The Cybersecurity Vault podcast with guest Tyler Cohen Wood

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, cybersecurity strategist and CISO at Eclipse. Today, we're going to talk about secure communications on the internet, how it is insecure, and why that is a problem, and, and what we can do about that to better protect our confidentiality and integrity of data communications. I'm going to be talking with Tyler Cohen Wood. Now, Tyler is the co-founder of Dark Kryptonite, a revolutionary special communication method of cybersecurity. She's also a host of My Connected Life: Digital Health Disrupted. She's Cyberwoman of the Year finalist in 2021 and the former Cyber Deputy Division Chief at the Defense Intelligence Agency. And lastly, she's a top 50 global cybersecurity influencer in this year, 2022. Now today's podcast is created in part by Eclipse, securing data in transit through any cloud, network, or device. Welcome, Tyler. It's always, always a pleasure to chat with you. Thank you for coming and talking with us.

Thank you so much for having me. I always love talking to you. I think you forgot to say I'm also an Aquarius.

I don't want to share too much. I mean, that's personal and private information. You know, I wouldn't want to do that to you. Okay, so internet security, right? You know, when it was originally created and designed, secure communications was not really in mind when they created this beast that we now call the internet. And essentially since that point, we've had all sorts of add-ons to try and fix the confidentiality and security of communications across the internet. How is that broken, right? And what do we need to start working on?

Well, I'll start by saying, you know, I've been in this industry for over 20 years and I have never seen things the way that they are now. You know, a recent poll, I think Trend Micro and Ponemon Institute put it out, that said 76% of companies expect to be hacked in the next 12 months. That's insane. That does not say that we're winning. And the problem is we have an internet that was not designed for security. And we just keep putting more and more bandages on a gaping hole, and it's clearly not working. At all. So we have to kind of look at what they're doing and see what we need to do differently.

And the problem's exacerbated, right, because we're adding more of, more of our sensitive information. We're becoming a digital nation, a digital world, and it seems like companies are putting more of not only their secrets but just confidential information, transaction information, information about, you know, Personally identifiable information, all those kinds of things, and maybe even innocuous information that in aggregate with these wonderful AI systems can derive sensitive results. So we're more reliant even now than we have been in the past. Do you see that trend changing?

I don't see that trend changing. What I do see changing is the way that we actually use the internet and secure our data. That I see changing. And I believe that, you know, we're gonna start seeing more and more peer-to-peer networks start up. You know, businesses like, solutions like Dark Kryptonite, which is, you know, essentially kind of a private cloud that you own. We're gonna start seeing more of those types of solutions, I think, because people really wanna get back to protecting their data, and people, in general also want their privacy and they want to know that the companies that they're doing business with are protecting their data. And with 76% of companies expecting to be hacked, I don't think they're doing that clearly.

So it's also about not only protecting the data, but also protecting the infrastructures potentially where the data is at and how it's being shared or, or controlled in that way. So why hasn't the industry fixed this problem, right? We're not at day one. The internet isn't brand new. It's been around for a while. Why hasn't this been fixed?

I don't know. I really don't know. I think it's kind of inertia, you know, the tendency for an object to continue doing what it's been doing. It's just what we do and it's what we know. You know, sus— you, you have to really suspend that knowledge of the internet as we know it, TCP/IP, all of the various protocols that we use. We have to kind of suspend that. And when you're talking about these special comms types of solutions, you really do have to suspend that because we're actually utilizing what we call the alternet, which is like the internet, but it's much, much, much more secure and it works differently. We're not utilizing TCP/IP inside of the Dark Kryptonite vault.

For the average user, everyday people, we kind of assume, right, our transactions are going to be safe, our data is going to be safe. We see the little lock or key on our web browser and think, oh, this is perfect. This is safe. Now that isn't actually true, and a vast amount of data isn't safe. What are some of the current risks that everyday people need to be thinking about? The, the consumers and the small businesses and medium— what do they need to be worried about?

