation that's not taking those kinds of approaches, well, what are they doing? Right? And I'm a big fan of those. So I think, so I think that detection journey is absolutely what folks have been doing in that market. But if you look at the other market that we deal with, that kind of classified government space, and I should state just, you know, for the record here that I deal with that market in a whole bunch of different countries. So I deal with UK and the US we deal with a bunch of other countries as well. And it's very, very similar everywhere. In the olden days they took a design based approach to that. Right. And the design based approach was, well, we just won't connect it to anything. And that way, well, it's a great design based approach for a security perspective. They've been on a very different journey because they had this concept. Well, we just don't connect these networks or anything and you go, well, it's really, really hard to actually get anything done if you don't connect anything. So how do we connect things together whilst maintaining a design principle that means that we're not introducing risk? And really that's, I think that's the origins of that, certainly of the work we're familiar with in the uk and that design pattern that I, that I described earlier around transform and verify, how do you. It's a, It's a really hard nut to crack. So kind of seeing this from the two directions where you've been like, trying to approach things from a detection perspective, but frankly, detection is getting really hard. CISOs are running around with their hair on fire because they're drowning in alerts. They can't hire enough people for the SOC team team. It's just getting really, really difficult. And from the other direction, with folks who are going, well, we had this great design solution that's great from the security design, but terrible from a usability design. How do we solve that? And we're trying to, ultimately, we're trying to solve both those problems at the same time with one product. That's the basic concept behind Garrison.

Interesting. So I've worked across domain solutions in government for just about a whole career, so I've seen the worst and the ugliest and I've seen the most modern and. And I've also seen people who think that you don't need Cross domain and I've seen this deployed in the field overseas, where you might have a secret network and a top secret network and no connection between them, but the workforce there has a job to do and they have to move files between them and they find ways to do that, whether it's dumping it to a disk or putting it on a flash drive and moving it around. In fact, 10 years ago there was a major operation called Buckshot Yankee the press has written about where malware got onto classified networks from thumb drives. And it's speculated that the adversary did it. Like a Red team would around here. You know, they dropped some thumb drives in a place where a good guy picked it up and moved it between siprnet and the J wix because that's what they had to do for Cross Domain. Get the job done.

Yeah, indeed, that's right. And so, yeah, we all know like security solutions that are unusable are terrible security solutions because people find ways around them, but there's still a lot of people. I mean, so obviously you've got that experience, but what I tend to find is that there's even a lot of people who work with that stuff day to day in a government context. So don't really understand even today what's going on in that space. I'm not going to name individuals or organizations, but I was at an event in the US a few months back and someone on a panel was asked about the way their organization protected classified information and they said, oh well, that's easy because we just don't connect it to anything. I was like, yeah, I know that's not true, right? I mean, the problem is you, you probably don't know that's not true either, right? You probably genuinely believe that's the way you're protecting your information. Well, it's not true. People have to connect these things. And so this whole discipline of how do we build cross domain solutions has emerged in different countries around the world because they all have the same requirement, but it remains like an almost totally separate market space from anything that anyone in the commercial world ever runs across. And even the language just doesn't translate. Normally if you use the words cross domain solution in the commercial world, people assume you're talking about an active directory domain in some way of joining active directory domains together, which is not what we're talking about at all. And so the language just doesn't translate. The concepts don't exist in that space.

Yeah, that's a good point. And I do want to talk about the commercial approaches. So tell me if I'm getting too deep into the cross domain here, but I also wonder about throughput. That can become an issue if you have a cross domain solution because people need to move massive files these days between different domains. Does your solution handle good? Solid.

So yeah. So I mean, what, yeah, what we kind of, so I guess, you know, salesman in me would, would kind of go kind of. Yeah, well we solved that problem completely because, because we don't do the file moving. Right. That's not our approach. So what the, you know, the classic approach has been, well, I've got a whole bunch of data over here in a risky space. I now need to move it across here into the, into the, into the sensitive space so that I can analyze the data or I can view the data or interact with it. What we have built instead is what's commonly known as an access solution so that you're sitting in your sensitive environment and you can interactively gain access to the risky content and the risky network. So we have folks today sitting in classified environments working on classified endpoints who Are through our technology, interactively browsing www.whatever.com browsing the dark web, going to dangerous places without having to actually ingest that data. Because what we're doing is we're running the browsing session in the risky environment and then we're basically just bringing a video of what that. Of that browsing session into the. Into the sensitive environment and allowing them to interact with it. Now, it's really easy to say that there's a lot of technology goes into doing that in a way that folks are actually going to trust because anybody can do that in principle. It'd probably take me about half an hour to write some software to do that, but I certainly wouldn't use it to protect my sensitive environment.

