Why Cybersecurity is Not Fixed Yet

Matthew Rosenquist. I've been in cybersecurity for over 30 years, 32, 34, something like that, on a wide range. So I was with Intel for 24 of those years. I justified, built, and managed Intel's first 24/7 security operations center. I landed and created and led Intel's CERT team. So anytime there was the company was attacked, I owned it. I was the incident commander so I could wake 6,000 people up in the middle of the night. And sometimes I did. I managed all the security for all of Intel's mergers, acquisitions, divestitures, site closures, and colocations around the world. Did all sorts of different things. I managed the playbook as I was talking earlier with Alex. I actually managed the security playbook and architecture for IA cybersecurity. So think about all the security capabilities and features and everything in Intel architecture, specifically around the core CPU chips, right? Things like that, IA security, all sorts of fun stuff. But throughout my career, I've really been focused on the strategy aspects, right? Yesterday's attacks, eh, it's a lesson. Today's attacks are interesting, but what most intrigues me is tomorrow's attacks. So throughout my career, I've actually done a lot of forecasting, right? Cybersecurity predictions, 1-year, 3-year, 5-year, 7-year, and even an unprecedented 10-year look ahead in the industry. I actually used to do it when we bought McAfee. I went over there and they asked me and I did their 1, 3, and 5-year predictions ahead and would sit down with customers and so on and so forth. So when we talk about what are those root causes, and this is a great topic, right, for why cybersecurity is still tough, it hasn't been solved. In fact, it's getting more difficult over time and we've thrown so much money So much time and effort into it. And yet it's almost like we're still slipping, right? We're not even gaining traction. You look at the impacts, you look at the losses, you look at the damages, you look at all these things, and they're only increasing over time. And it can be a little disheartening. But there is a story here to tell, and it's kind of an interesting one, I think. So let me show you a slide. And I think part of this is historical in nature. I did a keynote and actually talked about the fundamental engine behind cybersecurity and what causes, right? What are those chain reactions and what are those big elements that drive change in our industry? And unfortunately, we know what the change is like, right? It's more attacks, more losses, more impact, so on and so forth. But I presented this and said you had these combination of different things that we're going to get Worse. Anybody have a guess on when I actually presented this keynote? I presented this in '14. I actually developed this model back in 2007, 2009, right around there, right, as all this was starting to come to fruition. But the model had been solidified and a lot of predictions were made using these kinds of models. And if we look today, pick any one of those. Are they a problem? Did they manifest to be a problem? Absolutely. In fact, these are probably some of the big areas that we've looked at and seen turning points, right? So history has told the story when we understand what drives cybersecurity, right? What drives losses. And another thing that I tend to talk about is this cycle that we're in. And when we see certain things start. It just starts knocking over the dominoes, and we know we're in another cycle, and it's going to come back around, and we're going to see another blip. So again, understanding some of those things in the background, when we look at not so much the micro scale but at the macro scale, we can really kind of see what's going on. And back in the world, way back when, um, you know, we saw the world, and, and it's really complex when you start looking at some of those underlying pieces of data that we have to start fitting into those equations, right? The number of users, the number of software, or the amount of software and applications that are being written, right? Because if you go back to Carnegie Mellon and their software assurance, they say X number lines, in every X number lines of code, you will have a vulnerability, right? And so when you have billions of lines of code, guess what? The math is pretty simple. And even if you're off by an order of magnitude, it's still mind-blowing. The amount of vulnerabilities that you can have. And that's in hardware, that's in firmware, that's in virtual memory managers, that's in operating systems, applications, and even data structures. All those different things. Look at the amount of data that we have. We can't even imagine that amount of data, by the way. It's amazing. And over 90% of data is unstructured and it can't even be used, but it's being stored. So eventually it could be used, which means even the stuff we're doing now later on could be hacked. Even if you patch it, right? You may have data out there that can be exposed. Encrypted data is a great example, right? If you encrypted data stuff 