The Cyber Frenemy of the West: Understanding China

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today we're going to talk about one of the most aggressive nation-states when it comes to cybersecurity. And I'm talking about China and their global proficiency in attacking digital networks. And I'm going to be talking with Ian Thornton-Trump. Ian is a chief information security officer at Inversion6 and longtime security expert and researcher who has worked in the insurance, banking, and healthcare sectors. Welcome, Ian. Thank you again, again, a returning guest here for coming in and talking with us.

Amazing, Matthew. So glad to be here.

So, The world we live in, whether we like it or not, right, we are seeing a rise in aggressive cybersecurity from nation states. And these nation states, they have the capability to invest tremendous resources and a lot of time to leverage, right? They're able to go after a— take advantage of a multitude of technology opportunities, shall we say. And one of the biggest, and I would say offenders, but maybe not, maybe not, right, is the longstanding player that's been doing this has been China. And I guess I do have to caveat it a little bit, right? If you're the one doing, you know, data harvesting or whatever, you may have noble reasons for doing it and promoting your country. On the other hand, if you're on the other side of that and you're having things taken from you, you're probably going to look at it a little differently. And I'm sure we'll get into it here. But when we talk about a history of China and economic espionage, what have you seen? I mean, and what has been their goals? Let's just frame it with kind of a history here.

All right. So you're absolutely right. And this goes back many, many years. And I first have to say, A shout out to, I think he's probably now a Colonel, Wang Dong, APT 1. The first time where a civilian company, if you will, Mandiant, started and documented and understood the aggressive actions of Chinese-backed nation-state operators and their aggressive hacks of the United States. Purely on espionage terms, right? So, this was a wake-up call. I think the fact that a civilian agency outed the Chinese activity of the PRA. And then later on about, I think it was about 3 months later, we had the first indictments of PLA operatives. And so, this created the industry that many of us work in today, the cyber threat intelligence industry, right? Like it was like, It didn't exist until Mandiant put out APT1, and now we're at like APT, like, well, triple digits, right? So—

Well, hold on, hold on, hold on. I mean, because this kind of espionage did exist. It existed before we really even had cybersecurity, information security. I can remember back in the '80s and '90s, and it was the United States Office, Director of National Intelligence, I believe, right? They were required to report annual report annually to Congress. And you can go back and look, you can go back and look at some of these economic espionage reports. And it was old school, right? I mean, it was stealing manuals and getting visitor passes and taking pictures with old school cameras with film. I don't know if some of the audience actually remembers that, right? Where you had to go get it developed. But even back then, they were talking about the economic espionage of China being able to harvest the intellectual property, right? American designs and new technology and designs. And I mean, that initiative just, at least in my mind, blossomed when everybody started moving to a digital world and you didn't have to send people, you know, to walk into a campus or try and lift an access badge or pick up a user manual you're not supposed to have, right? You can do it all online.

Right?

Everything's online. So, you know, I'd like to say that they've had that culture in place and practices. They've been refining their skills for a long time. Cyber is just that next step.

Yeah, it was a national mandate. And they were not— they didn't disguise the fact that part of their whole, I'm going to call it, country's go-to-market strategy, if you will, was to take other people's stuff reverse engineer it, and literally from the Chinese translated into grow our economy.

Like, yes, we don't have—

and this is the interesting thing, as the United States digital, uh, cyber, uh, culture prospered, the Chinese, not stupid, looked at it and went, wow, they're starting to get things like double-digit growth in these areas, right? We want some of that action. Could we do all the R&D? Do we have smart people? 100%. Like, you know, very educated. But here's the thing. It's way easier to let somebody else do the R&D work, be it pharmaceutical, aeronautical, space, any of these key strategic areas, way easier to take it, right? Than it is to do it. And so, China's prosperity over the last 30 years is absolutely what you said. But here's the thing. It started off as, you know, the spy versus spy. Absolutely. The cameras, the recordings, the, you know, the getting into places in government and, you know, walking out with the files. And by files, I mean the manila folders, right? You know, and the Gerstettner machine, like to copy stuff, right? But now they went digital and digital meant we can steal a lot more for the level of effort, right? And again, Chinese understood we can hoover it up. Then they went next level. So they went digital, but now they realized the complex nature of the trading relationships that Western nations have with China meant that they could do two things. One, they could build parts of the technology, and that became really attractive to corporations. And then they could reverse engineer that technology. Now, this is where China and the Western world really depart. China looks at places like Africa and South America as market opportunities. We look at it as a place where we have to send aid to save people. And so, the abrupt turnaround in this was, I have a bunch of stuff that I can take. I can reverse engineer it. I can build the missing parts if there are missing parts because at one point North America went, "Well, we're only going to outsource parts of our thing and then we're going to have other parts and we're going to assemble it." And it's like we thought, "Oh, well, they'll never guess, you know, how to do it, right?" They're smart.