Now, I do get what you say when you say that it is very similar to the commercial kind of, because commercially you don't use that word cross domain. It's ultra secure browsing, right?

Correct. That's right. But we're selling. Exactly. We provide the same technology that's being used for that use. I just described that classified use case. But exactly the same technology finds another use. Right? It's the same thing, but it's described in a totally different way. So if I talk about a big banking deployment, we've got. This is a big. One of Europe's largest retail banks. They have a corporate network and of course it does have Internet access. Right. It's a regular corporate network, but they have a proxy and that proxy has a policy about what it allows people to go to and what it doesn't allow people to go to. And over the years they've been tightening up that policy and saying, well, yeah, we are no longer comfortable to allow people to go to this. And they're kind of tweaking that policy for different user groups as well. So they're going like, okay, well, like network administrators, we really like. There's a very limited number of things. They go. The guys who work in the global payments team. Yeah, right. Okay. I'm going to really tighten up what they're allowed to get to. But you know, the guys who work in marketing, they can go to more of it. But you start tightening up that proxy policy. And the guys even, it turns out, you know, people who work in global payments, I think it's a really good use case. I mean, I don't, I don't have a background in finance. I don't know what global payments people do. It turns out they don't just sit there typing in payments all day. There's a lot more to the payment business than that. And if you take away the majority of the Internet, they go, hey, I can't do my job any longer. And so then that's where we've come in. So that then, you know, yes, there's some stuff they can get to through the proxy, but when they need to get to other stuff, they come through us and we provide them with that safe ability to go access that. And that could even in some cases be really dangerous stuff, like they're trying to research a payment to find out whether it was fraudulent. And so they're visiting some site on the dark web, follow up a lead because they think it might be a money laundering type environment. And we're providing them with the ability to do that from the core banking environment where they manage the payments. It's the same technology, but they use completely different language to describe what that solution is doing.

So can you tell us about the technology? How does it work?

Sure. So I guess we set out. So Dave and I told you a story earlier. We set out to build a startup, right? And, and we were like, yippee, we're no longer working for a big, big enterprise or a little agile startup. Let's sit down and write some software, get a minimum viable product and we'll get it out in the market really quick. And then we decided what we wanted to do and we concluded that actually you couldn't solve this problem just by writing some software and that we had to go and build some hardware to do this. Which is kind of like a sobering moment because you go, oh, that's, you know, we've done this before, but it's not that easy. So nonetheless, we worked out that's what we had to do. So we concluded that you needed to build hardware. And we're kind of, again, we're building on stuff that we didn't invent here. Because another thing that's really come out of the UK national security sector over the last decade has been the idea of using hardware across domain solutions, particularly the use of field programmable gate arrays, FPGAs. And so we really kind of took learnings from what we'd done in that kind of area and introduced some additional technology that we invented and filed patents around and built our hardware platform to do it. And the basic concept, I mean, I'm not going to give you a full rundown, but the basic concept is to say we've got a rackable appliance goes in a data center that we designed and inside it's split Internally into things that happen on the, on the dirty side, government would call the low side, things that happen on the clean side, what government would call the high side. And there are some very, very clear hardware level security controls between those two sides. And in one direction, it really only allows RAW bitmaps to come in. So the dirty side does web browsing, it'll generate screen images of web browsing. And then that, that interface inside the box only allows RAW bitmaps to go across from the dirty side to the clean side. And then those RAW bitmaps can be sent to the user's endpoint to be displayed. And in the other direction, we take keyboard and mouse information, we apply a number of security controls to that to mitigate the risks of data loss, but all implemented in this kind of hardware level approach. And the hardware level approach is all really about trying to say, how do I build a box I can actually trust? Because we all know that like the core issue, the core cybersecurity issue we've got is we love software because it allows us to do everything, but equally, software is vulnerable, right? Very, very, very, very hard to write software that doesn't have vulnerabilities. And if you find a vulnerability and you can exploit it, you can turn the box into doing something completely different. And it's no longer doing security for you, it's now part of your attack chain. And so how do you build security solutions that don't become part of the problem? And that's really the reason that you go down this route. So, you know, it's as ever, you know, you never really invent something yourself, right? You invent a little bit of an enhancement on top of stuff that's come out of many years work by large numbers of people. And that's just what we're doing like everybody else. Yeah, thanks.

That's fascinating. And it makes me understand more clearly how this is security by design, this ultra secure browsing. But you said it's a rackable device, so it goes in your data center. Do you have a cloud version of this that you can tap into?