10 years ago, I can decrypt it today. You thought it was secure then, but it's not now. So a lot of it's temporal. We look at the number of devices, IoT, IIoT explosion, and they're not really all that secure to be perfectly honest, right? So we've got more devices out there, and yeah, of course the attackers are gonna go after them. And not only go after them to hack them, but then to use them, corral them into these wonderful botnets that can go off and be used to attack other machines. So it's, you know, there's lots of different stuff here, lots of money flowing around, lots of risks, trillions of dollars going and being impacted because of cybercrime, and a huge chunk of that is going to the cybercriminals, but a lot of it is just cleanup. Right, a lot of those costs. So there's a lot of things going on, and we'll kind of get to how it kind of flows together. So some topic points, right? We are at a, at a point in time in our history where we look at the next generation or the next evolution of the Industrial Revolution. We look at the transformation from analog to digital, right? That we are embracing all these great things because, well, they're great. They make us efficient. They make us more capable. Right? I want my autonomous car to drive me home from the bar at night, right? Or, or to drive me to work so I can, I, you know, I can be on my laptop. I want all these different technologies because they make life easier, better, more productive. They connect and enrich our lives. But for every technology that we embrace, and especially those that we rely upon, they bring with them equitable risks. Risks. They bring it around security, they bring it around safety, and they bring it around privacy, right, which are the hallmarks of what cybersecurity is. So as technology explodes, the amount of impact and what can be attacked also grows with it. So we're in a battle not only with these specific attacks that some attackers is coming out, some hack or exploit, we're also battling The playing field that's growing ever larger, which enables the attackers to maneuver, target different things, maintain the initiative, do more damage. It all matters. So yes, we can pour tremendous amounts of money, time, and effort, blood, sweat, and tears, but we can't catch up with that technology innovation using those standard historical methods because those don't scale. They don't scale at the rate of the technology and integration growth or innovation growth. We've had it easy. All right, let's go back 10 years, 15 years. How many people remember Blue Screen of Death? How many people love it, right? You know, and that was the Windows error at the time when it was doing something bad, it blue screened, and it was always right in the middle of a presentation or right in the middle of a Word document, and and you lost part of your file or your connection. You had to reboot. You cursed at the screen. You pounded the keyboard once or twice. It finally rebooted after 4 or 5 minutes, 'cause that's what it took. And you went on with your life. Those were the easy days. What happens now when your autonomous car going 70 miles an hour down the freeway has an error? What happens when the power generation system on your electrical grid has a blue screen? Uh, yeah, people could die, right? We're reaching a point where technology failures aren't an inconvenience anymore that we curse at the screen. Technology failures, as we move towards greater reliance, right? Especially for critical infrastructure. Think about this: food distribution, the water, the cleanliness of the water coming out of your tap, right? Your electricity, everything. All those critical infrastructures are at potential risk, and each one of them potentially can cause pain, not only pain but death. So we are reaching a tipping point here where our acceptance of, fine, my data was breached, whatever, 10th time, you know, this month, and you move on with life to, no, this is— I don't want my children to get into a car wreck in my smart vehicle, right? So there's gonna be some changes here, and we're gonna start talking a lot more about trust in technology. So our jobs as cybersecurity professionals only get more difficult, and we become more focused and in the light to say, hey, you can't let this happen. Right, or go fix this, or why did you let this happen? It's tough. One of the other things that we as an industry struggle with is it's really easy to look at a technology and vilify it. Cryptocurrency is evil. Windows 95 is terrible. You know, whatever. Pick your poison. It's very, very easy to do that. And yet the reality is technology is simply a tool and it can be used for good or it can be used for bad. And in fact, in most cases, most cases, it's used for both, right? A hacker, you know, might create a scanner, which they did, to scan a network to find vulnerabilities. Well, that's a terrible tool. We should block that. Well, wait a second, because the security pros wanna use that exact same tool to see what's vulnerable so they can go patch it. Bad guy uses it to see what to attack. Good guy uses it to see what to patch. Same thing for network sniffers, right? You know, network engineers created sniffers to look at packets going back and forth to make sure that they could go back and forth, right? The functionality of networks. The bad guys grabbed those packet sniffers and said, hey, I wanna start mucking with packets. I wanna start ping of death, let's play. Again, technology is not good or bad by default, it's how we use it. But again, as more technology floods into us, we also have to understand it's our responsibility to start thinking ahead. How is this technology, it's gonna be awesome, it's gonna be great, autonomous vehicles or autonomous rockets or whatever you wanna call it. Right? Great technology. We see the benefits. We also have to take a step back and go, wait a second, what are those equitable risks that come with it? And let's proactively think and maneuver in ways that we still get the benefits, but we manage the risks of the bad stuff coming in. And we haven't done that in the industry. And that's why throwing more money, more time, more effort, pain, tears, all that isn't gonna get us where we wanna go. We have to proactively change the way we think. We have to be proactive, especially in the technology and the infrastructure that we're embracing and adopting at record speed, right? So it's more secure to begin with and it's more resilient, right? So lots of different things going on there, but until we do that, we will never catch up. In fact, even if we do that, we may never catch up, and there's reasons why for that. But that doesn't mean it all is lost by any means. Okay, we talked about it a little bit, right? As it scales, we know those risks are also there. And as we use technology in different ways, the risks then transform. But this is the playing field that the attackers have the advantage. They can choose where, when, how, right, to attack. In combat, we call it the initiative, right? The enemy in this case maintains the initiative. They decide when an attack is gonna happen. As a defender, I respond to that for the most part. That's what cybersecurity right now does. We are firefighters, right? We respond to the fire and go put it out. There is a little bit of preventative effort, but because the landscape is so big, because the vulnerability spectrum is so big. Not only on the technical side, but also on the behavioral and process side, right? The attackers really can choose. And for the most part, most attackers are lazy, right? They're looking for the path of least resistance. They're looking for the easiest target, right? When we look at all the vulnerabilities, and Microsoft actually did a study back in 2015, a good one, it was based on a 2006 study, but Siantha did one recently, right? When you look at the entire spectrum of vulnerabilities, do you know it's a fraction, a tiny fraction, right? Less than 8% of all vulnerabilities are actually ever exploited. Now, they all could be exploited, but the attackers are lazy like you and me, right? We want, we want the easy button, and they're only having to use a tiny fraction So even if we closed out some of those vulnerabilities, they would just go to the next easiest one. So we have to keep that in mind. Oh, we're just gonna have this new program, we're gonna close out the top 20 vulnerabilities. Congratulations, there's now a next top 20, right? So you gotta think bigger. And many times we don't. We look at the fire in front of us, we decide we're gonna put that one out. We look at the attacks of yesterday, We, you know, get funding and make things happen today. What we fail to do is to look how they're going to attack tomorrow, because if you don't get ahead of it, you're chasing them. And if you're chasing them, you're not very effective in your spending of money, time, effort, and everything else. And because of all of that, and we talked about how the attacks are getting a little worse, right? And life safety is that, that cliff is coming. We're starting to see a paradigm shift in consumers and in businesses and in governments to say, hey, we see where this is going. This is ugly. It's no longer acceptable. Now, 15 years ago, cybersecurity, it wasn't a C-level position, right? People didn't talk about it. Cyber insurance really didn't exist for the most part, right? And it was something relegated under either legal or mostly IT and you're 10 steps away from a CEO or a board. It's elevated since then, and it will continue to be elevated because it's going to be important in that trust in products and services is now feeding its way into purchasing criteria, which we said it would, for products, which means, again, it's more important not only for your infrastructure to be secure, but the products you produce and the services that you offer to be trustworthy, right? The other aspect is a lot of times security professionals will go, well, this is the worst it's gonna be. No, it's not. When we look at the evolution of the type of attacks, right, we see it really started with denial of service, which is an availability type of an attack, right? And this goes back 20 years, right? You bring down web pages, you bring down databases. Okay, it's a pain in the butt. Oh no, I got DoSed, whatever, right? The next big attack that we saw that lasted and still going, right? So is denial of service, by the way. Denial of service remains to be the largest number of attacks to date. Still does. We saw data thefts, and we've all experienced this. Your healthcare data was stolen, your finance data was stolen, right? And we warned the industry, this is coming. Coming out of that, we're starting to see this next one, which is an integrity type of attack. Ransomware, for example. Ransomware basically mucks with the integrity of files. It encrypts them. So we're seeing that. We're seeing SWIFT transactions get modified. Let me move a decimal point in this transaction or who it's being sent to. Right, we're gonna see that, but that isn't the end of the story because now we're just starting, just starting to see cyber warfare where it's pulling all these things together and we're seeing nation-states start to develop capabilities to say, I want to crush another nation. I don't need a border with them. I don't need trillions of dollars in defense spending. I can do it with a small team. I can even outsource it, but I want to bring down their critical infrastructure. I want to destroy their reputation or undermine their social structures or whatever. This is where you own and obliterate somebody. And that's still coming. We're not there yet. But our industry has to start to prepare for that because yeah, that's coming. That's the normal evolution in this Dante's Inferno. That's where we start going down. We talked a little bit about that single view, right? That single prism viewpoint of security. And a lot of times it was those obstacles. Vulnerability, that's the obstacle. Let me go squash it. And in reality, it isn't that way. We are dealing with highly intelligent, resourced, creative, motivated attackers. That means they're in opposition. Okay, if you move left to get around them, they're gonna move too. They're going to adapt to what you're doing. So this is a never-ending battle. In cybersecurity, we do not eliminate risk. We manage risk because everything is constantly changing. But this is one of the biggest failures in our industry. And it comes back from an IT and engineering mentality. And the example I always give when I'm on stage is if you have a power, a CPU, I'm sorry, a power go out on your server, right? You know what you have to do. You gotta go to the data center, gotta pull out the server, gotta rip out the power supply unit, slap in a new one, Put it back, turn it on, you're good to go. Okay, it's an IT problem. It's very, very simplistic. In fact, so simplistic I can script it and I can run metrics to do mean time before failure. So I can predict when any power supply is probably gonna go out and I can also predict mean time to repair, right? I can, okay, it's scriptable, it's easy. But when somebody on the cyber side attacks you, And you go, oh, well, I'm just gonna block that port. All right, then go find another one, right? So again, it's fundamentally different. It's a different game that a lot of people in the security industry aren't prepared for mentally. And that means their contributions tend to be very, very limited, right? Regardless of what budget that they're given. Know your enemy, yes, Sun Tzu, still applies. Guy was brilliant. But again, if we only look at ourselves and go, what vulnerabilities we have, and we don't look at the bad guys on what they're trying to target, what they're trying to accomplish, what their motivations are, there's no way for us to get ahead of that. And getting ahead of that is where you get huge value. This is actually a model, a defense in depth— well, it's a continuous cycle model that I developed way back at Intel when I built out the security operations center. And you'll see Remnants of this show up in NIST and what we see in NIST now where you've got identify, prevent, detect, respond. But what it's missing, and I was very vocal when, 'cause I was part of the input team for NIST when they developed it, it was missing predict. Most of what NIST does in that methodology, which is a great methodology by the way, but it's still lacking a big piece, is let's look internal, let's identify what we have and manage the vulnerabilities and make sure we've got recovery and all that, that's great, One thing you're missing is you don't even know who's attacking you. What are their motivations? What are they gonna target? What are their typical methods? Because then you can front-end your defenses. Peter the Great said, "Trying to defend everything equally means you defend nothing." And that's where we falter again, right? We have to align where the biggest threats are, which means we have to do a certain amount of prediction of where they're coming from, how they're gonna get in, And that's where we put the defensive line. I covered a lot. Questions, thoughts, issues, hit me.