They need to be worried about, um, things that are going to affect them personally or their family. Like, you know, for example, getting scammed, and there's tons and tons of scams. I mean, Medicare will not leave me alone. I get text messages, I get emails, and I know it's not Medicare. First, I keep, and everybody else gets these. And the thing about these scams that's just so crazy is if you really stop and think about some of them, it doesn't make sense. But the scammers are very well trained on what they do, threat actors. And especially if you're talking to them on a phone, like if it's a hybrid attack, they're very, very good at scaring the crap out of people. And I'll give you an example. I was literally just gotten off a plane, was in the lift to get to a cybersecurity presentation, and one of my best friends gives me a call and she's freaking out. And she's like, "Oh my God, I'm like involved in this." scam. I, I'm being— I may be held up on charges. I have to buy these Amazon gift cards to prove that I'm not a criminal. And I'm like, Jess, wait, whoa, whoa, what? And she said, yes, I asked the guy to send me his ID and he sent me his CIA badge, so I thought it was legit. And I'm like, Jessica, that was not legit. Do not give them any more money. Do not do that. Contact the authorities. But here's how it worked. They called her and said that they were, um, federal investigators and that she had been part of what they thought was an Amazon scam because it was happening to her, to her account. So to prove that she was not involved, she had to buy Amazon gift cards right then and there.

Well, that doesn't really make sense at all because the CIA needs you to buy Amazon gift cards. Absolutely, yes. Little side hustle they've got going on. Yeah, I don't think so.

Have you ever, ever heard— and I mean, my background is DOD— have you ever heard of any federal or intelligence agent sending someone a photo of their badge.

No, never, never, never, never. But you know, the people they're preying on don't know this, right? And again, as you mentioned, you know, a lot of the, the cyber criminals out there, they're well-versed. They're using psychology, right? They're appealing to authority. They're using a sense of urgency. They're establishing an unwanted consequence to get people to do something they want to do. And at that point, when you create such strong emotions of fear, panic, urgency— panic, yes— people's common sense kind of goes out the window, and they stop thinking why. They just want to do whatever they're told. And that's how those criminals kind of hook you. And again, it all comes back— if we're talking communication— if you can't trust the communication mechanism, the messages, the sender, whatnot. How do you know? And showing a badge or taking a photo of a badge, whatever, that does not give enough confidence. That's easily spoofed, fake. So how do we get past that? Because we've got email, we've got texts, we've got, you know, videos, right? I've seen fraud go on, on, you know, Zoom channels. How do we start fixing that?

Well, I think that it starts with a change in the way that we, we look at cybersecurity. And, you know, one of the things that, you know, I've noticed, I almost got hacked. I almost got phished. And you know why? Because I wasn't at my best that day. My dog had just passed away. I was really sick. And, you know, I got this, this scam about a speaking engagement in the UK. And I started, I, started going through the process, and then they told me I needed to pay them for a visa to speak in the UK. And I knew right then and there it was a lie, but I wasn't in my best place. So we cannot— it's very hard for me to expect for people to become cybersecurity experts when they're— they haven't spent their whole careers doing it. So It has to be a combination of both, but there are so many threats out there now that, I mean, how many phishing attempts do you think that you get a day? Because I know I get about 8.

I get double digits almost every day across all my different emails. And I'm also in the email logs for my company. And so I'm seeing all the ones that get blocked and everything else and trying to aggregate and figure out, okay, is this a campaign? Are they targeting individuals? So on and so forth. What are they really going after? All sorts of things. It's a problem. And I think you're right. It cannot just rely on the end user applying common sense all the time because, you know, you're going to have bad days. But also some of these attacks are getting very, very sophisticated. It looks legitimate. The domain is correct. It's typed well. It's using, you know, colleagues' names or what appears like it's coming from their accounts. So it's tough. And so I think you're right. We need a combination. We do need those good behaviors and common sense to prevail. But I think we also need strong technologies that can take the brunt of that work. And a good mail filter, for example, should filter about 94, 96%, right? Maybe 97% of all the phishing and malware and so forth coming in via an email. Which is great, right? On a good day, you get rid of 97 out of 100. But given that thousands are flowing in, that still means a handful gets out to those end users. And it just takes one mistake.