So we do. And that's, you know, our website talks about that. I should say it's not yet ga that cloud service, it's something we're working with a small number of early adopters on. But what we're doing with that cloud service, I mean, I think the word cloud service kind of everybody's got so used now to the idea that cloud service means AWS or Azure or whatever. Obviously our cloud service still relies on our rackable appliances. So we still need to manufacture them and put them in a data center somewhere. But then what we're doing is offering working with early customers so that they're getting the benefits of that hardware as a service without having to rack that up in their own data centers. But then we've also got customers that, you know, I mean, like some of our core customers today, particularly the government customers, but also some of the financial services customers are never going to use a cloud based service for something as key to their security as this. They're always going to want appliances that are under their control. So we don't ever expect to become 100% cloud business, but we recognize that also that the mainstream commercial business is largely speaking getting out of the business of racking up appliances these days.

Yeah, it just seems like it would open you up to many others who want this kind of capability but don't to buy a box and put it in Europe.

You're absolutely right. And that is absolutely where we intend to go over time. That's the direction of travel. But as I say, we're going to stay also in the on premises business because there are some segments of the market that are really important to us. You know, I mean the government sectors, like in the end, the commercial world is where you want to be successful, right? Because it's huge and get successful there, there's a ton of cash to be made. And so every business ultimately wants to be successful in the commercial world. The reason we, we want to be successful in the government world for two reasons. One is because there are some missions we're keen to support there. So just personally there's, you know, a sense of doing good things. But also because in our experience, the government world has real experience of looking at products and evaluating whether they're actually any good at delivering security in a way that the commercial world really doesn't. And so this is not to say that the government is perfect. Right? I can complain about the various different governments approaches for hours on end, but nonetheless they have a lot of experience of trying to pick products to pieces, spending even years working with us to determine whether it's secure or not. And I want to be able to point to tell my commercial customers, look, this is a box that's trusted by these governments around the world who have spent many years of effort trying to determine whether our box is actually secure or not. So it's very important to us to maintain that market because really that's the proof point. I can claim my product secure, but I'M a vendor, you should never trust anything I say. Right.

I got a few more questions, if you don't mind. I want. Yeah, I've been lucky. I've met quite a few people from Garrison. James Derbyshire is a barber.

Unforgettable, certainly.

I met David Garfield a couple of times and I met Colin. And there's something consistent about every person I've met at Garrison. They all have this smile on their face and this can do attitude and this work ethic of just, you know, let's get it done. And also guys like James, before this pandemic hit, it seemed like he was always on an airplane. He's, you know, every time zone in the globe is out there getting stuff done. So there's something about your company culture I wanted to ask you about. You seem unique.

I guess. I don't think, I mean, everybody's unique, of course, but I think there's lots of other good companies out there. I think there's a couple of things that I am proud of with Garrison. I think one is that I really do think we're doing something good from a security perspective. And I think there's an. I'm not going to name names, right, but there's an awful lot of cybersecurity companies that are predominantly marketing led. They had the germ of a good idea. But because nobody really does any real work to evaluate whether their security is really delivering or not, all the emphasis is on features and marketing. And we have customers that are very demanding from a security perspective. And so we know we need to deliver. And I'm really proud of the security that we are actually delivering. I think the second thing then is that we're British. All those individuals you named are British. We're based in Britain. And I think we're all very conscious that Britain is a small island adrift in the Atlantic and that there's no success unless you get out there and engage with the rest of the world. You can't be successful just in the UK market. We need to get out there, we need to be part of the global discussion and we have a unique, I think, ability to do that from the UK because a lot of the sorts of, you know, the folks who deliver the sorts of solutions that we do in the US are usually heavily constrained by ITAR rules, by export control rules, such that those solutions really are restricted to U.S. government buyers. And the U.K. has a very different approach. So, you know, the U.K. is generally trusted by certainly, you know, the U.S. and other Five Eyes nations to deliver solutions. But Also has a, you know, has a pragmatic approach to export of capability because we recognize that we can't survive purely within our own shores and we need to get out there and be a trading nation. So I think those, I think those two cultural elements may describe something of what you do. But maybe we're just incredibly good at recruiting and we just got fantastic guys. I don't know.

Something tells me it is something about your leadership style. And I have a couple other questions I want to ask you. Yeah, kind of about that now. One, we talked at the very beginning about your bio and your background and the fact that maybe it wasn't a logical career path. It would not be fair for me to ask you, for somebody who wants to be a Henry Harrison in the future, what should they do? But that's the question I want to ask people today. What should they be studying if they want to succeed in life as a technologist and a leader and creator? Any thoughts on that?

Yeah, I do have some thoughts on that actually. I would say that the one thing I tell young people, I get asked this by young people and on the basis, you know, I don't do so much actual graduate recruitment any longer, but I used to the earlier days of the company and I think that there are still a lot of, there's a lot of people these days emerging saying they want to get into technology and they've been doing a computer science course or something, but they still don't really understand how a computer works. And I think, you know, one of the benefits that we had, I guess as a, you know, there's a number of decades behind us here is, is that when I was learning about technology, technology was a lot simpler and you were working much closer to the metal. It was hard not to understand how the computer actually worked. I think these days there are ways of doing that, right? I mean, go out and buy an Arduino board and learn to program it, maybe write some assembly code. Right. I mean, it's almost certainly a useless skill in the sense that you're almost certainly not going to get employed to write assembly code. I think I've literally written assembly code once in the last 30 years or something. But if you've done that, it forced you to understand how this thing you were working with actually worked. And I think that low level understanding stands you in good stead and doesn't change. Right. I mean, the lessons I learned when I was 16 with the 6502 processor are still, broadly speaking, absolutely valid things to have learned. Today, with today's latest intel processors, obviously there are new features, but the basic concepts haven't changed for 50 years. Right.

Yeah. That's perfect and fascinating. And it resonates with things that a lot of other people I deeply respect said.

So, I think, particularly for security, Right. Because, like. Like the guys who are good on, you know, particularly trying to, you know, do defensive security, the guys on the other side, like, they're really good at this stuff. Right. They're really good at finding out the ways that this thing's going to behave that weren't intended. And if you're going to. If you're going to engage with that, you have to. You have to understand what the thing is so that you can, you know, not be surprised when it turns out that it does this kind of stuff.

Yes. My business partner at uda, Matt devoe, has told me similar things. When he was hiring at his last company, he would look at resumes and, you know, the person may have several certifications where. Which is. It's very important that people train themselves and educate themselves. But the people he really wanted to hire are the ones that he would ask them what kind of lab they have at home, and they would describe the Raspberry PI and Arduino and the computers and their own virtual networks at home. And that's the kind of person who continually educates. So that resonated with the things he's been taught.

I kind of agree with that. Yeah, absolutely.

I want to ask you a couple other questions, a few minutes. One is. So we talked a bit about advice you might have for the younger folks. Do you have advice for the seasoned professionals out there? Just an observation on the Chief Technology Officer or the cio. The ciso. Today's ciso, it seems like they're just overwhelmed. Too many of them get pulled into. They're the incident responder instead of the strategic.

I agree. Yeah. So I do have. Yeah, I. So I'm gonna. I'm. I need to word this carefully, right. Because I think it could be taken the wrong way. But I guess the first message I'd have for the bit for the CISO is it's not your fault. Like, the industry's set up this way. It's designed for you to fail. And so, you know, you don't feel a sense of, you know, don't feel a sense of failure that you're running around with your hair on fire because you're dealing with an industry that's set up wrong, that's just guaranteed to make you behave like that. And I think the real challenge is how do you get out of it? And it's almost certainly impossible for any single CISO to get out of this because I think we have some really deep seated structural problems in the technology industry, which is that basically you're trying to promote security with technology that's just not very good. And the reason it's not very good is that almost nobody ever measures it to see if it's any good. Right. I mean, so I'm going to give you an example without naming any names. We had an RFP that we were sent a few months back by a large global bank buying web isolation technology and they're buying a security solution. They sent us the RFP and we read the criteria. We went back and we said, we've just read all the selection criteria in your rfp. We, we did notice that not a single one of the selection criteria had anything to do with security. Did you actually intend this? And they were like, oh, that's actually a really good point. So the industry doesn't set out to buy security, it sets out to buy IT systems with features and functions. And consequently, it's no surprise that the technology you're working with is, isn't designed to deliver security and you're not going to solve that problem on your own. I think it's something that you need to teach your seniors, you need to teach the leaders of your company that this is the case and not allow them to be blinded by the standard industry message that all you've got to do is get the basics right, you've just got to do this right and you'll be fine. Well, it's not true. It's too hard to do the basics right. And even if you do the basics right, the technology is still, still not good enough to keep you secure and you need to sell that honest message upwards. And then collectively, I think if you get together with other CISOs and they tell their leaders, collectively, we can solve this problem. Because if you as a buyer start saying, okay, when we buy security, we're going to set up stringent criteria for assessing the security of the technology we're buying, then we can start to change the landscape and turn it into something. Whereas where rather than kind of running around with your hair on fire, you're actually able to be a strategic planner, but it's going to be very, very difficult to do on your own because it's a whole industry that I think is ranged against you, not just your own organization.

Well, thanks, Henry, and thanks for this entire conversation.

This is just a pleasure, Bob. It's always a pleasure to speak to you. And, yeah, I've really enjoyed this. Cool.

Well, let's do it again soon.

Let's do that. All right. Well, thanks. Bye.

Thanks for listening to this. OODA Loop Production. For the latest analysis on cybersecurity technology and global risks, please visit www.oodaloop.com.