I mean, they are smart, like you said.

Super smart.

They can do it themselves, but why? Why would you? And I want to bring up a point that you talked about, and I think it's really, really relevant to emphasize. They've been open about this. They're not— it's really part of their culture. Hey, and if you are a Chinese citizen, right, back in the day and even now, right? They will tell you, hey, you are, this is your country and we need to grow and we need to, you know, our goal is to be a world power and take care of ourselves and do the right thing. You as a citizen have a national obligation to help our country grow. And if there is intellectual property in other countries that would benefit us, well then it's your national duty as a good citizen. To help bring that back to country, right, to mother China, so that we can prosper and use it right. And it tugs at the strings, right? The banner, the flag waving, nationalism. So, you know, a lot of people are doing it, you know, with certain moral structures going, yeah, I'm doing the right thing. And China's been open about it.

Well, not only have they been open about it, They've encouraged it, they've rewarded it, and they've said basically, bottom line, we're going to have laws in China that give— that require you as a Western company—

we're going to penalize you if you don't.

Exactly.

Come to our country and do business unless you give us intellectual property.

And so we got super excited because one thing China did offer, especially as its industries prospered and became more high-tech, was the opportunity to outsource technology and create technology and build it to order, right? Thinking that, hey, for the 100,000 things that they built, we're going to get 100,000 things. Well, we didn't. We got maybe 90,000, and 10,000 disappeared somewhere, right? And that disappearance was like, All of a sudden, the middle class of China started getting all of these consumer goods, right? And it was reverse-engineered technology from Cisco that was taken. And we know this because one of the big revelations was literally the manual that had the typos for the piece of Cisco gear had the same typos when they sent the manuals. And then, of course, there was the great undoing of Canada. We all remember an amazing company called Nortel Networks, which built some of the first high-level telco switching apparatus and stuff like that. Well, it was looted by the Chinese in an espionage operation. And Canada has never held the Chinese to account. And there's one guy, I think, out there with— planted a flag in the ground. And like, Nortel Networks no longer exists. But he won't let it go.

Right.

But this is the thing. You're 100% right. They've been completely transparent along this journey. And then I think the other factor is they look at it as their own national security issue. And I think one of the leaders of one of the generals of the United States who was running the NSA and then what became Cybercom basically said, Hey, there are patriots of other countries, right? So, their urge to do what is in the best nature of their country, to advance their country, is absolutely, you know, part of, I would say, the rivalry that nation-states have, number one. And number two, they made no bones about it. Their economy built on the labors of others. It's not a bad plan until, until we find that the dishwashers and the other white goods, as we call them in the UK, are duplicated. Maybe Whirlpool is spelled wrong. And they were finding them in Africa, we're finding them in Asia, and especially the battleground between the United States and China is going to be India. Because there's a rising middle class there. People are getting more wealthy. They want the top-line goods. They want— they're one of the largest nations consuming the luxury goods market as well too. One of the things that China is incredibly good at doing— counterfeiting.

Oh, absolutely. Right. And so, world-class.

I can get a Louis Vuitton, or I can get a Louis Vuitton made from Louis Vuitton parts that have all been reverse engineered and may even come from factory.

Yes.

The second shift is making the fake Louis Vuitton.

Well, like you said, they put in an order for 100,000 units, but the manufacturing, right, produces 110,000 or 150,000. And they ship you your 100,000. They take the other 50,000 and put them out in the market and sell them. So yeah.

There was a good article that came out about wind turbines and the technology around wind turbines. And there was actually a court case where where the plaintiff or the complainant in this case was trying to sue a Chinese entity because it had taken the intellectual property. Here's the problem with the whole narrative. We have willingly given them our intellectual property, right? They only, I think they only steal to get the missing parts, right? And here's a great example. When Lockheed Martin got hacked as a result of the RSA hack that was like the legend. Like, this was the biggest one. And for our listeners who maybe are not quite as old and as seasoned as us, I say that the kindest way. I would consider myself well-marbled in addition to well-seasoned. But the issue was really around the fact that they reverse-engineered the algorithm used for these little key fobs that we have that would be essentially your multi-factor authentication, right? And they reverse engineered, they got that seed, and then they used it to hack Lockheed Martin. And what were they after? They were after Reaper and Predator drones, Apache, and the F-22, F-35 technologies.

And F-35, we lost the F-35. We've also lost plans for certain nuclear subs. Oopsie. We've lost plans for the designs of the screws, which is hugely important on those.

Yeah, the propellers. Yeah, yeah.

The propellers. Yeah.

The screws on them.

So. But we see attacks, we see attacks in, and we'll talk about it, I'm sure telecom, and we see it in software and we see it in hardware and networking devices. We see it in telephones, we see it in social media, we see hacks and attacks and in manufacturing and all critical infrastructures, right? In defense sector industry, you name it. And you had said, hey, they hoovered up, by the way, for those people who aren't as marbled and seasoned, Hoover is actually a vacuum maker back in the day. Incredible suction and it just sucked everything up. But, you know, that's what we've seen. Even to the point where they were, and they still are, consuming vast amounts of encrypted data and just storing it.

That's right.

For the day when, okay, we now have quantum computers that can break all this encryption. We can go back retroactively, break all of that and figure out who was talking to whom and what secrets were being shared.

Exactly. Yeah. And that's—

What are they doing now? Right? What are they worried about now?

So there's a couple of things geopolitically they're posturing and they're posturing over a couple of issues. One, they're concerned with the rhetoric of the Trump administration coming in. But I think to be fair, like as an observer of it, what you say before you get into office does not necessarily match what you do. Right. I feel like this is one of those things where Trump is posturing aggressively, like looking tough, going to be tough on China. China's tone, if you will, is adapting to that adversarial relationship. And so the revelations that they infiltrated the telecom system in the United States It came at a time, and it's quite possibly they revealed their hands deliberately as opposed to got discovered, right? But the reason they would do something like that is they would send a powerful message by not sending a message. You know what I mean? Like, we didn't break anything. We just— two things. One, your technology is weak and we are strong. Or your cybersecurity is weak and we are strong. And number 2, maybe you should have bought Huawei, right?

So there is a subtle— It could have been even worse because they would be able to influence that and be able to get into technology. Sure.

But then we wouldn't be surprised, right? You know, but it's interesting to me to see that tone, that change of tone a little bit in that the idea is that, listen, We know that messing with the power infrastructure of your country as a technological nation, you have way more to lose if you did that to us. Right?

Okay. Well, let's talk about that because that is, it's reinforcing foreign policy and we kind of want to get there. But I mean, for the last 30 years, this isn't new.

No.

The last 30 years we've been talking and seeing this. This hoovering up of data and unauthorized acquisition of intellectual property for more than 30 years, right? There was a document more than a decade ago talking about the trillion-dollar bleeding of intellectual property just from the United States to China. So we know they've done it, but I've always found it interesting that there was a line that was drawn. They would break into systems. And again, they would copy and move stuff out, but they wouldn't destroy anything. They wouldn't delete anything and they would cause no damage.

Right.

And if they thought, in many cases, if they thought they were going to be discovered, they'd back out. They would self-delete and back out. Hey, we weren't here. It was very stealthy and non-destructive. Right. But I think, you know, you're talking about some interesting things that are moving forward now where it's a little more aggressive.

Yeah, definitely.

Not just stealing documents on manufacturing. Hey, we're going to compromise your communication systems. We're going to be able to potentially listen in to sensitive government conversations and everything else. And they want to do that anyway, right? That's just es— international espionage. But being able to do that, And then now you've kind of overlaid it and said there may be things coming up, right? China has been very open. Again, they're very open. The 30-year plans, right? They've said in the next few years they have a goal to reunify Taiwan.

Yeah.

And they're increasing their military. They're doing more drills. They're doing all these things. And it's hard for me to believe if they do go down that path and Taiwan has already said, we're not going to go willingly. The US has said we're gonna defend them and Japan and Philippines and Australia as well. So it, it, it will be a hotspot. I cannot imagine them having this 30-year plan and this plan to reunite Taiwan in a few years militarily. Yes. And not have any cyber plans. Yeah. To be part of that. So, you know, there's probably, at least in my mind, they're coming towards a point where they need to prepare. Prepare actual destructive, actual offensive capabilities. And it's not just the game, let me get in there, snoop around, copy what I can and get out. It's, I want to get into critical infrastructure and wait.

100%.

I'm going to have a little red button and that red button is going to start destroying things. And if I go in and reunify Taiwan, there's politics around that that I won't get into. That'd take forever. But if, you know, they decide to do that and, oh, America, oh, Japan, oh, these other countries want to impose their will on what they look at as sovereign territory or their territory, they may hit that red button. And I'm sure they want it prepared. So, I mean, do you see that as a risk? I'm worried about it.

Yeah. So a couple of really interesting things. So Jen Easterly, who's head of CISA, She was at a conference, I think it was yesterday or the day before, put on by The Cipher Brief. And she sat down with one of the, you know, editors and whatnot. And he asked that very question. And she had to be careful in her answer.

She used— she's leaving after this term. Once a new president's in, she's out. She should just be opening the books of what what she thinks.

I, I want to put, I want to put a footnote beside that because I think there's a really interesting dynamic and actually a potential benefit from the Trump presidency. But I'll get to that after we talk about Jen. She said what we have publicly talked about was, quote, the tip of the iceberg.

Oh yeah.

So, so what that means to me is that's a very careful way of saying, hey, there's a bunch of classified stuff that we can't talk about. So if you think that national critical infrastructure, Volt Typhoon, and the pwning of the telco infrastructure is pretty shocking, right? There's other stuff. There's other stuff. And I think this is exactly what you said is that this is preparatory in the event that the issues around Taiwan, South China Sea in general, flare up. Now, Trump, this is the thing. We knew a couple of things about Trump. The first is it's predictable that he will be unpredictable.

Okay.

Second thing is every sort of geopolitical event will have one, in my mind, one thing that he will be after. Okay. Or maybe two. One is the out loud looking tough. That's super important for America and for the presidency. Second thing is, how do I personally benefit from whatever's going to happen? So I would not be surprised if as soon as the Trump presidency He figures out how to buy real estate in Syria and start developing hotels. Okay. But here's the thing. The Chinese, again, as we have talked about, totally transparent. They don't worry about the ethics so much or religious issues so much. They're very similar to Trump is how does China directly benefit from this relationship, right? To the exclusion of allies or other people, right? Their Belt and Road Initiative that they're pushing through all the way to India is about making China prosper by getting a piece of all the trading action that's out there. The development—

I mean, that's, that's been an initiative for a long time. They want to reinstitute, reconstitute the concept of the Silk Road.

Yeah. And, and they look at a country and they say, you have no infrastructure, the first thing we're going to do is build you infrastructure, new infrastructure. You know, and then we can land sea containers of the white goods that we have.

Exactly. To build the milk. It's a perfect plan.

It is a perfect plan. And this is where I think America and everyone else has to understand that China right now, in my opinion, has the upper hand. And this is where America is going to have to like really take a look, a hard look and say, You know what? Mistakes were made. And I'm not talking about the fines for like accidentally on purpose transferring military technology as Raytheon just got hit with a $200 million fine for an oopsie on that. I'm talking about the global supply chain. And we can't go to war with China. And then at the same time go, okay, we have now crippled our entire economy, right? Like we have more to lose than I think the Chinese do because the Chinese have other markets. You know what I mean? Like America does export, but they export a lot less than they consume because they're a consumer-based economy and not an export-based economy.

Now, could they change that? And we rely a lot on China for certain types of goods, right? Yeah. So we don't have a diversity in markets to be able to replace it.

No, that's like picking a fight with Mexico. Like, what are you guys going to do when it gets super cold? And you can't grow, you know, all the fruits and vegetables that the country needs. Or Canada. Why are you picking on Canada? Like, but again, keep in mind, this is the posturing. This is the rhetoric. This is the looking tough. This is the pandering to the base. And I think, I think again, when I look at the geopolitical situation, Xi Jinping, he has an idea because he knows, hey, President Trump's term is 4 years. I'm just going to put off the invasion of Taiwan for 4 years. See who's next. Maybe there'll be somebody that's going to meet me halfway in my demands. Maybe not. Doesn't matter, but he's going to be around until he's—

They're patient.

Super patient.

Yeah. They look at it at a 100-year scale, not at 4 years or 10 years or, you know, we're very short-minded. Okay. So we know China has been, you know, aggressively stealing intellectual property from the US, from the West, so on and so forth for economic benefit. Yeah. And there's, and that kind of gets into a little bit the difference between industrial espionage and economic espionage. I'll let the audience go look up the difference. It's pretty straightforward. But yeah. You know, and our government and other governments around the world have understood this. Some of them have kind of raised, you know, some alarm bells and, Some haven't, right? They don't want to rock the boat. And I, you know, I've had the benefit to sit down with, with two different former heads of NSA and CIA and talk about this behind closed doors. And they've got some very interesting insights as well.

Yeah.

But, you know, really, what are we seeing the US government and the US companies doing now to try and manage this risk?

Yeah, it's interesting because not a lot is the first answer. And the second answer is they're too busy eating their young. Like, this is the thing about China and Russia and these other adversarial nations. They figured out how to press buttons in the United States and the buttons they're pressing are like to, I'm going to say stratify, create the opportunities for, you know, dissension and a lack of unity and a lack of direction. You know, one of the great undoings in American politics was the fact that the Democratic Party could not take a position on Israel or Palestine, right? They had to take the middle ground, which angered one side of their base and, you know, placated the other. So it was a mess, right? They could not come out with a coherent policy on what Israel was doing or whether or not there should have been a Palestinian state. And this was a wedge lever that other nation states started pulling with disinformation. And as a result, like you saw a party that was initially thought that was going to, you know, give Trump for, run for his money and I want to give you— ended up running the board.

I want to get back to China here, right? What are— what do you expect the US government to do like in the next year or two? Do you think it's going to be any different? Are we going to see more attacks from China or less? Is the US going to intervene more? They've already sanctioned certain companies and said you're no longer here. You mentioned Huawei, right? And said, yeah, we're ripping out all your 5G equipment and you cannot install it here. We've worked with some of our allies to do the same thing. We're looking at social media platforms doing the same thing. Nope, not here, right? It's gotta be, it cannot be a Chinese company because we know if you're a Chinese company, you can be unduly influenced by China to insert, even if it's not there now, to insert backdoors, to conduct surveillance. What do you see the US government, whether it be law enforcement, whether it be congressional, whatever, doing in the next couple of years?

I feel like the lever that the United States can pull, and it's a pretty harsh lever, is really start buying back any debt that they had that is in the Chinese hands, and then essentially an economic war. So not a trade war, but an economic war that simply goes like, We are going to look at your financial situation and we are going to start pressing buttons and they're going to be painful buttons on your economy because we're in a position where we can look at developing Colombia as a low-cost, low-wage place to manufacture goods. And so the Americans can engage with South America. They can engage with Europe and start looking at alternatives to having to send stuff over to China. And you know who's there to pick up the slack? India, Pakistan, and Vietnam. All right now, many technology companies are moving towards Vietnam and Thailand as places which are out of kind of out of I'm going to say mainland China's viewpoint. They're still influenced heavily by Chinese and Chinese trade for sure, but they're starting to kind of blossom. So I think there's going to be a major effort made by the US government to diversify and move especially critical goods. But we have— that's, I'm going to say, the optimal result. The other problem—

long-term plan— it's got to be a long roadway.

And the other problem is going to get to it is the issue around rare earth metals that we need to power our, our advanced technology capabilities. And right now, China has a good solid lock on it. So what does that mean really in real terms? It means America And this is, again, this is the tough spot that Trump has put himself in, in saying things like, you know, we're not going to go over to other countries and we're not going to make investments in other countries. We're going to look after America first. But here's the problem. America has to come back to Africa. America has to go into South and Central America and develop those economies and develop a workforce that can take over all of the things that we've been sending over to China.

So it sounds like that there probably isn't a whole lot of interdiction that the government is going to be doing directly to stem the, the surveillance and IP theft of US companies over the next years.

Right.

They're too entrenched. They've been— they're too good at it. They've been there for a long time. They have the resources to find zero days, to buy zero days. To get into the communications, to get into high-tech companies, to be able to go deep, right? And be able to remain persistent even once they get in. So if the government isn't going to save the day, right? Then as leaders and security professionals of US companies or Western companies, what can they do?

Yeah.

Right? To help protect themselves and at least be able to have some say in managing these risks. And we're talking against a digital predator that probably is spending, you know, hundreds of billions of dollars on technology and infrastructure and everything else. So, they've got more money than you. They probably are smarter than you, and they may already know more about your infrastructure than you do. So, how are you going to step forward as a security professional as a CISO to make a difference?

You know, when it comes down to one of the most ugliest words in cybersecurity, data loss prevention, right?

That is ugly. It's an ugly topic.

It's so ugly because, I mean, we can email stuff all over the world. We can zip it up with a password and it goes through almost every single filter that we have out there. That's how we move malware around for analysis. So, so here's the thing. We need to really figure out how to turn the taps off. And right now, most firewalls in most enterprises are Swiss cheese. And what we're finding is that our attack surface is the sexy word for 2025, reducing the attack surface and business resilience. And in my mind, business resilience is against that that threat like ransomware and that type of criminal actor. But here's the thing: criminal actors doing ransomware attacks, doing data destruction attacks, are like basically APTs that have decided to go to war with you, right? If I'm implanted in your network, and you said it yourself, I can do anything, right? I can make you feel uncomfortable, or I can shut it all down. And so, this is the reality that I think business leaders have to understand. And then, they have to go to their cyber team and say, "Look, I think there's a credible threat that because we do XYZ in the marketplace, we're pretty certain that Chinese espionage, Chinese folks are going to be looking and are going to be after that." So first, it's threat model. So figure out if you're on the radar or not on the radar. And second is start figuring out how to plug those Swiss cheese holes in your infrastructure. We've been too loosey-goosey at the perimeter, I think. And cloud didn't help, Matthew.

That's a technical term, right? Loosey-goosey, that's a technical term? Okay, okay. Well, I think you're answering kind of like my final question, right?

Yeah.

What should cybersecurity professionals do right now, tomorrow, starting tomorrow? And I think you covered some important things. One, do a risk assessment, understanding that IP loss, IP theft from a nation-state is a different beast than a denial-of-service attack or a ransomware attack.

100% agree.

It's not a matter of, oh, I'm going to go to my backups. Your data may still be there. The fact is that that data is somewhere else. And once it's outside your perimeter, you're not getting it back. It's already been copied and duplicated. And shared with all your competitors that are now being built out in another country. So, you know, once it's out the door, so it's not about resiliency and response. There is no resiliency and response once that data is out. Once China has your IP, there's no response. Good luck, right? So, for those kinds of attackers and attacks, you got to weight it towards the front end, predicting and preventing. That means risk assessment. Understanding what controls you have in place, being able to detect things if they are going south to be able to contain it. Only give them half your data, right? If you can jump in there. You know, what else would you— you said the evil term, data loss prevention, DLP, right? Is that something you would recommend for companies that say, "Yeah, you know, this nation-state may be interested. I'm part of critical infrastructure." you know, should I be looking at DLP?

What do you think? Yeah, so I think it's part of the fix, if you will. I think when I say DLP, I don't necessarily mean a product. I mean your approach to data loss prevention, which could be less data, right? Figure out a way to get rid of all of the stuff that we've been carting around since we copied shared drives into SharePoint. But here's the other thing, and I'm going to say the other dirty word in cybersecurity: encryption. But here's the secret about encryption that a lot of people don't get. When the bad guys go in, right, one of the first things you do is steal a valid set of credentials. Well, if they have a valid set of credentials, all the encryption in the world isn't going to help you, mate, because guess what? You have valid credentials, so you're able to see this data. Right? So this is the thing, is figure this piece out. And maybe we need to start looking at some combination technologies, right? And what do I mean by that? I mean something like not only does it validate your access to the system, it decrypts the specific things that you need and doesn't decrypt all of the things, right? So we can start going back to compartmentals. I don't know, Matthew, you and I have been around a long time. You remember some of the old models that we used to have in the early days of SANS where they were talking about you could only access like one level up from where you were, right?

Well, intelligence communities still use that for various reasons. You've got compartmentalization, then you've got— yes. But that's, I mean, that's something that most companies, it's a little beyond that, right?

It very much is. And it would take an entirely different data structure and architecture to start pulling off. But hey, It's an opportunity space, I think, because I think we now understand, hey, we have this threat. It's absolutely persistent. It's absolutely a technological, innovative threat which will keep adapting to whatever defenses we put there. We need to lock it down. Now, the $1.98 question is, is how much, you know, inconvenience are we going to tolerate? Right? We're so used to getting everything, right? Like saving passwords in browsers and we're used to like, "Hey, trust this computer," right? As soon as you hit "Trust this computer," it trusts you and anyone else that might be on your computer, right?

So, there's always a cost, right? Whether it's dollars or whether it's friction to users, but if you want to crank up security, you're probably going to be tapping and increasing both. Cost and friction.

And maybe, maybe, and I'm just saying this, maybe we have to go to user IDs and passwords that are not directly attributable to your LinkedIn profile, right? You know, because so much of our lives are out there in digital format, you know, one way or the other. And I know many skilled pentesters, you know, the first thing they do is they're going to look at the org chart that is out there on LinkedIn, and then they're going to—

intelligence gathering, OSINT, baby.

Yeah, you know, how many, you know, advanced persistent threat operators are out there that, you know, advertise in their LinkedIn profiles, right? So, so I guess, you know, we have to start thinking about the enemy as we would if we were battling them and try to understand, looking at history, looking at the story arc that we just talked about in this video podcast and go, okay, these are the things that have occurred. This is how they've done what they've done. We need to guard against that, but we can't be complacent, right? The work is never done in cyber, right? Especially when you're going up against a nation state.

Yeah, I think, I mean, unfortunately you're painting a grim picture And I completely agree with it. It's grim. Hey, you've got a brilliant, you know, a threat that's going to come after you that has great experience. And, you know, the way you've been thinking about security against ransomware and other things, those may not apply. You may need entirely new tactics, and you need to understand this enemy and what they're trying to accomplish. And then you need to apply these potentially costly, you know, or impactful increasing friction to your users, your customers, your employees, your vendors, your partners to be able to mitigate that. And now you also have to explain it and justify it to the powers that be. That sounds like a whole lot of fun. It sounds like a very grim picture. I'm not seeing a whole lot of silver linings other than the fact that I think the more we talk about it and the more people understand the issue, the more, the more focus we get, the more the industry can communicate and collaborate together, maybe start developing some of those better tools, right? Maybe there's something we can bolt into Zero Trust, right? And use the anchor points there and the validation points there to, again, segment access or be able to inhibit things, you know, outflow of data, stop bleeding, whatever. But this is a topic that we could have had 30 years ago. We're having now. My concern is we're going to have it 30 years from now again and cover the same things. But I think it has been an important topic. And I want to thank you for sharing all your insights around here. I know you're passionate about this.

Yeah, definitely. Thank you, man.

We're all under the microscope here and potentially in the target sites. So thank you.

I think what's really fundamental of our understanding is we cannot go through an era again where a SharePoint administrator can steal some of the closely guarded secrets of the intelligence community by copying it to a CD and no one noticing, right? Like, and I think, you know, I think obviously the United States government has put a tremendous amount of effort into anti-espionage activity. You see the arrests, you see the indictments, you see what's at stake. And I think it is an issue of, of national priority for the United States, because if people keep— if people keep taking away the major technological innovations that the United States creates, you know, my worry is, is no one will want to create stuff anymore only to have it taken away and then, you know, remanufactured and sold to the world at the expense of the original creators.

So it will stifle innovation.

Absolutely.

That's what we're built on. All right. Hey, thank you again for coming in and chatting, and thank you all for watching. And be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders like Ian here to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. We'll see you next time.