I know, I know. And I mean, I know that, you know, corporate cybersecurity, government cybersecurity is important, but personal cybersecurity is also important. Because I've actually seen the bad end of the worst-case scenarios and what can happen. You know, I started off doing digital forensics in major crimes cases where there's a lot of exploitation of children, and some of these cases were— it was just absolutely horrific. And, you know, I— people really need to be serious about it. And what's interesting too is the techniques that you will use to secure your your private life and your family's life are literally the same exact tactics that you're going to do to secure your company. Because, and if you say to someone, if you click that link, you could be getting ran— you could have your company get ransomware. Well, no one wants to be that person, but it's, you know, but if I say the same thing, if you click that link, not only could your company get ransomware, but you could actually be inviting hackers into your home Giving them full access to your daughter's phone and camera. I mean, that makes people listen because it's true.

Yeah, there are ramifications, right? If your system gets hacked and if it's the family system or your personal system, it can bleed over into your work environment and vice versa. If it's your work system, it can bleed over into your home environment, especially as we're working from home more and more. Now, I do want to get into, you know, some ideas and concepts around technologies and how they should be evolving and we should be embracing. But I'm going to put a pin in that just a second because you brought up something that I think is interesting, and it's, it's about balance, right? There's always a good and a bad side. We can talk about technologies that secure and protect communications, and we definitely want those, right, for, for good people, good transactions. But you had mentioned, you know, the criminals that are doing horrific things, those criminals, and I'm familiar with many, many different cases out there, they're also using that same technology, in some cases more so than the companies, right? They're using that to hide their criminal activities, right? Exploitation of children, so on and so forth. They're using these. So there needs to be a balance, I would imagine, right? We want to be able to secure our good communications, but We also want to make sure that the bad communications out there are still accessible to law enforcement so they can see these bad things go on and shut them down. What are your thoughts about that balance and how we get there and how we maintain it?

Well, my thoughts are, you know, the bal— there is no balance right now. The bad guys are way, way beating us. But, you know, by simply borrowing some of their techniques and, you know, using some of that actually against them and creating new technologies that they don't know how to break yet is really kind of the way forward. And I believe that we can actually change the balance, but I also think there's a lot of global collaboration between security companies that really has to happen. Because without that collaboration, you know, we're dead in the water. You know, together we're a lot stronger. And, you know, I've, I've known that from when I was at, um, at DOD, we would work with other labs to see, you know, what things they were seeing and it helped us with, with, with cases. So communication is extremely important.

So let's talk about some of the technologies that are currently in use and, and maybe some of those technologies looking forward into the industry where we need to go, because there are lots of challenges. You know, we've got SSL and TLS and we've got symmetric encryption and asymmetric encryption, keys and passwords. And, ah, you know, it gets crazy. You know, what's working well right now that you see in the industry and where does it kind of trail off and we need more help?

I mean, there are some success stories, but it seems to me, and I'm not usually like a negative person, but it seems to me as if there are a lot more kind of negative stories. You know, I think when hackers start going after hospitals and that type of thing, holding patients' lives at ransom, that's just ridiculous. And we do need to change this balance, and I believe that we absolutely can. But it's gonna take a shift in how we think and how we do things. It'll be gradual, but it is doable. And I do believe that that is something that we will see and that will happen.

So with a lot of systems, right, like a webpage, a webpage allows for anybody to come to it. Are you talking about locking some of those networks to where something has to happen before somebody can get to it? Or are we, you know, what kind of security are you talking about here that can help organizations like hospitals protect their data and stay up and running?

Well, if they have their data in the Dark Kryptonite environment and they're using, you know, the B2B email service to send things back and forth, chat, really any application that they need to use there, well, it's going to significantly improve their security posture because it literally cannot get ransomware. It can't happen. Ransomware needs a way to propagate. Phishing, once in, is also malware which needs a— it looks for specific things to propagate. It's looking for TCP/IP access controls. It's looking for all kinds of these different things that we're used to. But when you remove all of that and you create an alternate that sits beneath, beneath, beneath the internet and just uses different types of protocols, but still allows the user to do everything that they were able to do before seamlessly, you know, that, that will, that changes things entirely.

So you're talking about in order to undermine what the attackers are expecting, to change some of the fundamental underpinnings of networks and I would assume access controls as well?

Oh, absolutely. Absolutely. It is zero trust by default. That's how it was built.

