From the fizz of soda pop to the buzz of cybersecurity – witness Joe's extraordinary journey through the tech landscape. Our latest podcast episode takes you through a narrative of unexpected career leaps and the critical role of intelligence in the digital age. Joe, a former soft drink enthusiast turned cybersecurity guru, shares tales from his early tech escapades to his pivotal role at iDefense, where his collaboration with government agencies like the NSA, painted a picture of a complex and ever-evolving cyber battleground.
Unravel the twisted tale of Anthony Lewandowski's controversial departure from Google, highlighting the precarious nature of intellectual property and insider threats. This episode peels back the layers of corporate espionage, discussing how companies like Code 42 are at the vanguard of detecting unsanctioned data movement. We tackle the ethical quandaries posed by the race for innovation, where the lines between ownership and fair competition often blur. The discussion showcases the intricate work of safeguarding expansive AI datasets and the careful balance of advancing technology while maintaining integrity.
Navigating the murky waters of data security, we dissect the nuanced approach required for managing insider threats. Balancing an investigative eye with the necessity for swift action, our conversation sheds light on how companies toe the line between education and enforcement. As we discuss the limitations of traditional DLP systems and the emerging prominence of cloud monitoring, you'll gain insight into how organizations are adapting to the challenges of ensuring data remains in the right hands – all while contending with the unforeseen risks AI platforms like ChatGPT might present to data security. Join us for an exploration into the strategies that fortify companies against the tides of insider threats.
Affiliate Links:
NordVPN: https://go.nordvpn.net/aff_c?offer_id=15&aff_id=87753&url_id=902
Follow the Podcast on Social Media!
Instagram: https://www.instagram.com/secunfpodcast/
Twitter: https://twitter.com/SecUnfPodcast
Patreon: https://www.patreon.com/SecurityUnfilteredPodcast
YouTube: https://www.youtube.com/@securityunfilteredpodcast
TikTok: Not today China! Not today
1
00:00:01
Speaker 1: I was going.
00:00:01
Joe, it's great to finally get you on the podcast.
00:00:04
You know, I feel like we've been trying to get this thing
00:00:07
scheduled for quite some time now, but you know, with with
00:00:11
with our schedules being so hectic, you know, I'm glad that
00:00:14
we could finally get on.
00:00:16
Speaker 2: I think it's you know , you and I spent a lot of time
00:00:18
with the hairdresser, I think, and so getting our appointments
00:00:23
all lined up without a podcasting, that was probably
00:00:25
the difficulty here.
00:00:26
Yeah.
00:00:26
Speaker 1: Yeah, and this head of hair.
00:00:29
You know it doesn't maintain itself, it is necklace.
00:00:33
Speaker 2: Yeah.
00:00:35
Speaker 1: So, joe, you know why don't we start with you.
00:00:39
Know your background right, how you got into it, how you got
00:00:43
into you know kind of the security side, what made you
00:00:46
want to go down this route, was there, you know, something that
00:00:50
you maybe discovered earlier on in your life that you know kind
00:00:54
of took you down this path.
00:00:55
When you're looking back on it, or what was I like?
00:00:58
Speaker 2: It's my story to a little different to probably a
00:01:00
lot of your tests, because I my first job out of school was
00:01:05
actually the soft drink business and I was working for Coca Cola
00:01:09
in marketing and you know I was having a lot of fun and soft
00:01:15
drinks, you know commercials and all kinds of crazy stuff.
00:01:19
But I remember at the end of one year we grew.
00:01:22
It was like we had a great year and we grew 6% and I was like,
00:01:28
hmm, it got like in a different industry it grows a little
00:01:31
faster than beverages and I was always interested in tech, and
00:01:36
this was the mid 90s and tech wasn't made back then.
00:01:39
I need to think about it.
00:01:40
You know there was no social media.
00:01:42
There was very little internet.
00:01:44
Very few people had email addresses.
00:01:46
When I first joined in tech, I'll just tell you a funny story
00:01:50
about myself my first email address was Joe and Karrosh,
00:01:55
which is my wife's name, at AOLcom, and at the time we
00:01:59
thought, well, every family would just have one email
00:02:01
address, you know, like you have one physical address, and so we
00:02:04
had a shared email address.
00:02:06
So that's how far back I go in tech.
00:02:09
But then I got interested in security in the early 2000s.
00:02:13
It was a murdering space, an exciting space and I was the CEO
00:02:17
of a company called East Charity the first SIM products
00:02:20
way back in the day.
00:02:21
And what really turned me on as security was when I worked at
00:02:26
iDefense.
00:02:27
At iDefense we worked doing threat intel and our customers
00:02:32
were all of the three letter agencies in the government, all
00:02:36
the largest banks in the world, and at the time I also got
00:02:41
security clearance.
00:02:42
And so when you get connected to the three letter agencies and
00:02:47
you're looking at all of the things that are happening in
00:02:52
cybersecurity, it's tentacle could be exciting.
00:02:55
And iDefense was a lot of fun because we had white hat hackers
00:03:00
.
00:03:00
We were also tearing up software around the globe with
00:03:07
our white hat team just trying to get ahead of the bad guys.
00:03:10
So it was a lot of fun back then and I was getting
00:03:14
interested in security ever since.
00:03:17
Speaker 1: Yeah, it's interesting working with the
00:03:20
government.
00:03:20
Earlier on in my career I worked for a very small company
00:03:25
that did Enhanced 901 software and so the government was a huge
00:03:31
consumer of our product and somehow I finangled my way into
00:03:39
leading the entire tech side for our government clients and I
00:03:45
mean it really does just like open up your mind into what's
00:03:51
possible.
00:03:52
And I feel like it's a different way from government
00:03:55
employees, because the government employees are
00:03:58
typically very siloed and as a contractor you can come in and
00:04:02
say no, I need to know what's going on over here.
00:04:06
I know you normally don't tell people, but this impacts my work
00:04:09
of how I provide this product, and so I need to know these
00:04:12
different pieces.
00:04:13
And so you learn probably way more than what you should
00:04:16
actually learn in some cases.
00:04:21
And it's always interesting because I was going to a
00:04:24
facility for maybe a year or two and I never knew what they did.
00:04:30
I mean, you're in the middle of the mountains West Virginia,
00:04:35
something else is around, like a town was built around this
00:04:38
thing to support contractors coming in and I have no clue
00:04:44
what we're doing.
00:04:44
And one day I guess my handler that's what I called him my
00:04:51
handler at the facility.
00:04:52
He was like Joe, do you not know what we do here?
00:04:55
I said I have no clue.
00:04:57
I literally have no clue.
00:04:59
And he pointed to these satellites that were, these
00:05:04
giant satellites on the on premise and told me one of the
00:05:09
small things that they did.
00:05:10
And I'm like my God, where am I ?
00:05:13
Speaker 2: Well, Joe, you just there's a couple of great points
00:05:16
to kind of for first.
00:05:17
So I'll say my area of expertise now in cyber is
00:05:21
running cyber threat and insider risk, and so you just
00:05:24
identified a couple of things around why it's so important.
00:05:27
Because, to your point, like contractors in particular do you
00:05:30
get a lot of knowledge around things, and so contractors will
00:05:34
end up biggest risks on the federal side.
00:05:36
But the other side I think it's just as important to touch on
00:05:40
and I often have to talk to the old people on my teams about
00:05:43
this and that is that the United States government is, in my
00:05:48
opinion, the best in the world in cyber.
00:05:51
I mean the best in the world.
00:05:53
What's interesting about that is that when most people think of
00:05:57
government employees, they think of people that work in agencies
00:06:01
and are stereotypical.
00:06:04
Oh, these government employees, they don't work that hard, they
00:06:08
just shut along.
00:06:09
It takes a long time to get the government to do anything.
00:06:11
You know all these stories et cetera, but what I learned in
00:06:15
working with our Intel community , our long course community
00:06:20
around cyber, is that we literally have the best people
00:06:24
in the world at the NSA in particular, at the FDI, a little
00:06:30
bit at the CIA, in the military , we have the best people in the
00:06:34
world.
00:06:35
In cyber, we are nobody's better than us, and that level
00:06:40
of understanding and respect is really important for all of us
00:06:45
that work in a cyber community, and so I'm glad you brought that
00:06:49
up, something that I think we can be really proud of, and it's
00:06:52
something, honestly, that's just very safe as a country.
00:06:56
Speaker 1: Yeah, you know, it's very interesting that you bring
00:07:00
that up, you know, because sometimes, as from the outsider
00:07:06
perspective, right and I'm talking about people that aren't
00:07:09
even in cybersecurity it looks like to them that we're so far
00:07:15
behind everyone else that we're not capable.
00:07:21
There's too much bureaucracy.
00:07:22
And I will say this there probably is too much bureaucracy
00:07:27
, right, but at the same time, I know the crowd of security
00:07:32
professionals and we need those rules, because if we don't have
00:07:36
those rules and you just say, you point us towards China and
00:07:40
you're like hey, you've got the power grid, you know go have fun
00:07:44
, right, like yeah, it's going down and they won't be able to
00:07:48
recover from it, but like that's something you know you want to
00:07:52
really tie it, tie into other things and really control, right
00:07:56
, and it's a.
00:07:59
It's fascinating that you bring up.
00:08:00
You know that we have that talent pool there, because I
00:08:03
actually had on someone maybe two years ago at this point and
00:08:08
the episode was never released because the military asked me to
00:08:12
not release it and you know I do not want the United States
00:08:15
government showing up at my door for any reason.
00:08:19
And you know he talked about how the training that he was
00:08:27
going through is a two year program, for you know, one of
00:08:31
the three letter agencies.
00:08:32
It was a two year program and he said, literally every single
00:08:36
day, at any point in time, you can be cut.
00:08:39
If you write an inefficient line of code, if you, you know,
00:08:43
do something that you shouldn't have done, if you put it in the
00:08:47
wrong language, whatever it might be, you know you can be
00:08:50
cut right there.
00:08:50
That's the standards.
00:08:52
And he said you know only a very small amount of people actually
00:08:55
make it through and you typically have like a six to 12
00:08:59
month ramp up time before you even go to the school and you
00:09:04
know those standards.
00:09:06
They come into play in the real world because now you know what
00:09:10
the bar is, you know you.
00:09:11
You kind of know what you're expected to do and what you're
00:09:15
able to perform at and whatnot, and that's expected of you.
00:09:18
You know day in and day out, and I feel like I've always felt
00:09:23
like we've had the best cyber capabilities, for sure.
00:09:26
And if you just look at the things that have leaked, you
00:09:30
know, though, like eternal blue and how many, how many zero days
00:09:34
came out of internal blue, right, and that's, you know.
00:09:39
That's 10 years ago at this point, Well, it's interesting.
00:09:42
Speaker 2: So you know, first of all, and work, I will tell you
00:09:45
that in working with the NSA, I interacted as much with lawyers
00:09:49
at the NSA as with the, with the cyber experts.
00:09:53
That's how careful they are at following our laws and so you
00:09:58
know they're not.
00:09:59
You know they're not doing things that are the older, very,
00:10:03
very, very careful.
00:10:05
That's something that they share.
00:10:08
But you mentioned there's not enough data sharing and stuff
00:10:11
like that.
00:10:13
All the leaks we had in the US have really been because
00:10:17
coastline alumn, the cyber community, you know, created
00:10:23
tools to share broadly the intelligence and there's over a
00:10:27
million people that have street clearances, that have access to
00:10:31
some of our nation's most you know, sensitive information and
00:10:36
that you know.
00:10:37
The Jack Tech Sarah, you know, leak recently is because it just
00:10:41
takes one of those people to use that information the wrong
00:10:46
way out of a million people.
00:10:48
So that's a half every month.
00:10:50
So the price that we're paying right now on those leaks is that
00:10:53
we give a lot of access to people and because we want to
00:10:58
share that data and, you know, one a bad thing to the change
00:11:03
and can cause that change.
00:11:04
So it is an interesting balance .
00:11:07
I know there's a big back and forth and you tell those
00:11:09
community about that at all times.
00:11:11
But honestly, I only wanted it.
00:11:14
We all need to dwell on it.
00:11:15
I just find that point out to your list, or is that like if
00:11:19
you're young and you're like not sure about these things, you
00:11:23
haven't come?
00:11:25
Just know that the people that are protecting us from a serious
00:11:30
death by someone that has to the world, and that's a good to
00:11:33
know and it's also important to respect.
00:11:37
Speaker 1: Yeah, absolutely, you know to dive into the insider
00:11:41
thread a little bit more, right, do you think that these Snowden
00:11:48
leaks kind of set the stage for you know all the other leaks to
00:11:53
follow.
00:11:54
Right, how big was that, how meaningful was that from a you
00:11:59
know quasi insider, you know expert knowledge, right, like
00:12:04
you probably have a little bit more knowledge on that leak than
00:12:06
anyone else.
00:12:08
Right, like, what was?
00:12:10
Speaker 2: that like that was a devastating leak.
00:12:12
I mean, that was a devastating leak for the United States.
00:12:16
You know, people lost.
00:12:19
Some people lost their lives over that leak because there was
00:12:21
so much information that she ended up in hands that it
00:12:25
shouldn't have ended up in.
00:12:26
And I think it was also devastating for Booz Allen and
00:12:31
their reputation, because he was a Booz Allen contractor and it
00:12:35
was so basic.
00:12:38
I mean, all thumb drives were supposed to have been, you know,
00:12:45
all external drivers were supposed to have been blocked,
00:12:49
you know, and they just hadn't gotten to that facility in
00:12:52
Hawaii to put those controls in place, and so it was easily
00:12:56
preventable.
00:12:57
It keep with policy would improve.
00:13:00
So it was careful, but holding up the level.
00:13:05
Look, here's the thing about insider thread and insider leaks
00:13:08
.
00:13:08
We're always going to have them and so you have to really put
00:13:13
controls in place.
00:13:14
But you know, back to this conversation about sharing data,
00:13:18
you've got balance tag with the need to share and collaborate
00:13:25
and if you step outside the document for just a second, we
00:13:28
go into corporate, which probably most of your listeners
00:13:31
are corporate.
00:13:33
I think what surprises people is how pervasive data is making
00:13:38
out of organizations today.
00:13:40
So we all might say, oh, you know so, do so, but haven't done
00:13:44
anything so stupid, or how could we be so stupid?
00:13:47
I've got that happen and up, up , up, up, looking your own
00:13:50
backyard I mean we, when our company was specialized in
00:13:55
helping organizations on insider threads we first come in.
00:13:58
What surprises our clients is that the amount of data moving
00:14:04
out of the organization is incredible.
00:14:05
Literally every single person that will reach your
00:14:08
organization for a new job takes a lot of critical data.
00:14:12
Literally every single one.
00:14:14
60% of people admit they took data from their last job and are
00:14:18
using it in their current job.
00:14:20
That's the people that admit it .
00:14:22
So, even if I said it's probably more like 90%, and so
00:14:28
it's really.
00:14:29
You know, what's interesting right now is that the whole fn
00:14:33
of AI and the datasets around AI people are finally starting to
00:14:37
pay attention and say, oh, wait a minute, do I need to be
00:14:40
worried about my source code leaving or my large ASS leaving,
00:14:45
or you know whereby, your customer lists or et cetera, etc
00:14:49
.
00:14:49
So we're seeing a real assertence in people because of
00:14:54
the focus on AI datasets.
00:14:56
But, to be fair, that's just a very small to the I for what's
00:15:02
actually leaving and most organizations.
00:15:04
We see a lot of source code, customer lists, hr data.
00:15:09
We see that all the time.
00:15:12
So it is an area I'm glad is finally getting some attention.
00:15:18
We can talk about sort of different stories around that
00:15:20
and how it's happening, why, but on the corporate side, just to
00:15:23
touch on the, you know, on the stone side, on the corporate
00:15:28
side, the breach that Millie sort of woke everybody up in the
00:15:32
last few years is Anthony Lewandowski, who took data from
00:15:37
Waymo which is all their self-driving car data and, just
00:15:41
like Snowden, took just a troll of the information, lewandowski
00:15:45
in the last week of his his time at Google or Waymo online, who
00:15:51
walks to all that data, and he just took it on an external hard
00:15:55
drive and then used it for a year before they realized it.
00:16:01
And they only realized it because one of the suppliers
00:16:04
accidentally sacked Waymo and said, hey, we can put
00:16:09
confirmation on this part.
00:16:11
And the people at Waymo was like wait, that's our parts.
00:16:13
Oh, we did order this and it turns out it was.
00:16:16
It was he just literally taken the exact schematic for his new
00:16:20
company and was saying that part and so you know it was all.
00:16:24
When he discovered accidentally by the folks at Google Now was
00:16:28
sort of the best, that's the snowman taste on the corporate
00:16:32
side and you know he ended up.
00:16:35
That's what was interesting in the end for your listeners is he
00:16:39
went to prison for that and was serving time in jail when, in
00:16:45
the last days of his presidency, president Trump parted Anthony
00:16:50
Lewandowski with no little to no explanation of his phone.
00:16:55
So interesting sort of story that kind of keeps going.
00:17:02
Speaker 1: Yeah, that's really fascinating.
00:17:05
I actually I didn't.
00:17:07
I don't think I knew about that .
00:17:10
You know, is Waymo still around ?
00:17:13
Speaker 2: after that.
00:17:13
Yeah, waymo's still around.
00:17:15
It was an massive issue between Waymo and and then Uber because
00:17:21
Uber.
00:17:22
It looks as though Uber basically encouraged Lewandowski
00:17:26
to take that data, stand up his own company, and then Uber
00:17:29
bought that company six months later.
00:17:31
And so Anthony Lewandowski was at Uber when they discovered
00:17:35
this and Uber was working on sell all the self-driving car
00:17:38
stuff.
00:17:38
So they it was a long lawsuit.
00:17:41
They ended up settling in the end, but then when they sell,
00:17:46
after they sell the lawsuit, then criminal trial came and so
00:17:50
it was a big deal.
00:17:51
Some people think it's.
00:17:53
You know, one of the reasons Travis lost his job was we're
00:17:57
all around the same time.
00:17:58
So it was.
00:18:01
It was a big.
00:18:01
It was very controversial at the time.
00:18:04
Dead pass.
00:18:06
Speaker 1: And that's really fascinating because you know,
00:18:10
like, how does that even, how does that even come about?
00:18:14
Right, like you know, you're working for Google on this
00:18:17
project.
00:18:18
A competitor, a direct competitor, like they, must have
00:18:23
approached him at some point during his tenure at Google to
00:18:27
approach him with this idea.
00:18:28
You know, I maybe I'm just not in the insider threat space,
00:18:34
right, but I mean that's a, that's a kind of corporate
00:18:38
espionage, that that I I never would have thought of, I never
00:18:44
would have imagined that a competitor would go to that
00:18:48
length.
00:18:48
You know, I could see them, you know, buying the company, right
00:18:53
, but the for the idea to come into place with this guy, to
00:18:59
take the code form a company, start, you know, probably
00:19:02
develop it with it, try and order the parts that were
00:19:06
proprietary, you know, for what he was using at Google, I Mean
00:19:11
that's just a different Love that I feel happens every day.
00:19:15
Speaker 2: We had, we beat, we beat.
00:19:16
We had a new client just a couple of weeks ago at code 42
00:19:20
where they had Employee that left and stood up his own
00:19:24
companies in his source trust.
00:19:26
The way it happens is people that are Smart and people that
00:19:31
create new things All are capable companies.
00:19:34
They, they, a lot of them believe why created this design.
00:19:38
So you know, I'm gonna take it with me to my next job.
00:19:41
They'll.
00:19:42
And that's not the way a lot your property works.
00:19:45
When you work for a company, when you join, you sign an
00:19:48
document says anything I create for this company the company
00:19:51
owns, and so we see this every day was sourced to right now
00:19:56
most software developers.
00:19:57
They have their own get cover, get lab accounts, your repos.
00:20:05
You're gonna talk to developer friend hey, do you own your own
00:20:08
repo?
00:20:08
Oh, yeah, I guess we have in your ego of that projects that
00:20:11
are working on my whole career.
00:20:12
Okay, well, those products for companies we are you know, let's
00:20:16
does this company source code we have?
00:20:18
I mean, it's not like I took it .
00:20:19
I left the copy.
00:20:21
The company's using that copy.
00:20:22
I took the copy of the source code With me and no, we see that
00:20:27
time and time again and it's interesting and this ties back
00:20:32
to the AI stuff I was out there about.
00:20:34
So the way we look for the way most developers Take source code
00:20:40
is this kind of interesting and very straightforward, is they?
00:20:44
Essentially, you know, every day when the developer pulls
00:20:46
their code down from the corporate repo, you know that
00:20:49
corporate code is locked up tight it's.
00:20:51
You know you gotta have the right stiff divider machine to
00:20:53
get into it.
00:20:53
Sometimes it's all like back authentication, but like you're
00:20:56
not getting in that vehicle unless you're authorized to know
00:20:59
.
00:20:59
Right, most companies are really good now and so well.
00:21:02
Once the developer takes the code down to their local machine
00:21:05
, that's when they start buying code.
00:21:07
They got their test cases running.
00:21:08
They got a bunch of the ends etc, a writer code, and then
00:21:12
they check it back into the forklbeat pop.
00:21:14
Well, you know, in order to check it back in, you use it
00:21:18
commands to push that code.
00:21:20
It's called a git push.
00:21:21
She pushed that code back up is the recalls.
00:21:23
Oh, what a lot of developers do is, at the same time, they're
00:21:26
gonna take the bill, get pushed to their own personal repo and
00:21:31
you know if they're sitting at home and they're off the
00:21:33
corporate network which was developers are these days or
00:21:36
there's our what.
00:21:37
So, wherever they are, most organizations are completely
00:21:41
blind to that get pushed to the corporate, to personal repo, and
00:21:46
we built technology code 42 so we could see that.
00:21:50
And unless we did, that was her seeing some resource Good at
00:21:53
filtration.
00:21:53
We were literally like, oh my gosh, we didn't know.
00:21:56
We didn't even know that this was happening.
00:21:59
At the same time, the same capability also sees when you
00:22:04
move large datasets.
00:22:06
You also use the git commands to use large, large datasets.
00:22:10
So we also started seeing large datasets getting moved around
00:22:15
and that's where the AI I was.
00:22:18
That comes in a play where people moving large datasets to
00:22:21
train LLMs for AI usage and you're gonna see back in the
00:22:27
same capability we law.
00:22:29
We're let a company that has this capability out there today.
00:22:33
We lost it about two years ago and so the timing was just lucky
00:22:39
.
00:22:39
We didn't, we weren't anticipating that was that half
00:22:42
of it.
00:22:42
With the AI and the large language models I know, which I
00:22:46
have a lot in the a stop a few years ago, but but again we see
00:22:51
this kind of huge movement To that again.
00:22:54
So back to the afternoon and ask you story like yes, he took his
00:22:58
designs, yes, he took his files , let's see, toss up.
00:23:01
I mean, he went to prison for this, so he's obviously had to
00:23:04
pay the price.
00:23:05
But in his mind he probably was like, well, this is so fine,
00:23:09
that's it.
00:23:10
No, this is my stuff.
00:23:11
Like I do this, I want to forget, just like if a whole
00:23:14
team of people who were bonus and the damage done to the
00:23:18
people you leave behind as an insider, when you take
00:23:22
Everybody's, you know the work that everybody did and then you
00:23:26
go take it somewhere else is real.
00:23:28
And no part of what we often do as an insider risk company is we
00:23:34
help educate the organization on like a.
00:23:37
Hey, we're not allowed to do an .
00:23:39
I'll ask you why is an adder?
00:23:41
You know well, you know why is it important?
00:23:43
Is it?
00:23:43
Is it the company being mean?
00:23:45
Asking you your information?
00:23:47
Might, but people often don't sort of understand that the
00:23:50
impact that they have is on their old tears is Let it
00:23:54
biggest impact cash that you know occurs on inside risk hmm,
00:24:01
yeah, it's.
00:24:04
Speaker 1: I feel like it's almost like a, it's a miss in
00:24:08
the brain or something like that .
00:24:09
You know, because from my perspective you know I'm in it
00:24:14
right, I work a day job in cybersecurity there's a lot of
00:24:19
Potentially you know, proprietary information that I
00:24:23
have taken down in notes, in my, in my one note.
00:24:26
But there's a lot of Things that I'll that I'll learn right
00:24:33
for the very first time and I'll take note of it and it'll be,
00:24:35
you know, not proprietary information, right, it's a
00:24:41
configuration in AWS or whatever might be, and I'll take note of
00:24:45
it so that I remember it.
00:24:46
And when I leave the company, if I don't know it by heart,
00:24:50
I'll just take that little, that little piece of information and
00:24:53
put it into my personal one note, right, but it's not
00:24:55
proprietary, it's not anything that's you know, customer, the
00:25:01
company or anything like that.
00:25:02
And for me to do the mental gymnastics, right, to kind of
00:25:09
rationalize taking proprietary information from company, I mean
00:25:15
I don't want to go to prison.
00:25:19
Speaker 2: And it doesn't usually end up in prison.
00:25:21
I think part of what's going on here is that most organizations
00:25:27
today have some form of data protection but are Are.
00:25:32
You know, our ability to exfiltrate data from our company
00:25:36
is expanded so rapidly in the last five or six years that
00:25:40
people just don't think Daniel is paying attention or they
00:25:42
don't think that any of that car works.
00:25:44
And it is probably more the former than the latter, because
00:25:47
if they really think about any car and they feel guilty about
00:25:49
it and they and awesome, they won't do it, which is good.
00:25:51
But most companies today just can't see.
00:25:55
If you upload a document to Dropbox from your house, you
00:25:59
know you're not on the company network, or you know and you
00:26:03
just Gmail to yourself.
00:26:04
These are the most common ways that people take data and
00:26:08
they're free and most people are like, well, no, I don't think
00:26:11
my company sees that, you know I can still print and all kind of
00:26:14
stuff, and so you know, you know our.
00:26:19
Our philosophy as a company is we coin in terms of secure the
00:26:23
collaboration culture, and the collaboration culture is how we
00:26:28
all live today.
00:26:28
We use stack, we use teams, we use T drive and one your I.
00:26:32
We have all these tools like Salesforce, that they're cloud
00:26:35
based, last share information and our work clothes are shared
00:26:38
and we can collaborate on presentations together and
00:26:41
that's awesome, like it's a so much more productive as
00:26:45
organizations, right.
00:26:46
And so he insecurity is not to get in the way of that and to
00:26:52
just brought a little bit of security around it so that
00:26:54
people don't feel like, hey, nobody's watching, nobody cares,
00:26:57
and you'll find it in one of the ways that we do that, that's
00:27:01
how it is that the impact is, and somebody good employee,
00:27:05
normal employee, been working, you know, in their job does
00:27:09
something that they're not supposed to do.
00:27:11
We'll send that.
00:27:13
The system automatically send them a video.
00:27:15
Is this hey, we noticed that you uploaded a file to Dropbox.
00:27:19
We don't use Dropbox as our sharing platform here at X
00:27:24
company, you know, please?
00:27:26
So what that does is it puts the employee on notice that well
00:27:30
, somebody's actually paying attention, but it does it a very
00:27:32
nice, polite way, etc.
00:27:33
And if you let people know that we're watching a score, most
00:27:39
people are steal from you and most people behave the right way
00:27:44
.
00:27:44
And I'll say, if I last week I was doing a presentation in San
00:27:48
Francisco and I got there with my laptop at the conference and
00:27:52
they were like, oh, you can't use your laptop, catholic, but
00:27:55
instead I could update fine on, use yours and know like we need
00:27:59
your presentation.
00:28:00
And the only way I could get it done was was a thumb drive.
00:28:03
So I put my thumb drive in and had me using adapters.
00:28:07
Of course, matt, matt doesn't allow forever.
00:28:10
Eight and my days.
00:28:12
The presentation is them and I you know it was I one minute
00:28:15
before like my kickoff.
00:28:17
So it was like fast, Like I don't know, I did my
00:28:20
presentation that afternoon.
00:28:22
I am in knots.
00:28:24
I got an email but I was a black from my security team, the
00:28:28
little video attacks and said you know, no use, found rise to
00:28:32
your code 42 to take that.
00:28:35
So you know, risky way to XLT day it.
00:28:37
Please watch this video.
00:28:39
I had watched the video all the way through.
00:28:41
You know I did the very tenth and check that I have lost video
00:28:45
and all that kind of stuff, stuff.
00:28:46
So that's how controls you place working in a line and you
00:28:49
like don't, don't do that.
00:28:52
And just by doing that, now I know if I were to leave the
00:28:56
company, like if I moved a bunch of data, they would pay it,
00:29:00
they would notice and they would pay attention.
00:29:02
So that kind of show, you know, that really reinforces a way to
00:29:05
keep people from actually doing something.
00:29:09
Speaker 1: So I mean, that's a great.
00:29:11
That's a great like reinforcement of a, you know, a
00:29:16
learned behavior right.
00:29:19
But how do you, how do you stop that developer from uploading
00:29:24
to their own personal you know, get repository right?
00:29:28
Because I don't, I actually don't know.
00:29:31
Speaker 2: Yes.
00:29:31
Well, from a technical standpoint you don't want to try
00:29:34
to solve that.
00:29:34
And then you hear the other one is, if you get in the way of a
00:29:38
software developer as a security person, which one?
00:29:42
You is the leaser job?
00:29:45
And I'm telling you, this is just right.
00:29:48
You do not want to get in the way of the 300 software
00:29:51
developers you got to your company, or 500 or 1000 or
00:29:53
whatever, and that's two, though , slow down their machine.
00:29:56
If you slow down your developer's machine, hell is
00:29:59
going to pay by the CTOs that you go to the CEO and say where.
00:30:03
And also, you don't want to get in the way of them using get
00:30:07
commands.
00:30:07
That's the.
00:30:08
That's how you do their job every day.
00:30:10
So that's why the approach we take in is not to to stop that,
00:30:16
but it's to monitor that and to and, of course, correct behavior
00:30:22
.
00:30:22
So, if so, the first time a developer moves something to a
00:30:26
open source product that's unsanctioned, which is also how
00:30:29
the that we see that a lot too, which is, hey, meet, work, we're
00:30:33
contributing to 70 open source products, but it turns out that
00:30:36
when we actually start monitoring, we see code moving
00:30:39
to a lot of hundreds of open source products.
00:30:41
It's a very regular thing that we see at code 42.
00:30:45
When we work with our clients, the first thing you do is you
00:30:51
send that video to say, hey, no, do that.
00:30:53
And then the second time the developer does it and you have a
00:30:57
conversation and then if it happens again, then then you go
00:31:01
to their boss and say, hey, no, developer is doing X, y and Z.
00:31:04
But what you don't do is overreact and say fly that
00:31:09
developer, set down their machine, cut off all software,
00:31:13
that people from pushing code around with gate tomehans.
00:31:16
That's exactly the home response for a security team to
00:31:21
have, and I think it's it's it's right.
00:31:23
That's one of the big differences between insider
00:31:27
threat and external threat, because when you have a piece of
00:31:31
malware come in, you know the first thing that you do is it's
00:31:37
killed by the sledgehammer.
00:31:38
You don't isolate that machine, you're going to disconnect it,
00:31:41
you're going to quarantine it.
00:31:42
That is not what you do with insider threat, because you
00:31:46
really wanted to investigate and understand what is the person
00:31:50
doing.
00:31:50
Why are they using drought loss ?
00:31:51
Why don't Joe use a thumb drive ?
00:31:53
You know, and it turns out Joe used a thumb drive because he
00:31:55
don't know, because he was giving a presentation and he had
00:31:57
to in order to get it done, even though it's against our
00:31:59
policy.
00:32:00
We use a thumb drive.
00:32:01
We understand why we made that decision in that situation and
00:32:05
we didn't come down and get Joe with a sledgehammer right,
00:32:08
because it's always a bad actor when malware gets in.
00:32:12
You know it's always a colleague when we're talking
00:32:17
about insider threat.
00:32:20
The threat is fast moving and propagating when it's from the
00:32:24
outside.
00:32:25
But insider risk does it spread ?
00:32:28
Just because you, joe, lose the files around doesn't mean so
00:32:31
hot or Joe is going to move some files around.
00:32:32
That's not how it works.
00:32:33
You have time to investigate and to understand what's
00:32:37
happening.
00:32:37
Right, when it's malware, you know the security team can
00:32:42
handle it on its own every time.
00:32:44
But when it's an insider, you're going to need HR, you
00:32:48
might need legal, you're going to need a little bit of help to
00:32:51
do that.
00:32:51
So these are very different situations.
00:32:54
It's never accidental when you get malware in.
00:32:58
It's always it's sometimes.
00:33:01
It's sometimes accidental for in fact, it's, about 50% of the
00:33:05
time, an insider risk event.
00:33:08
This was just an accident.
00:33:09
Like you never need to educate the hackers, the bad guys.
00:33:15
Like that's a waste of your time and money when you always
00:33:19
want to educate your own employees, because that brings
00:33:22
down the number of events for you last time in it.
00:33:26
And then, last thing, I think the interesting one is you can't
00:33:31
.
00:33:31
You can get fired for not reacting fast enough to a
00:33:36
malware threat in your environment, but with insider
00:33:40
risk you can get fires for reacting too fast and so it's
00:33:45
like it's a totally f*****g-less-it sign.
00:33:48
So one of the things that we always work with our clients on,
00:33:52
if you're in security, you really need to process that is
00:33:55
how is this?
00:33:56
Is that the folks that are running CrowdStrike and look at
00:34:01
all the internal, the external activities, are not necessarily
00:34:05
the same people that you want to have running your internal,
00:34:08
because they can be, but it's a.
00:34:10
You have to turn your brain around and understand which
00:34:15
problem that you're working on external or internal because
00:34:18
your response is and the way you handle it are so very, very
00:34:22
different.
00:34:25
Speaker 1: Yeah, that's a really good point that I was going to
00:34:29
bring up.
00:34:29
It sounds like you almost need two separate teams because to
00:34:34
that normal security team everything looks like a nail
00:34:37
when you're used to being the sledgehammer.
00:34:39
I'll tell you right now if I saw something like insider
00:34:46
threat or whatever, I would have immediately, without question,
00:34:50
quarantined the machine, started doing a forensics investigation
00:34:54
into the guy or whoever it is.
00:34:57
I would immediately go the nuclear route.
00:35:01
Okay, we're going to make sure this person can't do anything.
00:35:05
Speaker 2: Unfortunately, that's an exact story from my customer
00:35:07
base.
00:35:08
One of my customers, ciso, has called me and said Joe, I'm
00:35:13
really angry with you.
00:35:14
Your team handed my team a gun and didn't teach you how to use
00:35:18
it.
00:35:18
And it was the very first thing incident they had was with the
00:35:23
senior vice president at this organization, and the security
00:35:27
team did exactly what you described a warranty machine, a
00:35:31
toboa machine and then they interrogated the senior vice
00:35:34
president and was hugely embarrassing for that executive.
00:35:37
But it turns out the executive was just actually doing their
00:35:41
job and there was a little bit of a misunderstanding about why
00:35:47
I'm supposed to be sending information to that particular
00:35:50
vendor in this case.
00:35:51
And the security team oh, that's an untested vendor and oh
00:35:55
, yes, had they handled it the right way, it would have just
00:35:59
said oh great, we've learned from that and we'll add that to
00:36:01
our trusted list or wherever.
00:36:03
But they put on a team machine, they isolated it and then they
00:36:06
interrogated a person and so, yeah, that happens.
00:36:09
And so part of what we've learned is like who are we going
00:36:12
with our customers?
00:36:13
We have to have a lot of conversations and the funny
00:36:17
thing is is most of our customers are not, you know,
00:36:21
securing folks, like you've worked with them all year, most
00:36:23
of all like we have this message that we know you want to tell
00:36:26
us.
00:36:26
We're very familiar with all the stuff, and we have to tell
00:36:28
you listen just a little bit in us, because your methodology is
00:36:33
so different.
00:36:35
So many people in security would like to think like Fedor, say,
00:36:40
mom, let's just block, let me just block all this.
00:36:42
You know exfiltration, and if you just block it, then you know
00:36:47
we all worry about it and it doesn't really work with
00:36:51
insiders, right, you know it doesn't really work as
00:36:54
first-worlds like well, so you're gonna block external jima
00:36:56
.
00:36:56
You know a lot of it.
00:36:58
So how are your employees going to?
00:37:00
You know, are they after a second machine around with them
00:37:04
and they have to do it?
00:37:06
How will that go?
00:37:07
Re-employment oh, tough, tough today, but okay, well, fed, we
00:37:11
know, you know, let's see if that, if that plays out well in
00:37:14
terms of your employees.
00:37:15
Just don't they find that you, you got a nail or a proton nail
00:37:19
where they start, you know, going around you.
00:37:21
So what always finds a way, and so, oh, we tell our customers.
00:37:25
As I look, your employees in most of the organizations we
00:37:28
work, your employees are better have a gene nail account.
00:37:32
They might have a dropbox tab because they do something with
00:37:34
their church or their school soccer gene with thousand like X
00:37:37
.
00:37:37
The important thing is that you help them identify, is that you
00:37:42
watch for important company data not moving to those things,
00:37:46
and then you course correct them if you see those things
00:37:49
happening and you always have the information available to you
00:37:52
that you can.
00:37:54
It's necessary to cross you down or whatever, but usually
00:37:57
what you just need to do is course correct and let them
00:38:01
operate the way they they need to offer and collaborate and
00:38:04
work together.
00:38:05
You cannot get in the way as if you start putting on these
00:38:08
rules.
00:38:08
One people's machines, it's posed down to machines for
00:38:12
everybody, and so it tends not to be a great way to do things.
00:38:19
Speaker 1: Yeah, it reminds me of a time a little bit earlier
00:38:24
on in my career where, you know, my manager was walking me
00:38:28
through, like our, our data loss prevention solution that we had
00:38:32
, you know, and he was saying how, you know nothing, nothing
00:38:36
is going to leave that we don't know about, or anything like
00:38:39
that, and that you know it's a perfectly locked down and
00:38:43
everything like that.
00:38:43
You know, and my security mind, I immediately and I did this
00:38:49
subconsciously, right, I didn't even realize that I did this at
00:38:52
the time, I took it as a challenge Like you think I can't
00:38:56
get around this, like I'm not the admin on this, I don't own
00:39:00
the tool, but you think that I can't get around this.
00:39:04
And then I immediately started discovering ways of getting
00:39:07
around it.
00:39:08
And when he didn't believe me, I showed him right there.
00:39:12
I was like, well, I just did it .
00:39:14
You know, like it's, it's on my phone now, it's on my personal
00:39:17
cell phone now.
00:39:18
Like what are we?
00:39:19
What are we doing?
00:39:20
You know, and it's, it's a different, it's a different
00:39:26
mentality that security people have, you know, because I feel
00:39:30
like when you tell us that we can't do something, we
00:39:34
immediately make sure that we can't.
00:39:37
Speaker 2: Well, it's funny.
00:39:37
I just as as as as comprehensive as our product is
00:39:42
today.
00:39:42
And the thing about traditional DLP is it doesn't see.
00:39:46
There's so much it doesn't see.
00:39:49
I bet in the way we talk about it is traditional DLP.
00:39:52
You write specific rules to cover things that you want to
00:39:56
cover and so as long as you know what all the risks are, you
00:39:59
know you'll be able to refine.
00:40:01
Of course, you don't know all the different ways that people
00:40:03
can exfiltrate data and move data around, and so they tend
00:40:07
not to be very effective solutions.
00:40:10
In fact, when we go, when we sell today, 85% of our customers
00:40:15
and Greenfield mean it may not have anything.
00:40:17
Because people gave up on DLP 15 years ago.
00:40:21
They said these systems don't work, they keep us from
00:40:23
collaborating, et cetera.
00:40:25
And so the space we call the space and Cyrus management today
00:40:30
Microsoft calls the same thing.
00:40:33
So the, the, the idea is really like hey, we will block people
00:40:39
for doing things that all the in rare circumstances only mostly
00:40:43
focus on is monitoring and then and then scoring things in the
00:40:48
cloud so we can see where did the data come from, who had it,
00:40:52
where did it go?
00:40:53
What do we know about that?
00:40:54
Versus is the first time that you said we can do all that kind
00:40:57
of analysis in the cloud and and and do it efficiently.
00:41:01
So then also, people's and phones down and then we can
00:41:04
score and then we can tell security.
00:41:05
Well, I need to pay attention to Joe and in particular, when
00:41:09
Joe is leaving the company, this is the biggest risk you have.
00:41:14
We can look back 90 days and say, hey, joe, 40 days ago he
00:41:19
took, he took, he took a lot of information and in this, well,
00:41:23
one is we talk lies in the same way that you.
00:41:25
You know you're very careful to make sure that we get our bags
00:41:28
back so they can't physically get into building their very
00:41:30
careful and actually the laptop accurate, so they can't get on
00:41:33
our networks.
00:41:33
But Only 10% of companies ask people about their data.
00:41:38
Only 10% ask you on the way out hey, did you take the data?
00:41:42
And so one of the things that we have is a process then say, go
00:41:46
back and look at every single person who's departing the
00:41:49
company and just double check that they haven't taken all
00:41:52
their data, because if you think about it out while they're in
00:41:57
the process of leading her, before they've left, it's really
00:42:00
easy to get it back at that point and I know that sounds
00:42:04
like well, how is it?
00:42:04
You know the security will.
00:42:07
You'll never get that data back , but if it's someplace, I'm
00:42:09
like, look, here's how you get it back.
00:42:11
You basically tell them we need to get back, you need to do
00:42:15
this, all copies, and we need to be confident that you're doing
00:42:18
that.
00:42:18
Because when I'm confident you're doing that, you're gonna
00:42:21
sign in attestation that you did that the total, full bill of
00:42:24
the process.
00:42:25
We're gonna notify your next employer that you're in
00:42:28
possession of our data.
00:42:29
If we notify your next employer that you're in position of our
00:42:32
data, that actually puts them on the hook legally for it.
00:42:35
They're gonna also send a pretty strong message to them
00:42:37
that, hey, you're hiring a new person and new person is never
00:42:40
worth the day of your company.
00:42:42
Is the process of stealing the data from their last company.
00:42:44
Do you really want to hire that person?
00:42:46
So it's what most people come to understand very quickly is
00:42:51
that they're putting their next job at risk if they don't return
00:42:56
the data and up like when an empty lot of dollars you left,
00:43:00
they end to start it for a year.
00:43:01
By that time they had taken all that data and they were using
00:43:06
it.
00:43:06
All that information was being used across Uber in this case
00:43:11
and so unwinding that was really complicated.
00:43:13
If they had found that the two days before he had left and
00:43:16
figured that out, it would have been a completely different
00:43:18
situation Although now it's very time-prisoned and then you
00:43:21
would take his mind and she's allowed it safe and his ideas
00:43:27
and worked at the next company and maybe created it so that
00:43:31
information and done some different things.
00:43:33
But you want to sell his actual designs, source code to
00:43:37
property, et cetera.
00:43:42
Speaker 1: With the evolution of AI and LLMs?
00:43:46
Are you seeing this as a new, I guess, attack avenue or attack
00:43:52
path for insider threat?
00:43:54
Because I'm thinking about it from the just a simple chat GPT
00:44:00
side of it.
00:44:01
Like most of the time the company isn't going to block
00:44:04
chat GPT.
00:44:04
You could just upload whatever you want to chat GPT and one.
00:44:10
You don't really know what they're doing with that data on
00:44:12
the back end.
00:44:13
So that's obviously a huge risk , but at the same time you could
00:44:18
save that conversation and then you can go and access it from
00:44:21
your personal computer.
00:44:22
Are you seeing newer attack paths that you haven't seen
00:44:27
before or come up?
00:44:29
Speaker 2: Yeah, and let's talk about sort of you know hat trial
00:44:35
, how to act on demand.
00:44:36
So first, I'm a rimerist.
00:44:37
Most of the people that are moving data out of the company.
00:44:40
They put them into large lines all like chat GPT.
00:44:44
They're a hoise.
00:44:46
And what are they doing?
00:44:47
They're just finding their jobs , like they're literally trying
00:44:50
to do their jobs.
00:44:50
They're probably not thinking I'd stay on Excel freeing the
00:44:53
data but not putting it up into chat GPT so that they can steal
00:44:57
it in a case, or just like hey, do you like to get an answer to
00:45:00
this or something?
00:45:01
So one, that whole video education part that we talked
00:45:05
about is super important, right?
00:45:08
So just remember, why are they doing what they're doing?
00:45:12
And can we dictate them and then say you know, help them not
00:45:17
do that?
00:45:18
That'll solve most of the problems.
00:45:20
Just try and be there.
00:45:21
They were actually trying to in most cases found steal data.
00:45:24
They certainly not find a steal data in chat GPT.
00:45:27
How would that benefit them?
00:45:30
I think what's newly been interesting is that it's the
00:45:33
first security.
00:45:34
So about seven months ago, when the supply chain attacks
00:45:38
started happening, you know some of the poor members would ask
00:45:47
security, hey, how are we on our supply chains and most of them
00:45:51
are there when nothing has been quite as loud as the boards of
00:45:56
directors specifically asking security leaders a re-cover for
00:46:01
AI, like how to low-earned up in the chat to TV.
00:46:04
It's one of those things that's been pressed to much that poor
00:46:08
members who aren't great technical usually and aren't
00:46:10
great security savvy but boy do they worry about this issue, is
00:46:14
they?
00:46:14
You know the tank cycle is really high and so they're
00:46:16
freaked out.
00:46:17
So security people are hearing a lot of like are we covered for
00:46:21
that?
00:46:21
So on the one hand, it's one of those times on security to be
00:46:26
like, hey, you do the best to more money and so it has some
00:46:28
resources because the board really cares about this.
00:46:31
But the actual threat out again is relatively easy, easily
00:46:40
mitigated and controlled by controlling what you know from a
00:46:46
network security standpoint, what you get access to.
00:46:49
You know, like our helping.
00:46:50
We have our own internal chat to TV, so it's hard data and so
00:46:55
it's easy to.
00:46:55
We restrict corporate access to chat to TV.
00:46:58
As I mentioned earlier, we also watch, you know, for large
00:47:03
style uploads as well, and then I think that's an area that's
00:47:10
been in this we've got to work.
00:47:12
Test you now One last example, sort of to your point RCTO did a
00:47:19
experiment and you just asked TechEBG to go tell us what the
00:47:25
product roadmap plan is for our competitor and for work.
00:47:30
Peppers and TechEKING got all of their stuff, so somebody over
00:47:35
there had uploaded enough information.
00:47:39
I guess they were working on their you know product plan and
00:47:42
why and how it been you know creating it.
00:47:44
And we got the insider of product plan just by asking chat
00:47:48
to TV.
00:47:49
So, yes, the format is real.
00:47:52
It is usually accidental, so you got to handle it, knowing that
00:47:56
it's usually accidental and closer, direct first, are paying
00:47:59
a lot of attention to it right now.
00:48:02
So it's not, it's something you really need to pay attention to,
00:48:05
even though I would say them, the previous threat to most
00:48:09
organizations right now is source code extliferation from
00:48:14
your own software engineers, because you know you think about
00:48:19
like hey, I have forgotten to install our source code.
00:48:21
That's bad, because you know they can look more bullies in
00:48:25
your source code.
00:48:25
But that factor is at a hard time.
00:48:28
Taking that source code and making a product, the person
00:48:31
that wrote back to the scope and knows exactly what it does and
00:48:35
how it's written and what business problem it's solving
00:48:38
because they wrote it.
00:48:39
That's the biggest risk to your source code today and keeping
00:48:43
those people in line and in check from doing that is a much
00:48:48
bigger risk today and I think you'll start to hear a little
00:48:53
bit more about this in the coming months.
00:48:56
Is it a few big cases that are happening on Thursday?
00:48:59
Is it probably a bigger risk than what's happening on the AS?
00:49:06
Speaker 1: Wow, that product roadmap that is.
00:49:10
You know, I mean the person that probably uploaded it right
00:49:15
was just trying to get chatGPT to write it better.
00:49:17
You know, I mean I do that with everything you know.
00:49:21
Speaker 2: I mean I know people that do that with all their
00:49:23
emails to executives, right, you know it's a very valid and
00:49:28
again I get it, you're not malicious, so you think right,
00:49:31
you're not trying to hurt the company when you do it right.
00:49:34
So because of that, it's one of those things that can be
00:49:39
largely solved through education .
00:49:41
But you have to take it on, you have to address it and then you
00:49:44
secretly leave things as well as soups.
00:49:46
So most of us, all of us, go through training.
00:49:49
You know there are companies that copy.
00:49:51
Every year we have to do these mandatory trainings and none of
00:49:53
us pay attention to it.
00:49:55
We all push 2X on the video thing.
00:49:57
You know that's how we do it.
00:49:59
What really we found is really the type of the moment you do
00:50:03
something wrong within a few hours.
00:50:06
That's when we send the video as an end time, because you know
00:50:10
, oh, I did do something wrong, I did upload something to
00:50:13
chatGPT.
00:50:14
I shouldn't have done that and they noticed, and so you could.
00:50:16
Why those things?
00:50:17
That's just too important.
00:50:19
So I would say that right now, inside of Threat in AI is an
00:50:24
education problem and then, of course, correction problem,
00:50:29
because a lot of people will suddenly be like look, I know
00:50:32
I'm not supposed to do it, but I'm not going to email to my CEO
00:50:35
.
00:50:35
He needs to be really good and so I'm going to put in there and
00:50:38
ask for better language and stuff.
00:50:39
Well, if you know you're made it caught building that, then
00:50:42
you're less likely to do that, but if you don't think anybody's
00:50:45
paying attention, then you're going to continue to do that.
00:50:47
So I think it's that.
00:50:48
Of course the education is important, also the enforcement
00:50:52
of that education, but that's different than just sitting and
00:50:55
someone with a stash card.
00:50:56
No.
00:50:58
Speaker 1: Yeah, you're playing more into the psychology, right,
00:51:02
it's more of the psychology of the person.
00:51:05
How do we change that thought process?
00:51:07
How do we change how they view this or whatnot?
00:51:10
Right, which is?
00:51:11
It's the better approach than the sledgehammer that I would
00:51:18
have done.
00:51:18
Speaker 2: And Joe, you pointed this out.
00:51:20
It's so different than most cybersecurity.
00:51:23
Speaker 1: Yeah, it's completely opposite.
00:51:26
Speaker 2: We should talk to fancy bear and tell them what
00:51:28
they're doing is not even thick.
00:51:29
You know what I mean.
00:51:31
There's nobody at CrowdStrike that's sitting around and
00:51:36
worried about educating.
00:51:37
You know, one of the things that we always get raised
00:51:43
eyebrows from security people is we say, look in security, we
00:51:48
don't want anybody to know our methods and practices.
00:51:50
Right, we don't want anybody to know that stuff.
00:51:52
It's set inside risk and companies.
00:51:55
And actually why tell people A lot of during your food hour,
00:52:00
monitoring you?
00:52:01
We care about your job.
00:52:03
We're not hot in your productivity, we're just
00:52:05
monitoring when you move data to untrusted location.
00:52:08
You know like we want you to know that we pay attention to
00:52:11
that.
00:52:11
And first of all, you tell security people that they're not
00:52:14
going to tell people that, no, you do.
00:52:15
You're not really want to catch them, but the rest of security
00:52:19
is more tax stuff.
00:52:20
It's like you just don't want them to do.
00:52:23
It is what it comes down to and you know it's a way to grab to
00:52:27
try to escape the hackers of the world and you know to find
00:52:33
syndicates who are really wanting these things today.
00:52:36
It's a waste of time and we see when they hack hospitals and
00:52:40
they're literally causing people life and death problems and
00:52:46
they'll tear.
00:52:47
You know, and so clearly you know it's.
00:52:51
We're wasting our breath and we try to educate the dinosaurs.
00:52:55
Speaker 1: Yeah, it's a great point.
00:52:57
You know, recently I'm not sure if it was in the news or
00:53:00
anything like that, I don't watch the news but you know,
00:53:04
lurie's Children's Memorial was attacked.
00:53:10
You know, it wasn't like a small attack, like they took them
00:53:13
offline, you know, and this is a children's hospital that treats
00:53:18
only the sickest of sick kids, that doesn't even charge
00:53:23
families if they can't afford the treatments, they don't even
00:53:26
charge them.
00:53:26
You know, I had a very personal experience with that right,
00:53:30
like my sister was a patient there and there was no way, no
00:53:35
way my family would ever be able to, you know, shell out the
00:53:39
half a million dollars to get her, you know, treated for the
00:53:44
next three years or whatever it was, you know, and they didn't
00:53:49
send us a bill or anything like that.
00:53:51
You know, like that was a huge weight lifted off of us.
00:53:54
And now these attackers, you know they they go in and they
00:53:58
they knock them offline.
00:53:59
It's like guys, you know, at least do an adult hospital, you
00:54:04
know what I'm saying Like a children's hospital is just like
00:54:08
the most heartless thing that you can do, but these attackers
00:54:12
they don't care, they know.
00:54:14
Speaker 2: They know and that's, and again, very different than
00:54:17
your insiders.
00:54:18
I mean insiders do care, they work at your companies and they
00:54:21
can most far, I mean there's those a few people doing, you
00:54:26
know, real uh, espionage at organizations.
00:54:29
I was a far kind.
00:54:30
So like, yeah, we're going to help you find those two, but
00:54:33
like, the most important thing is to help you reduce the amount
00:54:37
of offense.
00:54:38
You see, their non-friendly, their accidental.
00:54:41
That would just require a little bit of, you know, a
00:54:46
course budget so you can spend your time.
00:54:48
Go to some of the others.
00:54:49
You know, a friend of mine told me to send us to my first school
00:54:53
, my first job, in my early spring, because I was the
00:54:57
manager of a small retail store and I saw like seven people
00:55:01
working really small and, um, and somebody was taken through
00:55:05
the till and this is where all came to surprise, you know, and
00:55:10
that then we took tax rights and my owner, the boss, said look,
00:55:15
joe, 10% of the people, uh, will never steal from you, and 10%
00:55:23
of people will always steal from you.
00:55:24
And 80% of the people will steal from you if you give them
00:55:28
the opportunity.
00:55:29
So your job is to set the systems and the processes and
00:55:33
the controls so that 80% of them steal from you and you go focus
00:55:39
and figure out who the 10% that will always steal from you is
00:55:43
and um, and that's sort of a retailer, a retailer, a retailer
00:55:46
, a retailer, a retailer if you ask a retailer, who's your where
00:55:50
, where's most of your leakage from?
00:55:51
And it's not from, um, people coming in well, that some cities
00:55:56
are not mostly not people coming from from the outside,
00:55:59
and so so it's your employees taking it.
00:56:01
And I think the information services businesses and
00:56:04
professional services businesses have been so slow to realize
00:56:07
that Um, uh I tell that story often now because we try to
00:56:13
really help our clients do is get that 80% figured out, so
00:56:17
that they're trying to start with the 10% that are, that are
00:56:21
are going to take three or four or what, um, and, and catching
00:56:24
that is is is really important because they probably have
00:56:28
malicious intent with what they're going to do with the
00:56:30
data.
00:56:31
Speaker 1: Hmm, well, you know, joe, we're.
00:56:34
We're, unfortunately, we're at the top of the hour here.
00:56:37
We're at the end of our time.
00:56:39
You know, I feel like we could we keep talking about this
00:56:42
forever.
00:56:42
Um, you know, yeah, it was a, it was a fantastic conversation.
00:56:47
I really appreciate you coming on.
00:56:48
Um, you know, before I let you go, how about you tell my
00:56:52
audience, you know, where they could reach out to you if they
00:56:54
wanted to reach out, and where they could find your company?
00:56:57
Speaker 2: Yes, so we're code 42 and that's code 42.com and you
00:57:01
can get me at pain Joe on back, sign us and you can get me at
00:57:07
Joepain JYNE at code 42.com and happy to talk to any of you.
00:57:12
And um, you know we try to get back to the community.
00:57:16
So the research report coming out, um, I think in a few days,
00:57:21
uh call the data exposure report .
00:57:23
We do it every year, so look for that in this loss and
00:57:26
information there.
00:57:26
Uh, inside of that and center risk.
00:57:29
Speaker 1: Awesome.
00:57:30
Well, thanks everyone.
00:57:32
I hope you enjoyed this episode .
Speaker 1: I was going.
00:00:01
Joe, it's great to finally get you on the podcast.
00:00:04
You know, I feel like we've been trying to get this thing
00:00:07
scheduled for quite some time now, but you know, with with
00:00:11
with our schedules being so hectic, you know, I'm glad that
00:00:14
we could finally get on.
00:00:16
Speaker 2: I think it's you know , you and I spent a lot of time
00:00:18
with the hairdresser, I think, and so getting our appointments
00:00:23
all lined up without a podcasting, that was probably
00:00:25
the difficulty here.
00:00:26
Yeah.
00:00:26
Speaker 1: Yeah, and this head of hair.
00:00:29
You know it doesn't maintain itself, it is necklace.
00:00:33
Speaker 2: Yeah.
00:00:35
Speaker 1: So, joe, you know why don't we start with you.
00:00:39
Know your background right, how you got into it, how you got
00:00:43
into you know kind of the security side, what made you
00:00:46
want to go down this route, was there, you know, something that
00:00:50
you maybe discovered earlier on in your life that you know kind
00:00:54
of took you down this path.
00:00:55
When you're looking back on it, or what was I like?
00:00:58
Speaker 2: It's my story to a little different to probably a
00:01:00
lot of your tests, because I my first job out of school was
00:01:05
actually the soft drink business and I was working for Coca Cola
00:01:09
in marketing and you know I was having a lot of fun and soft
00:01:15
drinks, you know commercials and all kinds of crazy stuff.
00:01:19
But I remember at the end of one year we grew.
00:01:22
It was like we had a great year and we grew 6% and I was like,
00:01:28
hmm, it got like in a different industry it grows a little
00:01:31
faster than beverages and I was always interested in tech, and
00:01:36
this was the mid 90s and tech wasn't made back then.
00:01:39
I need to think about it.
00:01:40
You know there was no social media.
00:01:42
There was very little internet.
00:01:44
Very few people had email addresses.
00:01:46
When I first joined in tech, I'll just tell you a funny story
00:01:50
about myself my first email address was Joe and Karrosh,
00:01:55
which is my wife's name, at AOLcom, and at the time we
00:01:59
thought, well, every family would just have one email
00:02:01
address, you know, like you have one physical address, and so we
00:02:04
had a shared email address.
00:02:06
So that's how far back I go in tech.
00:02:09
But then I got interested in security in the early 2000s.
00:02:13
It was a murdering space, an exciting space and I was the CEO
00:02:17
of a company called East Charity the first SIM products
00:02:20
way back in the day.
00:02:21
And what really turned me on as security was when I worked at
00:02:26
iDefense.
00:02:27
At iDefense we worked doing threat intel and our customers
00:02:32
were all of the three letter agencies in the government, all
00:02:36
the largest banks in the world, and at the time I also got
00:02:41
security clearance.
00:02:42
And so when you get connected to the three letter agencies and
00:02:47
you're looking at all of the things that are happening in
00:02:52
cybersecurity, it's tentacle could be exciting.
00:02:55
And iDefense was a lot of fun because we had white hat hackers
00:03:00
.
00:03:00
We were also tearing up software around the globe with
00:03:07
our white hat team just trying to get ahead of the bad guys.
00:03:10
So it was a lot of fun back then and I was getting
00:03:14
interested in security ever since.
00:03:17
Speaker 1: Yeah, it's interesting working with the
00:03:20
government.
00:03:20
Earlier on in my career I worked for a very small company
00:03:25
that did Enhanced 901 software and so the government was a huge
00:03:31
consumer of our product and somehow I finangled my way into
00:03:39
leading the entire tech side for our government clients and I
00:03:45
mean it really does just like open up your mind into what's
00:03:51
possible.
00:03:52
And I feel like it's a different way from government
00:03:55
employees, because the government employees are
00:03:58
typically very siloed and as a contractor you can come in and
00:04:02
say no, I need to know what's going on over here.
00:04:06
I know you normally don't tell people, but this impacts my work
00:04:09
of how I provide this product, and so I need to know these
00:04:12
different pieces.
00:04:13
And so you learn probably way more than what you should
00:04:16
actually learn in some cases.
00:04:21
And it's always interesting because I was going to a
00:04:24
facility for maybe a year or two and I never knew what they did.
00:04:30
I mean, you're in the middle of the mountains West Virginia,
00:04:35
something else is around, like a town was built around this
00:04:38
thing to support contractors coming in and I have no clue
00:04:44
what we're doing.
00:04:44
And one day I guess my handler that's what I called him my
00:04:51
handler at the facility.
00:04:52
He was like Joe, do you not know what we do here?
00:04:55
I said I have no clue.
00:04:57
I literally have no clue.
00:04:59
And he pointed to these satellites that were, these
00:05:04
giant satellites on the on premise and told me one of the
00:05:09
small things that they did.
00:05:10
And I'm like my God, where am I ?
00:05:13
Speaker 2: Well, Joe, you just there's a couple of great points
00:05:16
to kind of for first.
00:05:17
So I'll say my area of expertise now in cyber is
00:05:21
running cyber threat and insider risk, and so you just
00:05:24
identified a couple of things around why it's so important.
00:05:27
Because, to your point, like contractors in particular do you
00:05:30
get a lot of knowledge around things, and so contractors will
00:05:34
end up biggest risks on the federal side.
00:05:36
But the other side I think it's just as important to touch on
00:05:40
and I often have to talk to the old people on my teams about
00:05:43
this and that is that the United States government is, in my
00:05:48
opinion, the best in the world in cyber.
00:05:51
I mean the best in the world.
00:05:53
What's interesting about that is that when most people think of
00:05:57
government employees, they think of people that work in agencies
00:06:01
and are stereotypical.
00:06:04
Oh, these government employees, they don't work that hard, they
00:06:08
just shut along.
00:06:09
It takes a long time to get the government to do anything.
00:06:11
You know all these stories et cetera, but what I learned in
00:06:15
working with our Intel community , our long course community
00:06:20
around cyber, is that we literally have the best people
00:06:24
in the world at the NSA in particular, at the FDI, a little
00:06:30
bit at the CIA, in the military , we have the best people in the
00:06:34
world.
00:06:35
In cyber, we are nobody's better than us, and that level
00:06:40
of understanding and respect is really important for all of us
00:06:45
that work in a cyber community, and so I'm glad you brought that
00:06:49
up, something that I think we can be really proud of, and it's
00:06:52
something, honestly, that's just very safe as a country.
00:06:56
Speaker 1: Yeah, you know, it's very interesting that you bring
00:07:00
that up, you know, because sometimes, as from the outsider
00:07:06
perspective, right and I'm talking about people that aren't
00:07:09
even in cybersecurity it looks like to them that we're so far
00:07:15
behind everyone else that we're not capable.
00:07:21
There's too much bureaucracy.
00:07:22
And I will say this there probably is too much bureaucracy
00:07:27
, right, but at the same time, I know the crowd of security
00:07:32
professionals and we need those rules, because if we don't have
00:07:36
those rules and you just say, you point us towards China and
00:07:40
you're like hey, you've got the power grid, you know go have fun
00:07:44
, right, like yeah, it's going down and they won't be able to
00:07:48
recover from it, but like that's something you know you want to
00:07:52
really tie it, tie into other things and really control, right
00:07:56
, and it's a.
00:07:59
It's fascinating that you bring up.
00:08:00
You know that we have that talent pool there, because I
00:08:03
actually had on someone maybe two years ago at this point and
00:08:08
the episode was never released because the military asked me to
00:08:12
not release it and you know I do not want the United States
00:08:15
government showing up at my door for any reason.
00:08:19
And you know he talked about how the training that he was
00:08:27
going through is a two year program, for you know, one of
00:08:31
the three letter agencies.
00:08:32
It was a two year program and he said, literally every single
00:08:36
day, at any point in time, you can be cut.
00:08:39
If you write an inefficient line of code, if you, you know,
00:08:43
do something that you shouldn't have done, if you put it in the
00:08:47
wrong language, whatever it might be, you know you can be
00:08:50
cut right there.
00:08:50
That's the standards.
00:08:52
And he said you know only a very small amount of people actually
00:08:55
make it through and you typically have like a six to 12
00:08:59
month ramp up time before you even go to the school and you
00:09:04
know those standards.
00:09:06
They come into play in the real world because now you know what
00:09:10
the bar is, you know you.
00:09:11
You kind of know what you're expected to do and what you're
00:09:15
able to perform at and whatnot, and that's expected of you.
00:09:18
You know day in and day out, and I feel like I've always felt
00:09:23
like we've had the best cyber capabilities, for sure.
00:09:26
And if you just look at the things that have leaked, you
00:09:30
know, though, like eternal blue and how many, how many zero days
00:09:34
came out of internal blue, right, and that's, you know.
00:09:39
That's 10 years ago at this point, Well, it's interesting.
00:09:42
Speaker 2: So you know, first of all, and work, I will tell you
00:09:45
that in working with the NSA, I interacted as much with lawyers
00:09:49
at the NSA as with the, with the cyber experts.
00:09:53
That's how careful they are at following our laws and so you
00:09:58
know they're not.
00:09:59
You know they're not doing things that are the older, very,
00:10:03
very, very careful.
00:10:05
That's something that they share.
00:10:08
But you mentioned there's not enough data sharing and stuff
00:10:11
like that.
00:10:13
All the leaks we had in the US have really been because
00:10:17
coastline alumn, the cyber community, you know, created
00:10:23
tools to share broadly the intelligence and there's over a
00:10:27
million people that have street clearances, that have access to
00:10:31
some of our nation's most you know, sensitive information and
00:10:36
that you know.
00:10:37
The Jack Tech Sarah, you know, leak recently is because it just
00:10:41
takes one of those people to use that information the wrong
00:10:46
way out of a million people.
00:10:48
So that's a half every month.
00:10:50
So the price that we're paying right now on those leaks is that
00:10:53
we give a lot of access to people and because we want to
00:10:58
share that data and, you know, one a bad thing to the change
00:11:03
and can cause that change.
00:11:04
So it is an interesting balance .
00:11:07
I know there's a big back and forth and you tell those
00:11:09
community about that at all times.
00:11:11
But honestly, I only wanted it.
00:11:14
We all need to dwell on it.
00:11:15
I just find that point out to your list, or is that like if
00:11:19
you're young and you're like not sure about these things, you
00:11:23
haven't come?
00:11:25
Just know that the people that are protecting us from a serious
00:11:30
death by someone that has to the world, and that's a good to
00:11:33
know and it's also important to respect.
00:11:37
Speaker 1: Yeah, absolutely, you know to dive into the insider
00:11:41
thread a little bit more, right, do you think that these Snowden
00:11:48
leaks kind of set the stage for you know all the other leaks to
00:11:53
follow.
00:11:54
Right, how big was that, how meaningful was that from a you
00:11:59
know quasi insider, you know expert knowledge, right, like
00:12:04
you probably have a little bit more knowledge on that leak than
00:12:06
anyone else.
00:12:08
Right, like, what was?
00:12:10
Speaker 2: that like that was a devastating leak.
00:12:12
I mean, that was a devastating leak for the United States.
00:12:16
You know, people lost.
00:12:19
Some people lost their lives over that leak because there was
00:12:21
so much information that she ended up in hands that it
00:12:25
shouldn't have ended up in.
00:12:26
And I think it was also devastating for Booz Allen and
00:12:31
their reputation, because he was a Booz Allen contractor and it
00:12:35
was so basic.
00:12:38
I mean, all thumb drives were supposed to have been, you know,
00:12:45
all external drivers were supposed to have been blocked,
00:12:49
you know, and they just hadn't gotten to that facility in
00:12:52
Hawaii to put those controls in place, and so it was easily
00:12:56
preventable.
00:12:57
It keep with policy would improve.
00:13:00
So it was careful, but holding up the level.
00:13:05
Look, here's the thing about insider thread and insider leaks
00:13:08
.
00:13:08
We're always going to have them and so you have to really put
00:13:13
controls in place.
00:13:14
But you know, back to this conversation about sharing data,
00:13:18
you've got balance tag with the need to share and collaborate
00:13:25
and if you step outside the document for just a second, we
00:13:28
go into corporate, which probably most of your listeners
00:13:31
are corporate.
00:13:33
I think what surprises people is how pervasive data is making
00:13:38
out of organizations today.
00:13:40
So we all might say, oh, you know so, do so, but haven't done
00:13:44
anything so stupid, or how could we be so stupid?
00:13:47
I've got that happen and up, up , up, up, looking your own
00:13:50
backyard I mean we, when our company was specialized in
00:13:55
helping organizations on insider threads we first come in.
00:13:58
What surprises our clients is that the amount of data moving
00:14:04
out of the organization is incredible.
00:14:05
Literally every single person that will reach your
00:14:08
organization for a new job takes a lot of critical data.
00:14:12
Literally every single one.
00:14:14
60% of people admit they took data from their last job and are
00:14:18
using it in their current job.
00:14:20
That's the people that admit it .
00:14:22
So, even if I said it's probably more like 90%, and so
00:14:28
it's really.
00:14:29
You know, what's interesting right now is that the whole fn
00:14:33
of AI and the datasets around AI people are finally starting to
00:14:37
pay attention and say, oh, wait a minute, do I need to be
00:14:40
worried about my source code leaving or my large ASS leaving,
00:14:45
or you know whereby, your customer lists or et cetera, etc
00:14:49
.
00:14:49
So we're seeing a real assertence in people because of
00:14:54
the focus on AI datasets.
00:14:56
But, to be fair, that's just a very small to the I for what's
00:15:02
actually leaving and most organizations.
00:15:04
We see a lot of source code, customer lists, hr data.
00:15:09
We see that all the time.
00:15:12
So it is an area I'm glad is finally getting some attention.
00:15:18
We can talk about sort of different stories around that
00:15:20
and how it's happening, why, but on the corporate side, just to
00:15:23
touch on the, you know, on the stone side, on the corporate
00:15:28
side, the breach that Millie sort of woke everybody up in the
00:15:32
last few years is Anthony Lewandowski, who took data from
00:15:37
Waymo which is all their self-driving car data and, just
00:15:41
like Snowden, took just a troll of the information, lewandowski
00:15:45
in the last week of his his time at Google or Waymo online, who
00:15:51
walks to all that data, and he just took it on an external hard
00:15:55
drive and then used it for a year before they realized it.
00:16:01
And they only realized it because one of the suppliers
00:16:04
accidentally sacked Waymo and said, hey, we can put
00:16:09
confirmation on this part.
00:16:11
And the people at Waymo was like wait, that's our parts.
00:16:13
Oh, we did order this and it turns out it was.
00:16:16
It was he just literally taken the exact schematic for his new
00:16:20
company and was saying that part and so you know it was all.
00:16:24
When he discovered accidentally by the folks at Google Now was
00:16:28
sort of the best, that's the snowman taste on the corporate
00:16:32
side and you know he ended up.
00:16:35
That's what was interesting in the end for your listeners is he
00:16:39
went to prison for that and was serving time in jail when, in
00:16:45
the last days of his presidency, president Trump parted Anthony
00:16:50
Lewandowski with no little to no explanation of his phone.
00:16:55
So interesting sort of story that kind of keeps going.
00:17:02
Speaker 1: Yeah, that's really fascinating.
00:17:05
I actually I didn't.
00:17:07
I don't think I knew about that .
00:17:10
You know, is Waymo still around ?
00:17:13
Speaker 2: after that.
00:17:13
Yeah, waymo's still around.
00:17:15
It was an massive issue between Waymo and and then Uber because
00:17:21
Uber.
00:17:22
It looks as though Uber basically encouraged Lewandowski
00:17:26
to take that data, stand up his own company, and then Uber
00:17:29
bought that company six months later.
00:17:31
And so Anthony Lewandowski was at Uber when they discovered
00:17:35
this and Uber was working on sell all the self-driving car
00:17:38
stuff.
00:17:38
So they it was a long lawsuit.
00:17:41
They ended up settling in the end, but then when they sell,
00:17:46
after they sell the lawsuit, then criminal trial came and so
00:17:50
it was a big deal.
00:17:51
Some people think it's.
00:17:53
You know, one of the reasons Travis lost his job was we're
00:17:57
all around the same time.
00:17:58
So it was.
00:18:01
It was a big.
00:18:01
It was very controversial at the time.
00:18:04
Dead pass.
00:18:06
Speaker 1: And that's really fascinating because you know,
00:18:10
like, how does that even, how does that even come about?
00:18:14
Right, like you know, you're working for Google on this
00:18:17
project.
00:18:18
A competitor, a direct competitor, like they, must have
00:18:23
approached him at some point during his tenure at Google to
00:18:27
approach him with this idea.
00:18:28
You know, I maybe I'm just not in the insider threat space,
00:18:34
right, but I mean that's a, that's a kind of corporate
00:18:38
espionage, that that I I never would have thought of, I never
00:18:44
would have imagined that a competitor would go to that
00:18:48
length.
00:18:48
You know, I could see them, you know, buying the company, right
00:18:53
, but the for the idea to come into place with this guy, to
00:18:59
take the code form a company, start, you know, probably
00:19:02
develop it with it, try and order the parts that were
00:19:06
proprietary, you know, for what he was using at Google, I Mean
00:19:11
that's just a different Love that I feel happens every day.
00:19:15
Speaker 2: We had, we beat, we beat.
00:19:16
We had a new client just a couple of weeks ago at code 42
00:19:20
where they had Employee that left and stood up his own
00:19:24
companies in his source trust.
00:19:26
The way it happens is people that are Smart and people that
00:19:31
create new things All are capable companies.
00:19:34
They, they, a lot of them believe why created this design.
00:19:38
So you know, I'm gonna take it with me to my next job.
00:19:41
They'll.
00:19:42
And that's not the way a lot your property works.
00:19:45
When you work for a company, when you join, you sign an
00:19:48
document says anything I create for this company the company
00:19:51
owns, and so we see this every day was sourced to right now
00:19:56
most software developers.
00:19:57
They have their own get cover, get lab accounts, your repos.
00:20:05
You're gonna talk to developer friend hey, do you own your own
00:20:08
repo?
00:20:08
Oh, yeah, I guess we have in your ego of that projects that
00:20:11
are working on my whole career.
00:20:12
Okay, well, those products for companies we are you know, let's
00:20:16
does this company source code we have?
00:20:18
I mean, it's not like I took it .
00:20:19
I left the copy.
00:20:21
The company's using that copy.
00:20:22
I took the copy of the source code With me and no, we see that
00:20:27
time and time again and it's interesting and this ties back
00:20:32
to the AI stuff I was out there about.
00:20:34
So the way we look for the way most developers Take source code
00:20:40
is this kind of interesting and very straightforward, is they?
00:20:44
Essentially, you know, every day when the developer pulls
00:20:46
their code down from the corporate repo, you know that
00:20:49
corporate code is locked up tight it's.
00:20:51
You know you gotta have the right stiff divider machine to
00:20:53
get into it.
00:20:53
Sometimes it's all like back authentication, but like you're
00:20:56
not getting in that vehicle unless you're authorized to know
00:20:59
.
00:20:59
Right, most companies are really good now and so well.
00:21:02
Once the developer takes the code down to their local machine
00:21:05
, that's when they start buying code.
00:21:07
They got their test cases running.
00:21:08
They got a bunch of the ends etc, a writer code, and then
00:21:12
they check it back into the forklbeat pop.
00:21:14
Well, you know, in order to check it back in, you use it
00:21:18
commands to push that code.
00:21:20
It's called a git push.
00:21:21
She pushed that code back up is the recalls.
00:21:23
Oh, what a lot of developers do is, at the same time, they're
00:21:26
gonna take the bill, get pushed to their own personal repo and
00:21:31
you know if they're sitting at home and they're off the
00:21:33
corporate network which was developers are these days or
00:21:36
there's our what.
00:21:37
So, wherever they are, most organizations are completely
00:21:41
blind to that get pushed to the corporate, to personal repo, and
00:21:46
we built technology code 42 so we could see that.
00:21:50
And unless we did, that was her seeing some resource Good at
00:21:53
filtration.
00:21:53
We were literally like, oh my gosh, we didn't know.
00:21:56
We didn't even know that this was happening.
00:21:59
At the same time, the same capability also sees when you
00:22:04
move large datasets.
00:22:06
You also use the git commands to use large, large datasets.
00:22:10
So we also started seeing large datasets getting moved around
00:22:15
and that's where the AI I was.
00:22:18
That comes in a play where people moving large datasets to
00:22:21
train LLMs for AI usage and you're gonna see back in the
00:22:27
same capability we law.
00:22:29
We're let a company that has this capability out there today.
00:22:33
We lost it about two years ago and so the timing was just lucky
00:22:39
.
00:22:39
We didn't, we weren't anticipating that was that half
00:22:42
of it.
00:22:42
With the AI and the large language models I know, which I
00:22:46
have a lot in the a stop a few years ago, but but again we see
00:22:51
this kind of huge movement To that again.
00:22:54
So back to the afternoon and ask you story like yes, he took his
00:22:58
designs, yes, he took his files , let's see, toss up.
00:23:01
I mean, he went to prison for this, so he's obviously had to
00:23:04
pay the price.
00:23:05
But in his mind he probably was like, well, this is so fine,
00:23:09
that's it.
00:23:10
No, this is my stuff.
00:23:11
Like I do this, I want to forget, just like if a whole
00:23:14
team of people who were bonus and the damage done to the
00:23:18
people you leave behind as an insider, when you take
00:23:22
Everybody's, you know the work that everybody did and then you
00:23:26
go take it somewhere else is real.
00:23:28
And no part of what we often do as an insider risk company is we
00:23:34
help educate the organization on like a.
00:23:37
Hey, we're not allowed to do an .
00:23:39
I'll ask you why is an adder?
00:23:41
You know well, you know why is it important?
00:23:43
Is it?
00:23:43
Is it the company being mean?
00:23:45
Asking you your information?
00:23:47
Might, but people often don't sort of understand that the
00:23:50
impact that they have is on their old tears is Let it
00:23:54
biggest impact cash that you know occurs on inside risk hmm,
00:24:01
yeah, it's.
00:24:04
Speaker 1: I feel like it's almost like a, it's a miss in
00:24:08
the brain or something like that .
00:24:09
You know, because from my perspective you know I'm in it
00:24:14
right, I work a day job in cybersecurity there's a lot of
00:24:19
Potentially you know, proprietary information that I
00:24:23
have taken down in notes, in my, in my one note.
00:24:26
But there's a lot of Things that I'll that I'll learn right
00:24:33
for the very first time and I'll take note of it and it'll be,
00:24:35
you know, not proprietary information, right, it's a
00:24:41
configuration in AWS or whatever might be, and I'll take note of
00:24:45
it so that I remember it.
00:24:46
And when I leave the company, if I don't know it by heart,
00:24:50
I'll just take that little, that little piece of information and
00:24:53
put it into my personal one note, right, but it's not
00:24:55
proprietary, it's not anything that's you know, customer, the
00:25:01
company or anything like that.
00:25:02
And for me to do the mental gymnastics, right, to kind of
00:25:09
rationalize taking proprietary information from company, I mean
00:25:15
I don't want to go to prison.
00:25:19
Speaker 2: And it doesn't usually end up in prison.
00:25:21
I think part of what's going on here is that most organizations
00:25:27
today have some form of data protection but are Are.
00:25:32
You know, our ability to exfiltrate data from our company
00:25:36
is expanded so rapidly in the last five or six years that
00:25:40
people just don't think Daniel is paying attention or they
00:25:42
don't think that any of that car works.
00:25:44
And it is probably more the former than the latter, because
00:25:47
if they really think about any car and they feel guilty about
00:25:49
it and they and awesome, they won't do it, which is good.
00:25:51
But most companies today just can't see.
00:25:55
If you upload a document to Dropbox from your house, you
00:25:59
know you're not on the company network, or you know and you
00:26:03
just Gmail to yourself.
00:26:04
These are the most common ways that people take data and
00:26:08
they're free and most people are like, well, no, I don't think
00:26:11
my company sees that, you know I can still print and all kind of
00:26:14
stuff, and so you know, you know our.
00:26:19
Our philosophy as a company is we coin in terms of secure the
00:26:23
collaboration culture, and the collaboration culture is how we
00:26:28
all live today.
00:26:28
We use stack, we use teams, we use T drive and one your I.
00:26:32
We have all these tools like Salesforce, that they're cloud
00:26:35
based, last share information and our work clothes are shared
00:26:38
and we can collaborate on presentations together and
00:26:41
that's awesome, like it's a so much more productive as
00:26:45
organizations, right.
00:26:46
And so he insecurity is not to get in the way of that and to
00:26:52
just brought a little bit of security around it so that
00:26:54
people don't feel like, hey, nobody's watching, nobody cares,
00:26:57
and you'll find it in one of the ways that we do that, that's
00:27:01
how it is that the impact is, and somebody good employee,
00:27:05
normal employee, been working, you know, in their job does
00:27:09
something that they're not supposed to do.
00:27:11
We'll send that.
00:27:13
The system automatically send them a video.
00:27:15
Is this hey, we noticed that you uploaded a file to Dropbox.
00:27:19
We don't use Dropbox as our sharing platform here at X
00:27:24
company, you know, please?
00:27:26
So what that does is it puts the employee on notice that well
00:27:30
, somebody's actually paying attention, but it does it a very
00:27:32
nice, polite way, etc.
00:27:33
And if you let people know that we're watching a score, most
00:27:39
people are steal from you and most people behave the right way
00:27:44
.
00:27:44
And I'll say, if I last week I was doing a presentation in San
00:27:48
Francisco and I got there with my laptop at the conference and
00:27:52
they were like, oh, you can't use your laptop, catholic, but
00:27:55
instead I could update fine on, use yours and know like we need
00:27:59
your presentation.
00:28:00
And the only way I could get it done was was a thumb drive.
00:28:03
So I put my thumb drive in and had me using adapters.
00:28:07
Of course, matt, matt doesn't allow forever.
00:28:10
Eight and my days.
00:28:12
The presentation is them and I you know it was I one minute
00:28:15
before like my kickoff.
00:28:17
So it was like fast, Like I don't know, I did my
00:28:20
presentation that afternoon.
00:28:22
I am in knots.
00:28:24
I got an email but I was a black from my security team, the
00:28:28
little video attacks and said you know, no use, found rise to
00:28:32
your code 42 to take that.
00:28:35
So you know, risky way to XLT day it.
00:28:37
Please watch this video.
00:28:39
I had watched the video all the way through.
00:28:41
You know I did the very tenth and check that I have lost video
00:28:45
and all that kind of stuff, stuff.
00:28:46
So that's how controls you place working in a line and you
00:28:49
like don't, don't do that.
00:28:52
And just by doing that, now I know if I were to leave the
00:28:56
company, like if I moved a bunch of data, they would pay it,
00:29:00
they would notice and they would pay attention.
00:29:02
So that kind of show, you know, that really reinforces a way to
00:29:05
keep people from actually doing something.
00:29:09
Speaker 1: So I mean, that's a great.
00:29:11
That's a great like reinforcement of a, you know, a
00:29:16
learned behavior right.
00:29:19
But how do you, how do you stop that developer from uploading
00:29:24
to their own personal you know, get repository right?
00:29:28
Because I don't, I actually don't know.
00:29:31
Speaker 2: Yes.
00:29:31
Well, from a technical standpoint you don't want to try
00:29:34
to solve that.
00:29:34
And then you hear the other one is, if you get in the way of a
00:29:38
software developer as a security person, which one?
00:29:42
You is the leaser job?
00:29:45
And I'm telling you, this is just right.
00:29:48
You do not want to get in the way of the 300 software
00:29:51
developers you got to your company, or 500 or 1000 or
00:29:53
whatever, and that's two, though , slow down their machine.
00:29:56
If you slow down your developer's machine, hell is
00:29:59
going to pay by the CTOs that you go to the CEO and say where.
00:30:03
And also, you don't want to get in the way of them using get
00:30:07
commands.
00:30:07
That's the.
00:30:08
That's how you do their job every day.
00:30:10
So that's why the approach we take in is not to to stop that,
00:30:16
but it's to monitor that and to and, of course, correct behavior
00:30:22
.
00:30:22
So, if so, the first time a developer moves something to a
00:30:26
open source product that's unsanctioned, which is also how
00:30:29
the that we see that a lot too, which is, hey, meet, work, we're
00:30:33
contributing to 70 open source products, but it turns out that
00:30:36
when we actually start monitoring, we see code moving
00:30:39
to a lot of hundreds of open source products.
00:30:41
It's a very regular thing that we see at code 42.
00:30:45
When we work with our clients, the first thing you do is you
00:30:51
send that video to say, hey, no, do that.
00:30:53
And then the second time the developer does it and you have a
00:30:57
conversation and then if it happens again, then then you go
00:31:01
to their boss and say, hey, no, developer is doing X, y and Z.
00:31:04
But what you don't do is overreact and say fly that
00:31:09
developer, set down their machine, cut off all software,
00:31:13
that people from pushing code around with gate tomehans.
00:31:16
That's exactly the home response for a security team to
00:31:21
have, and I think it's it's it's right.
00:31:23
That's one of the big differences between insider
00:31:27
threat and external threat, because when you have a piece of
00:31:31
malware come in, you know the first thing that you do is it's
00:31:37
killed by the sledgehammer.
00:31:38
You don't isolate that machine, you're going to disconnect it,
00:31:41
you're going to quarantine it.
00:31:42
That is not what you do with insider threat, because you
00:31:46
really wanted to investigate and understand what is the person
00:31:50
doing.
00:31:50
Why are they using drought loss ?
00:31:51
Why don't Joe use a thumb drive ?
00:31:53
You know, and it turns out Joe used a thumb drive because he
00:31:55
don't know, because he was giving a presentation and he had
00:31:57
to in order to get it done, even though it's against our
00:31:59
policy.
00:32:00
We use a thumb drive.
00:32:01
We understand why we made that decision in that situation and
00:32:05
we didn't come down and get Joe with a sledgehammer right,
00:32:08
because it's always a bad actor when malware gets in.
00:32:12
You know it's always a colleague when we're talking
00:32:17
about insider threat.
00:32:20
The threat is fast moving and propagating when it's from the
00:32:24
outside.
00:32:25
But insider risk does it spread ?
00:32:28
Just because you, joe, lose the files around doesn't mean so
00:32:31
hot or Joe is going to move some files around.
00:32:32
That's not how it works.
00:32:33
You have time to investigate and to understand what's
00:32:37
happening.
00:32:37
Right, when it's malware, you know the security team can
00:32:42
handle it on its own every time.
00:32:44
But when it's an insider, you're going to need HR, you
00:32:48
might need legal, you're going to need a little bit of help to
00:32:51
do that.
00:32:51
So these are very different situations.
00:32:54
It's never accidental when you get malware in.
00:32:58
It's always it's sometimes.
00:33:01
It's sometimes accidental for in fact, it's, about 50% of the
00:33:05
time, an insider risk event.
00:33:08
This was just an accident.
00:33:09
Like you never need to educate the hackers, the bad guys.
00:33:15
Like that's a waste of your time and money when you always
00:33:19
want to educate your own employees, because that brings
00:33:22
down the number of events for you last time in it.
00:33:26
And then, last thing, I think the interesting one is you can't
00:33:31
.
00:33:31
You can get fired for not reacting fast enough to a
00:33:36
malware threat in your environment, but with insider
00:33:40
risk you can get fires for reacting too fast and so it's
00:33:45
like it's a totally f*****g-less-it sign.
00:33:48
So one of the things that we always work with our clients on,
00:33:52
if you're in security, you really need to process that is
00:33:55
how is this?
00:33:56
Is that the folks that are running CrowdStrike and look at
00:34:01
all the internal, the external activities, are not necessarily
00:34:05
the same people that you want to have running your internal,
00:34:08
because they can be, but it's a.
00:34:10
You have to turn your brain around and understand which
00:34:15
problem that you're working on external or internal because
00:34:18
your response is and the way you handle it are so very, very
00:34:22
different.
00:34:25
Speaker 1: Yeah, that's a really good point that I was going to
00:34:29
bring up.
00:34:29
It sounds like you almost need two separate teams because to
00:34:34
that normal security team everything looks like a nail
00:34:37
when you're used to being the sledgehammer.
00:34:39
I'll tell you right now if I saw something like insider
00:34:46
threat or whatever, I would have immediately, without question,
00:34:50
quarantined the machine, started doing a forensics investigation
00:34:54
into the guy or whoever it is.
00:34:57
I would immediately go the nuclear route.
00:35:01
Okay, we're going to make sure this person can't do anything.
00:35:05
Speaker 2: Unfortunately, that's an exact story from my customer
00:35:07
base.
00:35:08
One of my customers, ciso, has called me and said Joe, I'm
00:35:13
really angry with you.
00:35:14
Your team handed my team a gun and didn't teach you how to use
00:35:18
it.
00:35:18
And it was the very first thing incident they had was with the
00:35:23
senior vice president at this organization, and the security
00:35:27
team did exactly what you described a warranty machine, a
00:35:31
toboa machine and then they interrogated the senior vice
00:35:34
president and was hugely embarrassing for that executive.
00:35:37
But it turns out the executive was just actually doing their
00:35:41
job and there was a little bit of a misunderstanding about why
00:35:47
I'm supposed to be sending information to that particular
00:35:50
vendor in this case.
00:35:51
And the security team oh, that's an untested vendor and oh
00:35:55
, yes, had they handled it the right way, it would have just
00:35:59
said oh great, we've learned from that and we'll add that to
00:36:01
our trusted list or wherever.
00:36:03
But they put on a team machine, they isolated it and then they
00:36:06
interrogated a person and so, yeah, that happens.
00:36:09
And so part of what we've learned is like who are we going
00:36:12
with our customers?
00:36:13
We have to have a lot of conversations and the funny
00:36:17
thing is is most of our customers are not, you know,
00:36:21
securing folks, like you've worked with them all year, most
00:36:23
of all like we have this message that we know you want to tell
00:36:26
us.
00:36:26
We're very familiar with all the stuff, and we have to tell
00:36:28
you listen just a little bit in us, because your methodology is
00:36:33
so different.
00:36:35
So many people in security would like to think like Fedor, say,
00:36:40
mom, let's just block, let me just block all this.
00:36:42
You know exfiltration, and if you just block it, then you know
00:36:47
we all worry about it and it doesn't really work with
00:36:51
insiders, right, you know it doesn't really work as
00:36:54
first-worlds like well, so you're gonna block external jima
00:36:56
.
00:36:56
You know a lot of it.
00:36:58
So how are your employees going to?
00:37:00
You know, are they after a second machine around with them
00:37:04
and they have to do it?
00:37:06
How will that go?
00:37:07
Re-employment oh, tough, tough today, but okay, well, fed, we
00:37:11
know, you know, let's see if that, if that plays out well in
00:37:14
terms of your employees.
00:37:15
Just don't they find that you, you got a nail or a proton nail
00:37:19
where they start, you know, going around you.
00:37:21
So what always finds a way, and so, oh, we tell our customers.
00:37:25
As I look, your employees in most of the organizations we
00:37:28
work, your employees are better have a gene nail account.
00:37:32
They might have a dropbox tab because they do something with
00:37:34
their church or their school soccer gene with thousand like X
00:37:37
.
00:37:37
The important thing is that you help them identify, is that you
00:37:42
watch for important company data not moving to those things,
00:37:46
and then you course correct them if you see those things
00:37:49
happening and you always have the information available to you
00:37:52
that you can.
00:37:54
It's necessary to cross you down or whatever, but usually
00:37:57
what you just need to do is course correct and let them
00:38:01
operate the way they they need to offer and collaborate and
00:38:04
work together.
00:38:05
You cannot get in the way as if you start putting on these
00:38:08
rules.
00:38:08
One people's machines, it's posed down to machines for
00:38:12
everybody, and so it tends not to be a great way to do things.
00:38:19
Speaker 1: Yeah, it reminds me of a time a little bit earlier
00:38:24
on in my career where, you know, my manager was walking me
00:38:28
through, like our, our data loss prevention solution that we had
00:38:32
, you know, and he was saying how, you know nothing, nothing
00:38:36
is going to leave that we don't know about, or anything like
00:38:39
that, and that you know it's a perfectly locked down and
00:38:43
everything like that.
00:38:43
You know, and my security mind, I immediately and I did this
00:38:49
subconsciously, right, I didn't even realize that I did this at
00:38:52
the time, I took it as a challenge Like you think I can't
00:38:56
get around this, like I'm not the admin on this, I don't own
00:39:00
the tool, but you think that I can't get around this.
00:39:04
And then I immediately started discovering ways of getting
00:39:07
around it.
00:39:08
And when he didn't believe me, I showed him right there.
00:39:12
I was like, well, I just did it .
00:39:14
You know, like it's, it's on my phone now, it's on my personal
00:39:17
cell phone now.
00:39:18
Like what are we?
00:39:19
What are we doing?
00:39:20
You know, and it's, it's a different, it's a different
00:39:26
mentality that security people have, you know, because I feel
00:39:30
like when you tell us that we can't do something, we
00:39:34
immediately make sure that we can't.
00:39:37
Speaker 2: Well, it's funny.
00:39:37
I just as as as as comprehensive as our product is
00:39:42
today.
00:39:42
And the thing about traditional DLP is it doesn't see.
00:39:46
There's so much it doesn't see.
00:39:49
I bet in the way we talk about it is traditional DLP.
00:39:52
You write specific rules to cover things that you want to
00:39:56
cover and so as long as you know what all the risks are, you
00:39:59
know you'll be able to refine.
00:40:01
Of course, you don't know all the different ways that people
00:40:03
can exfiltrate data and move data around, and so they tend
00:40:07
not to be very effective solutions.
00:40:10
In fact, when we go, when we sell today, 85% of our customers
00:40:15
and Greenfield mean it may not have anything.
00:40:17
Because people gave up on DLP 15 years ago.
00:40:21
They said these systems don't work, they keep us from
00:40:23
collaborating, et cetera.
00:40:25
And so the space we call the space and Cyrus management today
00:40:30
Microsoft calls the same thing.
00:40:33
So the, the, the idea is really like hey, we will block people
00:40:39
for doing things that all the in rare circumstances only mostly
00:40:43
focus on is monitoring and then and then scoring things in the
00:40:48
cloud so we can see where did the data come from, who had it,
00:40:52
where did it go?
00:40:53
What do we know about that?
00:40:54
Versus is the first time that you said we can do all that kind
00:40:57
of analysis in the cloud and and and do it efficiently.
00:41:01
So then also, people's and phones down and then we can
00:41:04
score and then we can tell security.
00:41:05
Well, I need to pay attention to Joe and in particular, when
00:41:09
Joe is leaving the company, this is the biggest risk you have.
00:41:14
We can look back 90 days and say, hey, joe, 40 days ago he
00:41:19
took, he took, he took a lot of information and in this, well,
00:41:23
one is we talk lies in the same way that you.
00:41:25
You know you're very careful to make sure that we get our bags
00:41:28
back so they can't physically get into building their very
00:41:30
careful and actually the laptop accurate, so they can't get on
00:41:33
our networks.
00:41:33
But Only 10% of companies ask people about their data.
00:41:38
Only 10% ask you on the way out hey, did you take the data?
00:41:42
And so one of the things that we have is a process then say, go
00:41:46
back and look at every single person who's departing the
00:41:49
company and just double check that they haven't taken all
00:41:52
their data, because if you think about it out while they're in
00:41:57
the process of leading her, before they've left, it's really
00:42:00
easy to get it back at that point and I know that sounds
00:42:04
like well, how is it?
00:42:04
You know the security will.
00:42:07
You'll never get that data back , but if it's someplace, I'm
00:42:09
like, look, here's how you get it back.
00:42:11
You basically tell them we need to get back, you need to do
00:42:15
this, all copies, and we need to be confident that you're doing
00:42:18
that.
00:42:18
Because when I'm confident you're doing that, you're gonna
00:42:21
sign in attestation that you did that the total, full bill of
00:42:24
the process.
00:42:25
We're gonna notify your next employer that you're in
00:42:28
possession of our data.
00:42:29
If we notify your next employer that you're in position of our
00:42:32
data, that actually puts them on the hook legally for it.
00:42:35
They're gonna also send a pretty strong message to them
00:42:37
that, hey, you're hiring a new person and new person is never
00:42:40
worth the day of your company.
00:42:42
Is the process of stealing the data from their last company.
00:42:44
Do you really want to hire that person?
00:42:46
So it's what most people come to understand very quickly is
00:42:51
that they're putting their next job at risk if they don't return
00:42:56
the data and up like when an empty lot of dollars you left,
00:43:00
they end to start it for a year.
00:43:01
By that time they had taken all that data and they were using
00:43:06
it.
00:43:06
All that information was being used across Uber in this case
00:43:11
and so unwinding that was really complicated.
00:43:13
If they had found that the two days before he had left and
00:43:16
figured that out, it would have been a completely different
00:43:18
situation Although now it's very time-prisoned and then you
00:43:21
would take his mind and she's allowed it safe and his ideas
00:43:27
and worked at the next company and maybe created it so that
00:43:31
information and done some different things.
00:43:33
But you want to sell his actual designs, source code to
00:43:37
property, et cetera.
00:43:42
Speaker 1: With the evolution of AI and LLMs?
00:43:46
Are you seeing this as a new, I guess, attack avenue or attack
00:43:52
path for insider threat?
00:43:54
Because I'm thinking about it from the just a simple chat GPT
00:44:00
side of it.
00:44:01
Like most of the time the company isn't going to block
00:44:04
chat GPT.
00:44:04
You could just upload whatever you want to chat GPT and one.
00:44:10
You don't really know what they're doing with that data on
00:44:12
the back end.
00:44:13
So that's obviously a huge risk , but at the same time you could
00:44:18
save that conversation and then you can go and access it from
00:44:21
your personal computer.
00:44:22
Are you seeing newer attack paths that you haven't seen
00:44:27
before or come up?
00:44:29
Speaker 2: Yeah, and let's talk about sort of you know hat trial
00:44:35
, how to act on demand.
00:44:36
So first, I'm a rimerist.
00:44:37
Most of the people that are moving data out of the company.
00:44:40
They put them into large lines all like chat GPT.
00:44:44
They're a hoise.
00:44:46
And what are they doing?
00:44:47
They're just finding their jobs , like they're literally trying
00:44:50
to do their jobs.
00:44:50
They're probably not thinking I'd stay on Excel freeing the
00:44:53
data but not putting it up into chat GPT so that they can steal
00:44:57
it in a case, or just like hey, do you like to get an answer to
00:45:00
this or something?
00:45:01
So one, that whole video education part that we talked
00:45:05
about is super important, right?
00:45:08
So just remember, why are they doing what they're doing?
00:45:12
And can we dictate them and then say you know, help them not
00:45:17
do that?
00:45:18
That'll solve most of the problems.
00:45:20
Just try and be there.
00:45:21
They were actually trying to in most cases found steal data.
00:45:24
They certainly not find a steal data in chat GPT.
00:45:27
How would that benefit them?
00:45:30
I think what's newly been interesting is that it's the
00:45:33
first security.
00:45:34
So about seven months ago, when the supply chain attacks
00:45:38
started happening, you know some of the poor members would ask
00:45:47
security, hey, how are we on our supply chains and most of them
00:45:51
are there when nothing has been quite as loud as the boards of
00:45:56
directors specifically asking security leaders a re-cover for
00:46:01
AI, like how to low-earned up in the chat to TV.
00:46:04
It's one of those things that's been pressed to much that poor
00:46:08
members who aren't great technical usually and aren't
00:46:10
great security savvy but boy do they worry about this issue, is
00:46:14
they?
00:46:14
You know the tank cycle is really high and so they're
00:46:16
freaked out.
00:46:17
So security people are hearing a lot of like are we covered for
00:46:21
that?
00:46:21
So on the one hand, it's one of those times on security to be
00:46:26
like, hey, you do the best to more money and so it has some
00:46:28
resources because the board really cares about this.
00:46:31
But the actual threat out again is relatively easy, easily
00:46:40
mitigated and controlled by controlling what you know from a
00:46:46
network security standpoint, what you get access to.
00:46:49
You know, like our helping.
00:46:50
We have our own internal chat to TV, so it's hard data and so
00:46:55
it's easy to.
00:46:55
We restrict corporate access to chat to TV.
00:46:58
As I mentioned earlier, we also watch, you know, for large
00:47:03
style uploads as well, and then I think that's an area that's
00:47:10
been in this we've got to work.
00:47:12
Test you now One last example, sort of to your point RCTO did a
00:47:19
experiment and you just asked TechEBG to go tell us what the
00:47:25
product roadmap plan is for our competitor and for work.
00:47:30
Peppers and TechEKING got all of their stuff, so somebody over
00:47:35
there had uploaded enough information.
00:47:39
I guess they were working on their you know product plan and
00:47:42
why and how it been you know creating it.
00:47:44
And we got the insider of product plan just by asking chat
00:47:48
to TV.
00:47:49
So, yes, the format is real.
00:47:52
It is usually accidental, so you got to handle it, knowing that
00:47:56
it's usually accidental and closer, direct first, are paying
00:47:59
a lot of attention to it right now.
00:48:02
So it's not, it's something you really need to pay attention to,
00:48:05
even though I would say them, the previous threat to most
00:48:09
organizations right now is source code extliferation from
00:48:14
your own software engineers, because you know you think about
00:48:19
like hey, I have forgotten to install our source code.
00:48:21
That's bad, because you know they can look more bullies in
00:48:25
your source code.
00:48:25
But that factor is at a hard time.
00:48:28
Taking that source code and making a product, the person
00:48:31
that wrote back to the scope and knows exactly what it does and
00:48:35
how it's written and what business problem it's solving
00:48:38
because they wrote it.
00:48:39
That's the biggest risk to your source code today and keeping
00:48:43
those people in line and in check from doing that is a much
00:48:48
bigger risk today and I think you'll start to hear a little
00:48:53
bit more about this in the coming months.
00:48:56
Is it a few big cases that are happening on Thursday?
00:48:59
Is it probably a bigger risk than what's happening on the AS?
00:49:06
Speaker 1: Wow, that product roadmap that is.
00:49:10
You know, I mean the person that probably uploaded it right
00:49:15
was just trying to get chatGPT to write it better.
00:49:17
You know, I mean I do that with everything you know.
00:49:21
Speaker 2: I mean I know people that do that with all their
00:49:23
emails to executives, right, you know it's a very valid and
00:49:28
again I get it, you're not malicious, so you think right,
00:49:31
you're not trying to hurt the company when you do it right.
00:49:34
So because of that, it's one of those things that can be
00:49:39
largely solved through education .
00:49:41
But you have to take it on, you have to address it and then you
00:49:44
secretly leave things as well as soups.
00:49:46
So most of us, all of us, go through training.
00:49:49
You know there are companies that copy.
00:49:51
Every year we have to do these mandatory trainings and none of
00:49:53
us pay attention to it.
00:49:55
We all push 2X on the video thing.
00:49:57
You know that's how we do it.
00:49:59
What really we found is really the type of the moment you do
00:50:03
something wrong within a few hours.
00:50:06
That's when we send the video as an end time, because you know
00:50:10
, oh, I did do something wrong, I did upload something to
00:50:13
chatGPT.
00:50:14
I shouldn't have done that and they noticed, and so you could.
00:50:16
Why those things?
00:50:17
That's just too important.
00:50:19
So I would say that right now, inside of Threat in AI is an
00:50:24
education problem and then, of course, correction problem,
00:50:29
because a lot of people will suddenly be like look, I know
00:50:32
I'm not supposed to do it, but I'm not going to email to my CEO
00:50:35
.
00:50:35
He needs to be really good and so I'm going to put in there and
00:50:38
ask for better language and stuff.
00:50:39
Well, if you know you're made it caught building that, then
00:50:42
you're less likely to do that, but if you don't think anybody's
00:50:45
paying attention, then you're going to continue to do that.
00:50:47
So I think it's that.
00:50:48
Of course the education is important, also the enforcement
00:50:52
of that education, but that's different than just sitting and
00:50:55
someone with a stash card.
00:50:56
No.
00:50:58
Speaker 1: Yeah, you're playing more into the psychology, right,
00:51:02
it's more of the psychology of the person.
00:51:05
How do we change that thought process?
00:51:07
How do we change how they view this or whatnot?
00:51:10
Right, which is?
00:51:11
It's the better approach than the sledgehammer that I would
00:51:18
have done.
00:51:18
Speaker 2: And Joe, you pointed this out.
00:51:20
It's so different than most cybersecurity.
00:51:23
Speaker 1: Yeah, it's completely opposite.
00:51:26
Speaker 2: We should talk to fancy bear and tell them what
00:51:28
they're doing is not even thick.
00:51:29
You know what I mean.
00:51:31
There's nobody at CrowdStrike that's sitting around and
00:51:36
worried about educating.
00:51:37
You know, one of the things that we always get raised
00:51:43
eyebrows from security people is we say, look in security, we
00:51:48
don't want anybody to know our methods and practices.
00:51:50
Right, we don't want anybody to know that stuff.
00:51:52
It's set inside risk and companies.
00:51:55
And actually why tell people A lot of during your food hour,
00:52:00
monitoring you?
00:52:01
We care about your job.
00:52:03
We're not hot in your productivity, we're just
00:52:05
monitoring when you move data to untrusted location.
00:52:08
You know like we want you to know that we pay attention to
00:52:11
that.
00:52:11
And first of all, you tell security people that they're not
00:52:14
going to tell people that, no, you do.
00:52:15
You're not really want to catch them, but the rest of security
00:52:19
is more tax stuff.
00:52:20
It's like you just don't want them to do.
00:52:23
It is what it comes down to and you know it's a way to grab to
00:52:27
try to escape the hackers of the world and you know to find
00:52:33
syndicates who are really wanting these things today.
00:52:36
It's a waste of time and we see when they hack hospitals and
00:52:40
they're literally causing people life and death problems and
00:52:46
they'll tear.
00:52:47
You know, and so clearly you know it's.
00:52:51
We're wasting our breath and we try to educate the dinosaurs.
00:52:55
Speaker 1: Yeah, it's a great point.
00:52:57
You know, recently I'm not sure if it was in the news or
00:53:00
anything like that, I don't watch the news but you know,
00:53:04
lurie's Children's Memorial was attacked.
00:53:10
You know, it wasn't like a small attack, like they took them
00:53:13
offline, you know, and this is a children's hospital that treats
00:53:18
only the sickest of sick kids, that doesn't even charge
00:53:23
families if they can't afford the treatments, they don't even
00:53:26
charge them.
00:53:26
You know, I had a very personal experience with that right,
00:53:30
like my sister was a patient there and there was no way, no
00:53:35
way my family would ever be able to, you know, shell out the
00:53:39
half a million dollars to get her, you know, treated for the
00:53:44
next three years or whatever it was, you know, and they didn't
00:53:49
send us a bill or anything like that.
00:53:51
You know, like that was a huge weight lifted off of us.
00:53:54
And now these attackers, you know they they go in and they
00:53:58
they knock them offline.
00:53:59
It's like guys, you know, at least do an adult hospital, you
00:54:04
know what I'm saying Like a children's hospital is just like
00:54:08
the most heartless thing that you can do, but these attackers
00:54:12
they don't care, they know.
00:54:14
Speaker 2: They know and that's, and again, very different than
00:54:17
your insiders.
00:54:18
I mean insiders do care, they work at your companies and they
00:54:21
can most far, I mean there's those a few people doing, you
00:54:26
know, real uh, espionage at organizations.
00:54:29
I was a far kind.
00:54:30
So like, yeah, we're going to help you find those two, but
00:54:33
like, the most important thing is to help you reduce the amount
00:54:37
of offense.
00:54:38
You see, their non-friendly, their accidental.
00:54:41
That would just require a little bit of, you know, a
00:54:46
course budget so you can spend your time.
00:54:48
Go to some of the others.
00:54:49
You know, a friend of mine told me to send us to my first school
00:54:53
, my first job, in my early spring, because I was the
00:54:57
manager of a small retail store and I saw like seven people
00:55:01
working really small and, um, and somebody was taken through
00:55:05
the till and this is where all came to surprise, you know, and
00:55:10
that then we took tax rights and my owner, the boss, said look,
00:55:15
joe, 10% of the people, uh, will never steal from you, and 10%
00:55:23
of people will always steal from you.
00:55:24
And 80% of the people will steal from you if you give them
00:55:28
the opportunity.
00:55:29
So your job is to set the systems and the processes and
00:55:33
the controls so that 80% of them steal from you and you go focus
00:55:39
and figure out who the 10% that will always steal from you is
00:55:43
and um, and that's sort of a retailer, a retailer, a retailer
00:55:46
, a retailer, a retailer if you ask a retailer, who's your where
00:55:50
, where's most of your leakage from?
00:55:51
And it's not from, um, people coming in well, that some cities
00:55:56
are not mostly not people coming from from the outside,
00:55:59
and so so it's your employees taking it.
00:56:01
And I think the information services businesses and
00:56:04
professional services businesses have been so slow to realize
00:56:07
that Um, uh I tell that story often now because we try to
00:56:13
really help our clients do is get that 80% figured out, so
00:56:17
that they're trying to start with the 10% that are, that are
00:56:21
are going to take three or four or what, um, and, and catching
00:56:24
that is is is really important because they probably have
00:56:28
malicious intent with what they're going to do with the
00:56:30
data.
00:56:31
Speaker 1: Hmm, well, you know, joe, we're.
00:56:34
We're, unfortunately, we're at the top of the hour here.
00:56:37
We're at the end of our time.
00:56:39
You know, I feel like we could we keep talking about this
00:56:42
forever.
00:56:42
Um, you know, yeah, it was a, it was a fantastic conversation.
00:56:47
I really appreciate you coming on.
00:56:48
Um, you know, before I let you go, how about you tell my
00:56:52
audience, you know, where they could reach out to you if they
00:56:54
wanted to reach out, and where they could find your company?
00:56:57
Speaker 2: Yes, so we're code 42 and that's code 42.com and you
00:57:01
can get me at pain Joe on back, sign us and you can get me at
00:57:07
Joepain JYNE at code 42.com and happy to talk to any of you.
00:57:12
And um, you know we try to get back to the community.
00:57:16
So the research report coming out, um, I think in a few days,
00:57:21
uh call the data exposure report .
00:57:23
We do it every year, so look for that in this loss and
00:57:26
information there.
00:57:26
Uh, inside of that and center risk.
00:57:29
Speaker 1: Awesome.
00:57:30
Well, thanks everyone.
00:57:32
I hope you enjoyed this episode .
Related Episodes
Outsmarting Cybercriminals: A Deep Dive into Social Engineering, Deepfakes, and Digital Defense with Aaron Painter
Prepare to have your mind broadened and your digital defenses bolstered as we journey with cybersecurity expert Aaron Painter, whose insights from Microsoft and NameTag are nothing short of enlightening. We tackle the increasingly sophisticated realm of social engineering, where attackers prey on h...
Educational Grit and Quantum Communications in Space Security
Embarking on the rollercoaster ride of higher education can be daunting, but what if it's the key to unlocking a career in the complex world of cybersecurity? That's exactly what I dive into in our latest episode, as I peel back the layers of my own experience, from the decision to pursue...
Seizing IT Opportunities - Gerry Gebel's Professional Saga
Ever wondered how an economics graduate ends up orchestrating identities in the tech world? Join us as Gerry Gebel unpacks his incredible journey from an unexpected programming class to spearheading a bank's leap into IBM technology. His story, far from typical, is a testament to seizing oppor...