And zero trust is a huge buzzword out there. And there's no individual product that delivers. I mean, it's a concept, right? Microsegmentation and validation for connections and everything else.— and we're seeing a lot of traction in that. And I agree, I think that's really— I mean, we've been talking actually fundamentals of zero trust for almost 20 years now, but it's starting to catch up, right? We're seeing the normal networking and authentication and access paradigms, again, crumbling, as you said, under the pressure of the attackers. And something like zero trust or any type of mechanisms where you're elevating those controls change the fundamental problems to the benefit of the defender and put in a lot more barriers for the attackers. Is there a particular area that you think is most beneficial? I mean, we could change lots of things, spend insane amounts of time, money, energy, create incredible friction that for poor end users Are there areas in this space that you think are more important to, to address, uh, and a bigger return on investment when it comes to securing communication?

Well, yes, I do. Um, you know, especially if you're dealing, if you're talking about, um, someone's physical health, if you're talking about the healthcare system in, in its entirety, that whole ecosystem needs to be secured. And it's, and that's dangerous because You literally have people's lives at stake. But, you know, there's other things too that, that really need to be secured, like, um, genetic databases. You know, take that as an example, because if I was a threat actor, you know what I would do is I would develop a biological weapon based on a genetic profile that I wanted to get rid of and let it loose.

I mean, okay, we're not letting you near the lab or petri dishes. That's number one.

And then I worry about things like, well, so if you have a medical implant, well, can that be hacked? Well, yes, it can. And literally holding people's bodies for ransom. I mean, it's really scary. And that's why it's such a serious problem and it needs to be taken seriously.

Yeah, and we've seen exploits like that be published around defibrillators, implanted defibrillators. As well as pacemakers, where somebody in theory could hack them if they were in close proximity. And that's generally not a good thing if you have a pacemaker or an implanted defibrillator. What about— so you had mentioned healthcare and, and, you know, personal data. What about critical infrastructure? You know, our power, our food supply, logistics, communication, all those things.

That's where I was going next. You know, you've got, like you said, the power stations. You've also got water treatment plants. You've got sewage. You have a lot of these public utilities, and a lot of them are using these kind of legacy systems still. And, you know, these type— these things have to be secured. And if you need to use the legacy system, well, then you have to put it in something that's going to provide security for it because You know, for the longest time we've been balancing cybersecurity where, you know, we can take the steering wheel, the engine, and, you know, the doors off the car and no one's going to steal it, but we can't use it either. So that's, that's where the balance is. It's somewhere in there.

Yeah. The, the safest computer is one that's off buried 6 feet in the soil on the moon. Yes. It's super secure. Not very useful.

Well, and you— that's the problem right there. The problem is if you have a public-facing IP address, you are hackable. You are on the internet. And if you don't have that, right, you're exposed. But if you go deeper than that to where you don't actually have that same type of methodology, it just changes everything.

And attackers are great at developing tools and then propagating them. And again, a lot of those tools expect a certain type of environment. Right, a certain IP environment, a certain naming conventions, calls to DNS, things of those, of that sort, as being embedded in these tools. And when you go off script, as it were, those tools tend not to work very well and can actually start creating a lot of noise to alert people, hey, somebody's trying to do something really bad. And then that leaves the very elite who don't need those tools, who are doing it all by hand, um, and, and that greatly reduces the threats, right, the community of threats that you have to work with. So looking at evolving technology, because part of the problem we have, right, is technology moves so fast, the internet moves so fast, you know, they didn't embed security into it. But when we look at things like quantum computing, when we look at things like AI and the power around that, How is that going to further shift the problem? I mean, we can come up with potential solutions for today, which may take years to put in place and for everybody to adopt. But the technology landscape is constantly changing as well. We have to kind of skate to where the puck's going, not necessarily where we're seeing now. So what kind of problems or challenges do you see with quantum or AI or anything else moving forward?

Well, I think the problem is there's going to be a kind of a learning curve here, and we're actually seeing that more with AI than we are with quantum computing, because I believe that a lot of the power from quantum computing is years away. The cat and mouse game continues because we're using AI, but so are they, and we're going to use quantum computing. And so are they. So we, we have to have something that just breaks the cycle because there's been new technology created, but the problem has gotten worse, not better. And that could just be based on sheer magnitude of, of devices and, and, and, you know, people out there. But the problem is worse, the problem is not better.

So we're going in the wrong direction is what you're saying. And we need fundamental change to drive security and the foundations.

Absolutely. I mean, that's, that's, that's why we're here. And that's why we do what we do is because we want to keep people and their businesses and their families safe and secure. And we do, I mean, people talk about, you know, digital disruption and digital revolution, but What that means is that really does mean a very significant shift in at least part of how we use the internet. It's a paradigm shift. You don't have to deeply secure the communications of every single transaction that happens at a business, but there are some things that you do need to secure, and you don't want people that should not have access to to those documents or whatever it is to have access to it. And so, removing that from the picture and putting it into something else that is a different methodology and is more secure, well, I really do believe that it's solutions like that and solutions that are yet to come that are really going to make a big shift and a big difference in the playing field. And I would love for, if it was evenly balanced, Even that would be great.

Yeah, it's kind of stacked against us in security. We're always behind whatever the attackers are doing.

And people don't like us because we're always telling them what they're doing wrong.

And we're costly too, right? We make them come up with these weird long passphrases and everything. Okay, so, so in kind of conclusion, what we're talking about here is we live in a world where digital communications just aren't really all that secure. And the bad guys are getting better at undermining that. And companies and organizations which have and possess that sensitive data and information value are getting brutalized more and more every year. So my last question to you is, you know, we've said security and change has to happen. We have to get better. But change is not easy, and it's typically not free, and it normally comes with additional demands and friction for those poor end users. So what will it actually take for people, businesses, even governments to invest and embrace more robust data confidentiality?

I think that's starting to happen, and I've really kind of only noticed it in the past year or two where the government is actually much more concerned about cybersecurity, you know, than, than they have been previously. And, you know, even when I was at DIA working there, you know, it wasn't— it's important, but it's not as important as it is— it wasn't as important as it is today.

So do you think government will take that leadership and from there push into businesses, maybe with regulatory issues, and that eventually cascades down to end users, that they're going to see security in that way?

Yes, I— that, that, that will happen. And oftentimes that's how a lot of change starts, is by regulations. But I kind of think it's going to happen in tandem too, because You know, the cybersecurity world is kind of scared and, you know, we're really working very, very hard to do whatever, you know, we can to sort of at least tame this problem that seems very, very out of control.

And do you think this solution, this evolution that you're talking about, will it come quickly? Will there be just a watershed moment, a major crisis, and then all of a sudden we lean into this quickly? Or do you think it's going to be kind of a slow burn year over year? We get a little better, we get a little better. How do you see that kind of playing out?

I think it's probably going to play out as a slow adoption. I hope it isn't a slow adoption, but it probably will be because that, that really is how things get started. Like you said, zero trust. You know, we're talking about that for a long, long time, but now it's a big thing. So it's kind of these gradual changes unless something terrible happens and then it won't be so gradual. It depends on what happens. Catastrophes.

Catastrophes. They tend to change people's perspective pretty quick. Yes. When you're feeling the pain, when your pants are on fire, you tend to move very quickly and do the dance.

Yes.

Okay, so if you had one message to give to those small, medium, and even large organizations, right, when it comes to their concerns around secure communications, what would be that one thing that you want to just shake them and go, "Listen," right? What do they need to know?

They need to understand what they have in their possession, in a third party's possession, And they have to know how things are being configured and where their security responsibility ends and the other company's begins and vice versa. And I think that, you know, there's a lot of companies that may— don't exactly know where all of their inventory is or what all they have and what all has to be secured. And, you know, I think you can't secure a network if you don't know exactly what you have. The other thing I would recommend is, you know, if people don't need access to specific documents, you have to have an access control system in place. I mean, it just has to be there. And, you know, I do believe that there is hope for the future, and I do believe that we will start seeing some of these shifts. You know, but again, it's going to take time. And it's also going to take, you know, the world sort of trusting these new cybersecurity kind— technologies.

Tyler is the co-founder of DARPA Kryptonite. So if you are serious and interested in protecting your critical data, please go out to their website and learn more. Thank you all for watching. And Tyler, thank you for joining me.

Thank you for having me.

Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices.