1 00:00:00,980 --> 00:00:05,840 Well, I think most of us realize that security and entrepreneurship go hand-in-hand. 2 00:00:06,120 --> 00:00:09,300 All the major players in the industry are venture-backed. 3 00:00:09,320 --> 00:00:15,140 Mostly, those companies are too young to vote or drink, let alone screw with their customers. 4 00:00:16,140 --> 00:00:25,380 So, if you're in security, at some point, you're going to work for a start-up, or you're going to buy products from a start-up, or you're going to invest in a start-up, or you're going to acquire one. 5 00:00:26,120 --> 00:00:30,040 So, you want to know what's going to happen to all these start-ups. 6 00:00:30,240 --> 00:00:31,920 Is there room for more of them? 7 00:00:32,080 --> 00:00:33,500 Which ones will succeed? 8 00:00:34,100 --> 00:00:37,840 Today, I'll discuss the long-term role of start-ups in the security ecosystem. 9 00:00:39,400 --> 00:00:53,340 But rather than speculate on the industry's future successes, because that's something I think that many of you are probably more capable to do than I am, or rather than hype my own investments, I think it's more instructive to highlight mistakes of the industry. 10 00:00:54,080 --> 00:01:01,460 Because, unfortunately, security doctors don't swear a Hippocratic oath to do no harm. 11 00:01:02,080 --> 00:01:04,820 And so far, the results have been disastrous. 12 00:01:12,580 --> 00:01:17,120 So, these are some of the questions that people ask me that I'll try to address today. 13 00:01:19,100 --> 00:01:24,560 So, next question is, why dwell on the mistakes? 14 00:01:25,480 --> 00:01:34,780 Well, 10 years ago, Dan Farmer popularized the notion that we can't secure our networks if we don't openly air our vulnerabilities and errors. 15 00:01:35,060 --> 00:01:38,760 And just this week, Michael Lynn reminded us of the same thing. 16 00:01:38,940 --> 00:01:46,420 A lesson that I think applies not only to information security, but also, I believe, to all challenging pursuits, including venture capital. 17 00:01:48,840 --> 00:01:57,840 And in case you think that I can only dish it out, but I can't take it in, you're welcome to take a look at the anti-portfolio that we at Vestamer published on our website. 18 00:01:57,840 --> 00:02:00,240 It's the only one of its kind in the industry. 19 00:02:00,400 --> 00:02:14,000 You can read in gory detail, if you like, about the, frankly, stupid reasons why we passed on the first investment rounds in Intel, FedEx, Apple, eBay, Google, many others. 20 00:02:15,360 --> 00:02:17,260 Good lessons there for us. 21 00:02:20,330 --> 00:02:28,130 So, this presentation is for investors who don't want to lose their capital. 22 00:02:28,650 --> 00:02:32,210 Entrepreneurs who want to navigate the landmines. 23 00:02:32,790 --> 00:02:36,050 Engineers who don't want to make the wrong career choice. 24 00:02:36,530 --> 00:02:41,370 Chief Information Security Officers and their staff who don't want to buy the wrong product. 25 00:02:42,670 --> 00:02:48,190 Also, anyone with money in the bank who wants to keep it safe. 26 00:02:48,190 --> 00:02:57,050 And, if that doesn't just about cover all of you, then I guess it's also for anybody who's looking to kill an hour between the two Fed presentations. 27 00:03:00,990 --> 00:03:07,250 So, still, I expect that many of you came here looking for more positive direction on tomorrow's great inventions. 28 00:03:07,890 --> 00:03:11,250 I feel obliged to offer something inspirational here. 29 00:03:11,250 --> 00:03:21,270 So, I've injected into my presentation some interstitial slides here and there offering up some great examples of entrepreneurial innovation. 30 00:03:21,370 --> 00:03:23,870 You'll see them popping up now and then. 31 00:03:26,390 --> 00:03:31,510 So, I've told you about some things that Bessemer Venture Partners has done wrong. 32 00:03:31,510 --> 00:03:39,650 Please give me just 30 seconds to tell you some things we've done right in an effort, perhaps, to lend some credibility to my ravings about the industry. 33 00:03:40,350 --> 00:03:43,310 So, here's the background. 34 00:03:43,310 --> 00:03:59,530 As the oldest venture capital practice in the nation, Bessemer has, for nearly a century, invested the family fortune of Henry Phipps, a 19th century entrepreneur who decided to reinvest his proceeds from the sale of Carnegie Steel into other tiny startups like W.R. 35 00:03:59,530 --> 00:04:01,430 Grace and Ingersoll Rand. 36 00:04:01,430 --> 00:04:15,490 More recently, Bessemer has funded the early stages of Parametric, Staple, Sienna, Cascade, VMX, Maxim, Veritas, Gartner Group, Perceptive Biosystems, and Skype. 37 00:04:15,670 --> 00:04:22,590 We have about 60 employees with offices in California, Massachusetts, New York, Bangalore, and Shanghai. 38 00:04:28,220 --> 00:04:33,860 We are the most active early stage venture firm in information security. 39 00:04:33,860 --> 00:04:37,780 You can see here we've invested in 17 security companies. 40 00:04:37,780 --> 00:04:39,720 Some of them are ones that I'm sure you know. 41 00:04:40,000 --> 00:04:42,300 Some you may be less familiar with. 42 00:04:42,300 --> 00:04:48,320 But one thing that's in common is that we work early on with experts in the security field to start these companies. 43 00:04:48,320 --> 00:05:05,560 Folks like Paul Makapetris at Nominum and Dan Farmer at Elemental, Bruce Schneier at Counterpain, Mark Mayfritt at EI, Gene Kim and Gene Spafford at Tripwire, and of course Ron Rivest at Verisign. 44 00:05:07,840 --> 00:05:15,160 All but the recent three early stage investments that we've made here of the 17 are all doing well. 45 00:05:15,160 --> 00:05:17,740 They all have run rates above $10 million. 46 00:05:18,320 --> 00:05:19,820 Five of them have gone public. 47 00:05:19,820 --> 00:05:21,820 One of them was acquired by Cisco. 48 00:05:22,900 --> 00:05:28,180 And among the 17 investments we've made there hasn't been a single realized or unrealized loss. 49 00:05:34,480 --> 00:05:55,660 We have a dedicated security team at the firm including myself, Divesh Garg who ran Broadcom Security Business Unit, Chini Krishnan who founded Valisert, Chris Risley who was CEO both of Nominum and previously of On Technology, after going public, Symantec acquired, 50 00:05:55,660 --> 00:05:59,580 and just a broad strong team of security professionals. 51 00:05:59,580 --> 00:06:10,540 In this team we commit ourselves, we commit our time and our resources to maintaining a very rich dialogue with chief information security officers in the industry. 52 00:06:10,680 --> 00:06:18,740 Many of you are probably here and you know first hand that we do this and we do that really to maintain a good pulse on the marketplace on behalf of our companies. 53 00:06:23,180 --> 00:06:24,660 Easier to spread. 54 00:06:27,240 --> 00:06:28,480 Let's see. 55 00:06:30,280 --> 00:06:37,360 Okay, so the biggest challenge for startups is that nobody wants to buy from startups. 56 00:06:37,360 --> 00:06:39,360 People want to buy products from big companies. 57 00:06:39,360 --> 00:06:40,600 They want to buy suites. 58 00:06:40,600 --> 00:06:42,840 And there are some very good reasons for this. 59 00:06:42,840 --> 00:06:44,460 Very valid reasons. 60 00:06:44,460 --> 00:06:50,100 Product suites from big companies offer integration at the console level. 61 00:06:50,100 --> 00:06:55,740 They offer integration at the appliance level, making security easier to deploy in a scalable fashion. 62 00:06:56,180 --> 00:06:58,660 These companies promise event correlation. 63 00:06:59,520 --> 00:07:01,760 And I think one day they might even deliver it. 64 00:07:02,600 --> 00:07:09,780 And of course they do offer better vendor viability than what a startup can do. 65 00:07:25,980 --> 00:07:32,480 So I'm just going to run through some slides that show you the product footprint of the major companies in the industry. 66 00:07:32,600 --> 00:07:39,300 And this is a taxonomy that we've developed internally to map out security products. 67 00:07:39,760 --> 00:07:43,880 And the data for each company are probably about six months old. 68 00:07:43,880 --> 00:07:46,540 We last updated at the end of 2004. 69 00:07:46,680 --> 00:07:54,560 But you get a feel for how the different companies have staked out their turf across the security landscape. 70 00:07:54,560 --> 00:08:00,040 Here you have Symantec and of course McAfee. 71 00:08:01,720 --> 00:08:03,620 Here's ISS. 72 00:08:03,720 --> 00:08:10,060 And as you can see, the large vendors, each of them offer suites that cover different aspects. 73 00:08:10,060 --> 00:08:15,020 More than point solutions, but still they can't cover the whole landscape. 74 00:08:15,020 --> 00:08:30,020 And so what happens is that enterprises really often pick one suite and then fill in all the holes around the products that are offered by that suite vendor. 75 00:08:32,760 --> 00:08:36,340 So this is an inventive cold remedy. 76 00:08:43,610 --> 00:08:49,070 So then these big companies, they have these great suites and enterprises want to buy from them. 77 00:08:49,070 --> 00:08:51,550 So the question is, what are we smoking? 78 00:08:51,550 --> 00:08:57,050 We keep funding all these startups out there to compete against them and have a hard time selling. 79 00:08:57,690 --> 00:08:59,250 And why do we do that? 80 00:08:59,750 --> 00:09:02,370 And here's our thinking. 81 00:09:02,370 --> 00:09:07,390 Our thinking is that there are two major reasons why the startups have to exist. 82 00:09:07,390 --> 00:09:11,130 And in the long run, as a group at least, have to thrive. 83 00:09:11,590 --> 00:09:13,090 At least some of them. 84 00:09:13,190 --> 00:09:20,350 And the first reason is that there are constantly new protocols, applications and platforms that are being deployed in the network. 85 00:09:20,350 --> 00:09:26,310 And every time a new one comes along, then enterprises have to completely rethink their security. 86 00:09:26,330 --> 00:09:30,890 So that the security has to actually keep up with the new technologies quickly. 87 00:09:30,890 --> 00:09:36,390 It has to be the fastest changing element of the network because it has to move as quickly as everything else that's going on. 88 00:09:36,390 --> 00:09:41,930 And these are just some examples of protocols that enterprises are adopting now or have started to adopt last year. 89 00:09:41,930 --> 00:09:49,690 And every one of these things introduces important new vulnerabilities that change the way enterprises have to think about security. 90 00:09:49,910 --> 00:09:53,430 And then the second element is captured in this image here. 91 00:09:53,550 --> 00:09:57,390 And that is that security is very different from other elements of infrastructure. 92 00:09:57,730 --> 00:10:04,910 In other types of infrastructure, you're trying to basically... it's basically a battle of man versus nature. 93 00:10:04,910 --> 00:10:08,790 Trying to iron out the wrinkles, trying to get the products to work better. 94 00:10:08,830 --> 00:10:11,490 And asymptotically these products approach perfection. 95 00:10:11,630 --> 00:10:15,710 The way that routers and switches today basically work. 96 00:10:15,710 --> 00:10:19,870 They don't crash, we have enough bandwidth, basically they work fine. 97 00:10:20,710 --> 00:10:33,770 But security isn't like that because in security every time a company releases a product, you've got people who are... you've got many people who are actively trying to render it obsolete right away. 98 00:10:33,770 --> 00:10:36,250 Very creative and adaptive people. 99 00:10:36,310 --> 00:10:49,390 And if that's not enough, more recently the nature of that adaptation has changed now that the enemy is motivated less by ego, mischief and politics and motivated more by profit. 100 00:10:49,390 --> 00:10:53,750 Profit from spamming, profit from extortion, profit from ID theft. 101 00:10:53,750 --> 00:11:03,750 The enemy now has the patience, the resolve and the resources to continually escalate and continually adapt to the new products as they come out. 102 00:11:03,770 --> 00:11:17,270 And for this reason we believe that it's absolutely imperative that we continue to have startups, entrepreneurial teams, who are innovating new defenses against the tax. 103 00:11:17,630 --> 00:11:23,470 This is why I believe we've seen so much venture investment in startups. 104 00:11:23,470 --> 00:11:33,750 In the last two and a half years we've counted, and we may not know all of them, but we've counted 477 distinct companies that have received venture funding during that time. 105 00:11:34,430 --> 00:11:47,210 Obviously these companies aren't all going to be successful, but the level of innovation that's coming out of these 477 companies absolutely eclipses anything that's going on among the larger companies. 106 00:11:48,870 --> 00:11:55,330 So that's the role of the startup and that's the role that we try to fund. 107 00:11:55,970 --> 00:12:07,550 Now, with all these companies that are being funded, I'm sad to say that there aren't any public, there aren't any IPOs in the security industry since the beginning of 2003. 108 00:12:07,550 --> 00:12:15,990 So that's a lot of money going in and nothing really coming back to the hard working employees and the not so hard working investors in those companies. 109 00:12:16,510 --> 00:12:33,970 But what we do see is that, as we all know, mergers and acquisitions have really accelerated in the last couple of years, even beyond the peak of the bubble in terms of the number of deals and the number of dollars going to security companies. 110 00:12:34,370 --> 00:12:39,510 And that's because we have two types of companies in the ecosystem. 111 00:12:39,530 --> 00:12:42,550 We have the suite vendors who are great at integrating. 112 00:12:42,550 --> 00:12:44,910 Integrated consoles, integrated appliance. 113 00:12:45,170 --> 00:12:48,550 They offer, that's their value to the enterprise. 114 00:12:48,970 --> 00:12:51,650 Then you have the small companies who are the innovators. 115 00:12:51,670 --> 00:12:53,890 They produce the new defenses. 116 00:12:53,930 --> 00:12:56,950 Usually they're point solutions, but these are the new defenses. 117 00:12:56,950 --> 00:13:03,590 In order for the integrators to remain competitive, they have to assimilate the innovative solutions. 118 00:13:03,890 --> 00:13:15,530 And so, and so although journalists like to talk about what's happened in the last year as a consolidation in the industry, we don't view this as a phase of consolidation. 119 00:13:15,530 --> 00:13:17,650 We view this as a permanent fixture. 120 00:13:17,970 --> 00:13:19,930 This, this is going to persist. 121 00:13:19,930 --> 00:13:27,310 It's going to persist longer than the M&A string in the 90s where Cisco, 3Com and Lucent all acquired networking companies. 122 00:13:27,370 --> 00:13:31,750 Because again, those networking companies, eventually those products worked and they matured. 123 00:13:31,750 --> 00:13:35,350 But the best you can ever hope to do with a security product is tread water. 124 00:13:50,120 --> 00:13:51,980 No mess, no waste. 125 00:13:58,130 --> 00:14:04,510 So, now let me start to talk about why it is that we see some major bloopers and blunders in the industry. 126 00:14:05,250 --> 00:14:10,230 And it starts off with an analysis of people's state of minds when they buy products. 127 00:14:10,230 --> 00:14:16,530 And um, so I'm going to talk about reasons why people buy security technology. 128 00:14:16,530 --> 00:14:18,310 Why they pick one product or another. 129 00:14:18,310 --> 00:14:25,930 And the first reason, and this is one that I think we all agree is a very good reason, and one that a lot of attention is spent to here at Defcon. 130 00:14:26,550 --> 00:14:34,230 I understand how this technology will likely secure important assets from entire classes of attack at a reasonable cost. 131 00:14:34,710 --> 00:14:41,310 And here we like to think that this is the only reason why people choose one security product over another. 132 00:14:41,490 --> 00:14:43,770 But wait, there are more reasons. 133 00:14:44,730 --> 00:14:46,150 Here's one. 134 00:14:46,490 --> 00:14:49,930 Lots of other people seem to think that this technology works. 135 00:14:50,010 --> 00:14:51,870 I guess that means I need it. 136 00:14:52,990 --> 00:15:00,810 This common, weak minded disposition to suspend skepticism explains a lot of the problems in our world. 137 00:15:00,870 --> 00:15:02,730 Beyond information security. 138 00:15:03,270 --> 00:15:10,350 Not only might others be wrong, and I'll point out some doozies today, but there simply is no one size fits all security mix. 139 00:15:10,570 --> 00:15:15,490 Nonetheless, this kind of thinking does drive a lot of purchasing from the big security companies. 140 00:15:15,810 --> 00:15:20,310 Here's another brain malfunction that drives sales for Symantec and Cisco. 141 00:15:21,170 --> 00:15:28,370 If an attack brings our network down, I'll be okay, so long as it brings everyone else's network down as well. 142 00:15:28,650 --> 00:15:43,090 So I'm just going to hide in the safety of the herd and buy whatever seems to be selling well, and never mind that we're seeing more targeted attacks today, but more importantly, that the consequences of an attack to my enterprise are pretty much the same regardless of whether it hits others. 143 00:15:44,070 --> 00:15:47,150 Okay, why else do we see people flocking to Symantec and Cisco? 144 00:15:47,150 --> 00:15:50,510 Well, I got a good deal on a bundle. 145 00:15:51,310 --> 00:15:57,530 I bought that big router or appliance over there, and the vendor threw in some cheap or maybe even some free licenses. 146 00:15:58,110 --> 00:16:05,350 It might not work, it might inconvenience my users, it might suck up IT resources, it might even be another vector of attack. 147 00:16:05,350 --> 00:16:07,150 But it was cheap. 148 00:16:07,890 --> 00:16:13,600 My favorite example of this cheap bundle nonsense is antivirus licenses for servers. 149 00:16:13,870 --> 00:16:23,710 You know, the computers that nobody ever uses for email or browsing, and the signature AV companies actually charge extra for putting their AV products on those servers. 150 00:16:26,200 --> 00:16:29,320 Let's see, um, what's another reason? 151 00:16:29,320 --> 00:16:32,200 Oh yes, okay, we need to convince somebody. 152 00:16:32,760 --> 00:16:45,160 It might be our chief security officer, or our chief information officer, or our chief executive officer, or maybe the board, or our auditors, or the regulators, or our customers, or maybe Congress. 153 00:16:45,160 --> 00:16:49,200 We have to convince somebody that we've got best practice security. 154 00:16:49,200 --> 00:16:52,100 Of course, best practices have been defined by somebody else. 155 00:16:52,620 --> 00:16:57,780 Those practices might imply working technology, but then again, they might not. 156 00:16:59,360 --> 00:17:06,640 Let's see, here's one that, that startups can also exploit, as well as big companies. 157 00:17:06,880 --> 00:17:12,480 A nasty attack crashed our network, and so I've got budget to deploy a defense. 158 00:17:13,320 --> 00:17:17,500 And you can always spot these folks, because they don't want to hear about how the product works. 159 00:17:17,500 --> 00:17:22,960 They just want to run a battery of attacks against the product to see if it defends against them. 160 00:17:22,960 --> 00:17:26,300 And these are the attacks that they suffered several months ago. 161 00:17:26,300 --> 00:17:34,740 And they seem to have, they seem to suffer from this delusion that next quarter's attack is going to be exactly the same as last quarter's attack. 162 00:17:34,860 --> 00:17:40,080 And so as long as this product stops last quarter's attack, they somehow think that they're protected. 163 00:17:40,080 --> 00:17:43,900 I, I can't believe how often I see this in accounts. 164 00:17:43,900 --> 00:17:46,540 It's rather frustrating. 165 00:17:46,780 --> 00:17:51,000 And then finally, the last reason, is that there's always relationship selling. 166 00:17:51,060 --> 00:17:57,220 You know, the vendor threw a wild party, and so, uh, you know, I should buy the product. 167 00:18:00,000 --> 00:18:02,960 Okay, well, maybe that one's not such a bad reason. 168 00:18:02,960 --> 00:18:06,080 I'm going to move that up to the, to the plus category. 169 00:18:11,120 --> 00:18:12,600 Let's see, alright. 170 00:18:12,600 --> 00:18:18,220 So, those are, we see a lot of poor reasons why people choose security technology that doesn't work. 171 00:18:18,220 --> 00:18:22,500 So, now what I'd like to do is really explain what I mean by bloopers, blights and blunders. 172 00:18:22,720 --> 00:18:28,140 And to do so, I'm first going to define, uh, two distinct classes of security technology. 173 00:18:28,760 --> 00:18:34,940 There's, let's call it the security technology that works, and the security technology that sells. 174 00:18:34,940 --> 00:18:39,340 Now, for those reasons we saw in the previous slide, these sets are not equivalent. 175 00:18:40,880 --> 00:18:50,760 Now, you know, my job at Bessemer is to find teams that have technology that works, and fund them into companies that have technology that sells. 176 00:18:50,760 --> 00:18:54,960 And of course, that intersection is where all the great security companies thrive. 177 00:18:56,360 --> 00:19:05,960 But, we also see a lot of security businesses with technology that doesn't work, and technology that doesn't sell. 178 00:19:06,640 --> 00:19:09,540 And, um, those all still get funded. 179 00:19:09,580 --> 00:19:11,360 And those are what I call bloopers. 180 00:19:11,680 --> 00:19:15,420 And I think, you know, blooper is a good name because it's sort of an innocent mistake. 181 00:19:15,420 --> 00:19:25,700 You know, maybe they blow about 100 million, 200 million dollars of venture capital, but at least they didn't actually, at least didn't actually cost any customers any money, because nobody ever bought it. 182 00:19:29,360 --> 00:19:32,800 Okay, then the next category of disaster. 183 00:19:33,580 --> 00:19:35,680 These are the blights on the industry. 184 00:19:35,680 --> 00:19:40,340 These are the technologies that don't work, but for one reason or another, everybody's buying them anyway. 185 00:19:40,960 --> 00:19:41,600 Right? 186 00:19:41,600 --> 00:19:43,640 And, um, we'll talk about those. 187 00:19:43,640 --> 00:19:50,040 Now, these cost the venture industry hundreds of millions of dollars, uh, developing these products. 188 00:19:50,040 --> 00:20:02,360 But more importantly, they cost, they can cost the industry a billion dollars a year buying these products, not to mention the costs that they incur trying to mop up the mess when the products don't actually work. 189 00:20:03,020 --> 00:20:05,160 And, um, I'll talk about some of those. 190 00:20:06,320 --> 00:20:15,580 And then, and then, uh, I'm going to spend actually more time on the third category, because the third one is actually something that maybe we can do about, something we can do about. 191 00:20:15,660 --> 00:20:21,180 And those, oh, I'm sorry, one thing I should mention is that the blights inevitably, the good news is that the blights inevitably 192 00:20:26,640 --> 00:20:27,500 is wasted. 193 00:20:27,580 --> 00:20:29,980 Now, the next category are the blunders. 194 00:20:30,360 --> 00:20:33,860 And the blunders, these are the ones that really scare me. 195 00:20:33,860 --> 00:20:38,220 These are the ones that, the technology doesn't work, but these are hot products. 196 00:20:38,220 --> 00:20:48,520 These are the ones that everybody's talking about, and these are the ones that even some big companies are bringing into accounts, and everybody thinks are next year's products, and I would call them next year's blights. 197 00:20:48,540 --> 00:20:53,140 And I think we're going to see them, you know, on, on our landscape for quite some time, 198 00:20:56,640 --> 00:20:57,400 these technologies. 199 00:20:58,380 --> 00:21:15,360 My hope is that by illustrating some of these disasters and exposing the blights and blunders, I hope to assist you in avoiding the mistake of making a bad investment, a doomed career choice, a wasted product purchase, or even a dangerous choice of online bank. 200 00:21:16,860 --> 00:21:20,540 Here's another invention, but this one might be a blooper. 201 00:21:20,540 --> 00:21:24,460 This is a mobile computing invention of some sort. 202 00:21:32,180 --> 00:21:35,780 So, uh, I think I have to move a little quicker through these slides. 203 00:21:35,940 --> 00:21:37,400 Um, I'll start with the bloopers. 204 00:21:37,680 --> 00:21:49,160 Uh, so, you know, I think many of you may think this is wrong, and, you know, I'm, I look forward to some hearty debate, but the first, the first, and these are, by the way, these are past. 205 00:21:49,160 --> 00:21:50,040 I think these are proven. 206 00:21:50,040 --> 00:21:54,160 I mean, these are, these companies tried to make a go of it, and, and they failed. 207 00:21:54,160 --> 00:21:58,000 First, they're the, they're startups who tried to build universal consoles. 208 00:21:58,000 --> 00:22:02,400 And, of course, universal console is all about integration, not innovation. 209 00:22:02,480 --> 00:22:04,420 It's hard enough for the big companies to do it. 210 00:22:04,420 --> 00:22:07,340 It's almost, it's all, it's really difficult for HP. 211 00:22:07,460 --> 00:22:09,440 It's impossible for a startup. 212 00:22:09,500 --> 00:22:13,260 And no startup, and no enterprise is going to buy a universal console from a startup. 213 00:22:13,720 --> 00:22:17,120 Um, another area is enterprise DRM. 214 00:22:17,400 --> 00:22:19,740 So, there's been some great work done here. 215 00:22:19,740 --> 00:22:24,800 Companies like, uh, Authentica and Alkamedia, which Fingen acquired. 216 00:22:24,880 --> 00:22:28,340 You know, they built some great tools to make it happen. 217 00:22:28,340 --> 00:22:29,840 You can revoke the rights later. 218 00:22:29,840 --> 00:22:31,340 And it's really great technology. 219 00:22:31,340 --> 00:22:37,700 But what the industry has learned is that people just will not change their behavior in order to curb rights on a document further down. 220 00:22:37,760 --> 00:22:39,240 Um, Tumbleweed learned this. 221 00:22:39,240 --> 00:22:41,340 Slam Dunk Networks learned this. 222 00:22:41,460 --> 00:22:47,240 And, um, and now, you know, and people, and more, and more startups are continuing to learn this. 223 00:22:47,480 --> 00:22:54,060 Uh, and I think it's safe to bet that, you know, Microsoft is going to provide good enough DRM in office and, and that's going to be the end 224 00:22:58,000 --> 00:23:03,060 the risk of an embarrassing leak is episodic and difficult to quantify in terms of damage. 225 00:23:03,080 --> 00:23:07,920 You know, this, this category of product never stays in the top three concerns very long. 226 00:23:07,920 --> 00:23:13,440 And if you're not in the top three, then, you know, you, you, you ought to go home and figure something else to do. 227 00:23:13,960 --> 00:23:18,500 So, um, next area is enterprise DDoS protection. 228 00:23:18,820 --> 00:23:34,240 Uh, it may be sorely needed, but the truth is that if you're trying to stop the traffic when it gets to the edge , the only way that, the only way that DDoS is, the only way you can protect yourself against DDoS is in the network. 229 00:23:34,600 --> 00:23:45,840 Uh , there are services you can buy, like the Prolexic service that counterpaint cells, but, you know, Mazu and others, they figured out that they need to do something different than, than DDoS protection at the edge. 230 00:23:46,440 --> 00:23:51,400 Um, again, these are all big, big venture capital investments in all these categories. 231 00:23:51,540 --> 00:23:53,620 Uh, here's another one, PKI. 232 00:23:53,980 --> 00:24:15,060 Um, you know, I'm sure there are some, you know, applications like SSL, but in terms of trying to build applications on top of PKI yourself, uh, it just, just really doesn't, it's just really not worth it and, you know, personally I'm really pleased that Verisign managed to buy network solutions in other businesses and diversify away from this. 233 00:24:16,000 --> 00:24:22,720 Uh, so, uh, and then finally there's applet signing and I'll talk a little bit more about this later, but basically 234 00:24:28,000 --> 00:24:33,980 on this tent, most people who look at the name on an applet have no idea whether that's someone they can trust or not. 235 00:24:33,980 --> 00:24:36,220 And so, it really doesn't do any good. 236 00:24:37,580 --> 00:24:41,840 So, uh, there we've gone through the bloopers. 237 00:24:42,140 --> 00:24:43,940 Now the, now the blights. 238 00:24:43,940 --> 00:24:46,840 These are the ones that are still doing well in the market. 239 00:24:46,840 --> 00:24:48,120 Still selling well. 240 00:24:48,320 --> 00:24:50,340 And, uh, first there's IDS. 241 00:24:50,380 --> 00:24:52,320 And we all know the problems with IDS. 242 00:24:52,320 --> 00:25:03,540 They generate alerts, every year they get improved, which means they generate so many alerts that speaking of too much useless information, that's what these things generate. 243 00:25:03,800 --> 00:25:18,000 And, you know, companies who use these are forced to either hire 24 by 7 teams of expensive experts to go through these or outsource them to companies like Counterpain or Verisign to just manage all the alerts that are coming out of these IDSs. 244 00:25:18,940 --> 00:25:23,960 Um, the second category is what I would call unmanaged firewalls. 245 00:25:23,960 --> 00:25:25,380 So, you know, 246 00:25:36,860 --> 00:25:42,120 most of the, most of the firewalls, as you all know, are not configured. 247 00:25:42,120 --> 00:25:46,060 About half of them still have the default passwords in place. 248 00:25:46,400 --> 00:25:53,440 So, you know, half of the industry, half of the firewall industry is, uh, is wasted money. 249 00:25:55,420 --> 00:26:11,420 Um, and then, you know, there's my, you know, my favorite P, the, the server based signature AV, uh, because, you know, in case somebody comes along and wants to start doing email on your, on your websphere application server blade. 250 00:26:12,840 --> 00:26:15,880 Um, let's see. 251 00:26:17,480 --> 00:26:19,520 Now, onto the blunders. 252 00:26:19,920 --> 00:26:23,720 And I have really just sort of two, two, two slides on this. 253 00:26:23,720 --> 00:26:29,400 The first one is the, oh, I'm sorry, I forgot single sign-on, single sign-on, there's another blight. 254 00:26:29,640 --> 00:26:32,800 So single sign-on is, uh, sounds great. 255 00:26:32,800 --> 00:26:34,400 It seems like a really good idea. 256 00:26:34,560 --> 00:26:45,160 Um, but it turns out that it's really hard to integrate all your old apps and then keep all your new apps integrated and actually try to get the single sign-on to stay, to stay working. 257 00:26:45,280 --> 00:26:54,340 Um, I, I liken these things to the universal remote control that I, that I bought from my, you know, from my media system. 258 00:26:54,480 --> 00:27:02,180 Um, you know, it seemed like a good idea, but after a month or two it ends up being just one more remote control on the table to worry about. 259 00:27:02,520 --> 00:27:04,620 Just too hard to keep programmed, right? 260 00:27:05,360 --> 00:27:12,400 So, um, now by the way, there are some promising glimmers of innovation here in the area of web-based single sign-on which seems to work a little better. 261 00:27:12,400 --> 00:27:18,620 Companies like Accentuate that are, um, that are making this a little easier, but I'm still very skeptical. 262 00:27:20,540 --> 00:27:22,060 So now the blunders. 263 00:27:22,260 --> 00:27:30,700 So the first one is the, so suppose it's successor to intrusion detection. 264 00:27:31,220 --> 00:27:42,900 And, and everybody said, okay, intrusion detection doesn't work, we need something that doesn't just generate alert, it can actually stop the attack in real time because it takes too long for the people to sort through the alerts. 265 00:27:43,200 --> 00:27:45,120 So intrusion prevention is the answer. 266 00:27:45,120 --> 00:28:00,680 And we saw a whole generation of these systems proliferate and we even saw Cisco and Intercept, uh, Cisco and McAfee buy Okina and Intercept from some very, very lucky investors uh, and bring, and they're bringing these things to market, uh, with, with a lot of gusto. 267 00:28:01,020 --> 00:28:16,140 Um, the fundamental , the fundamental premise behind these products , which I find just laughable , is that every attack creates a visible anomaly, and every anomaly indicates that there's an attack going on. 268 00:28:16,740 --> 00:28:25,560 If you don't believe that that's true, then it's inevitable that anomaly based intrusion prevention systems will cause false positives . 269 00:28:26,120 --> 00:28:37,220 And if they cause false positives, then then you can be sure that the very first thing that's going to happen when some customer is blocked from a website is that, that intrusion prevention system is going to be turned into monitor only mode. 270 00:28:37,480 --> 00:28:38,660 Which means, guess what? 271 00:28:38,660 --> 00:28:40,000 Now it's an IDS again. 272 00:28:40,160 --> 00:28:42,760 Generating alerts for somebody to, to, to look through. 273 00:28:42,860 --> 00:28:45,560 Now there are some other problems with these things too that I mentioned. 274 00:28:45,600 --> 00:28:48,540 You know, they were, they're really slow because they have to look at all the traffic. 275 00:28:48,540 --> 00:28:52,220 They require weeks of training, so you can't deploy them right away. 276 00:28:52,220 --> 00:28:59,100 If anything changes on the server that you're watching, like the number of users or the applications or the configuration, then you have to retrain it. 277 00:28:59,100 --> 00:29:03,720 All in all a very non scalable solution, but the big killer is the fact that it has false positives. 278 00:29:03,720 --> 00:29:07,040 Just doesn't make sense for something that's supposed to be in line. 279 00:29:07,640 --> 00:29:13,040 Um, what's required here are intrusion prevention systems that have zero false positives. 280 00:29:13,580 --> 00:29:18,120 Uh, there are some on the market that use signature based approaches. 281 00:29:18,320 --> 00:29:23,000 Those of course have zero false positives, but they don't provide zero day protection. 282 00:29:23,220 --> 00:29:25,960 Um, we believe this is a big area of opportunity. 283 00:29:25,960 --> 00:29:30,500 We funded a company called Determina that we believe has the solution to this space. 284 00:29:30,840 --> 00:29:36,120 Um, and you know, I expect that there will be other companies trying to tackle this as well. 285 00:29:40,710 --> 00:29:42,350 Okay, now my favorite. 286 00:29:45,430 --> 00:29:51,710 So this one, this one is a set of technologies that I see coming strong into the market. 287 00:29:51,770 --> 00:29:57,030 Raising lots of venture capital and getting a lot of money, mostly from banks to deploy them. 288 00:29:57,670 --> 00:30:06,890 And uh, and the damages from these, these blunders I think are gonna be, are gonna be more costly than any others that we've seen. 289 00:30:07,130 --> 00:30:09,910 So I'm gonna start, let me just start down the list. 290 00:30:09,910 --> 00:30:26,330 The first one is the desire of vendors, the belief that people have that somehow there's some client software that people can give you or some inbox software that people can give you that will prevent phishing at the inbox. 291 00:30:26,950 --> 00:30:32,070 A red, yellow or green light that knows which sites are phishing and which ones aren't. 292 00:30:32,310 --> 00:30:37,670 Well, the bottom line is that software has no way of knowing what you think you're talking to. 293 00:30:37,670 --> 00:30:40,050 It doesn't know that you think you're talking to Citigroup. 294 00:30:40,390 --> 00:30:49,710 And, and so, you know, unless you're only going to browse on a whitelist, which nobody wants to do, these, these red, yellow, green lights are not gonna work. 295 00:30:49,710 --> 00:31:01,070 They assume that phishers are not gonna adapt, that they're not gonna change their IP addresses, that they're not gonna figure out ways to, they're not, they're not gonna use zombies in the United States that have IP addresses that don't look like they're, 296 00:31:01,070 --> 00:31:02,710 you know, coming from Russia. 297 00:31:03,010 --> 00:31:08,230 Um, you know, it's, it's, these are quite naive defences. 298 00:31:08,490 --> 00:31:13,210 Um, people sometimes think that they can apply rules to look at it and tell whether it's phishing. 299 00:31:13,210 --> 00:31:16,430 Well, the whole point of phishing is that it looks like a real email. 300 00:31:16,610 --> 00:31:20,010 It looks like a, it looks like a real, you know, site or a real email. 301 00:31:20,010 --> 00:31:27,110 There's just, you know, there's just no way to, for a technology to be smarter than a human being in terms of seeing those patterns. 302 00:31:28,410 --> 00:31:37,110 Um, then there are simple mechanisms that, that vendors come out with that defeat very certain phishing mechanisms, like URL masking. 303 00:31:37,150 --> 00:31:42,350 Again, these assume absolutely zero creativity or adaptation on the part of the phishers. 304 00:31:42,370 --> 00:31:48,690 Um, you know, they're, they, they'll just do, you know, they'll just get URLs that look like they're real URLs. 305 00:31:48,810 --> 00:31:56,190 If I saw the URL citygrouponline.com, I have no idea if that's a real, that's a valid URL or not. 306 00:31:57,390 --> 00:32:14,410 Um, and, and none of these phishing preventions, by the way, would stop you from new kinds of phishing attacks, like the bogus camera store that collects people's credit card information for selling cheap cameras and the way they get the traffic is by buying the keyword on Google for camera. 307 00:32:14,410 --> 00:32:19,190 They get the top placement and they get all this traffic coming and people looking, oh, look at these cheap cameras. 308 00:32:19,250 --> 00:32:24,770 And then of course they use the, they, then they use the credit cards they steal to actually pay Google for the keyword. 309 00:32:24,810 --> 00:32:26,210 That's my favorite part of it. 310 00:32:28,250 --> 00:32:32,150 So, you know, we're looking at, um, oh, let me, okay, next one. 311 00:32:33,430 --> 00:32:35,710 There's this idea that we want to empower the user. 312 00:32:35,710 --> 00:32:36,930 Give the user more information. 313 00:32:36,930 --> 00:32:38,990 You're about to go to a non-SSL page. 314 00:32:39,050 --> 00:32:41,670 You're, this certificate's about to expire. 315 00:32:41,770 --> 00:32:46,410 Um, you're, there's a license agreement that you should read and sign and then you'll know what you're getting into. 316 00:32:46,710 --> 00:32:49,950 Uh, there's, you know, this is the person who signed this applet. 317 00:32:49,950 --> 00:32:51,310 This is the person who owns this domain. 318 00:32:51,310 --> 00:32:53,350 This is the person who's behind this email address. 319 00:32:53,550 --> 00:32:58,670 All these are attempts to give the user information and thereby empower the user to make decisions. 320 00:32:58,690 --> 00:33:02,050 The problem is, again, outside this tent, no one knows what to do with that information. 321 00:33:02,510 --> 00:33:06,570 Some window pops up and says their certificate expired or they're about to browse somewhere else. 322 00:33:06,690 --> 00:33:07,270 What do they do? 323 00:33:07,270 --> 00:33:09,150 They don't know what to do, so they just go browse. 324 00:33:09,290 --> 00:33:12,030 It's, the, the, the information becomes useless. 325 00:33:13,010 --> 00:33:16,410 Here's another, here's another last resort of the clueless. 326 00:33:16,410 --> 00:33:18,250 You see a lot of banks talking about this. 327 00:33:18,250 --> 00:33:20,170 The answer is educating the users. 328 00:33:20,170 --> 00:33:25,930 We just have to train people not to click on the bad stuff and that's gonna solve the phishing problem or the ID theft. 329 00:33:25,930 --> 00:33:29,210 Well, how does that, how does that solve farming? 330 00:33:29,210 --> 00:33:31,910 Where the DNS is, is, is redirecting your traffic. 331 00:33:31,910 --> 00:33:36,250 Or how does it solve malware that redirects your browser somewhere else? 332 00:33:36,250 --> 00:33:37,870 Or the bogus camera store? 333 00:33:37,870 --> 00:33:48,950 I mean, redirecting, you know, train, educating the users is again a very naive and really, uh, negligent answer to the, to, to protecting our bank accounts. 334 00:33:49,850 --> 00:33:50,770 Okay. 335 00:33:51,010 --> 00:33:56,470 Here's another thing we see, this is another attempt hopefully to stop phishing, is authenticating the email source. 336 00:33:56,470 --> 00:34:02,590 Sender ID and, and DKIM and, and whatever, you know, the other standards wars here. 337 00:34:02,830 --> 00:34:10,110 Well, again, you're authenticating the source, but as we know, most of the people who register for those systems are actually spammers. 338 00:34:10,490 --> 00:34:15,430 So, you know, it, it doesn't really tell you anything about the behaviour of the email. 339 00:34:15,430 --> 00:34:21,830 You might see some name behind the email source, but it doesn't give you any, any real good information. 340 00:34:23,130 --> 00:34:25,150 Okay, so what are the banks thinking? 341 00:34:25,150 --> 00:34:27,690 They're thinking, okay, we have to provide stronger authentication. 342 00:34:27,790 --> 00:34:28,810 Passwords aren't good enough. 343 00:34:28,810 --> 00:34:34,090 We have to authenticate everybody who comes to our site and we're gonna have to do it with, with real strong authentication. 344 00:34:35,130 --> 00:34:39,190 Well, everyone knows that there are trade-offs between security, convenience and cost. 345 00:34:39,370 --> 00:34:46,730 And you can't apply the most inconvenient and the costliest security to everybody who comes to your website. 346 00:34:46,730 --> 00:34:47,890 You have to profile. 347 00:34:47,970 --> 00:34:49,310 You have to be smart about it. 348 00:34:49,310 --> 00:34:52,610 If you've ever flown El Al Airlines, you know how they do it. 349 00:34:52,610 --> 00:34:55,350 They only inconvenience a few people, not everybody. 350 00:34:55,830 --> 00:34:57,870 This is gonna be an unscalable solution. 351 00:34:57,870 --> 00:34:59,210 It's gonna be too expensive. 352 00:34:59,670 --> 00:35:01,910 Here's another, here's another mistake. 353 00:35:02,050 --> 00:35:05,050 They're focusing all their authentication efforts on the login. 354 00:35:05,350 --> 00:35:08,590 The login is the least dangerous part of the session. 355 00:35:08,590 --> 00:35:10,990 What about the part where I withdraw cash? 356 00:35:10,990 --> 00:35:12,810 Or where I change my address? 357 00:35:13,290 --> 00:35:17,010 Those are the risky things and it turns out that those are a very small number of sessions. 358 00:35:17,010 --> 00:35:29,510 If you focus the authentication on the risky transactions, as opposed to the login, then again you have a much better way of focusing the security resources, the cost and the inconvenience on the sessions that matter. 359 00:35:31,430 --> 00:35:34,870 Banks think okay, we're gonna use strong authentication because passwords aren't good enough. 360 00:35:34,870 --> 00:35:39,410 We'll use smart cards like the secure ID card or time based codes. 361 00:35:39,810 --> 00:35:41,830 I'm gonna loop the next three together. 362 00:35:42,650 --> 00:35:47,470 We're gonna use biometrics, fingerprints to authenticate. 363 00:35:47,470 --> 00:35:55,930 Or we're gonna use watermarks to educate the user so that they know that this is not, this is not, uh, they know that this is a real site. 364 00:35:56,210 --> 00:36:05,930 Of course if you're logging in from a new computer, then we have to ask you some challenging questions and we have to authenticate you and, and, you know, we'll do that and then show you the watermark. 365 00:36:05,930 --> 00:36:09,610 Well these last three, these are all really expensive. 366 00:36:09,610 --> 00:36:11,650 Not the last one so much, but those first two. 367 00:36:12,410 --> 00:36:16,810 Two factor authentication has a total cost of ownership of $20 per user per year. 368 00:36:18,090 --> 00:36:21,250 That would be okay maybe if they worked. 369 00:36:21,370 --> 00:36:29,890 But all three of these defenses are all, are all, uh, defeatable by either man in the middle attacks. 370 00:36:29,890 --> 00:36:38,930 So all the phishers have to do is while they're collecting your data, your time code or your biometric information, they're turning around and logging into your bank at the same time. 371 00:36:39,350 --> 00:36:41,350 And they can do the same thing with the watermark. 372 00:36:41,350 --> 00:36:43,730 Sit in between and get the watermark. 373 00:36:45,970 --> 00:36:49,570 Or they're also subject to malware based slip streamers. 374 00:36:49,570 --> 00:36:57,590 So malware that sits on your computer and then waits for you to log in using all of this expensive technology and then just, you know, takes over your session. 375 00:36:57,590 --> 00:37:00,130 Does something on your PC or hands it over to somebody else. 376 00:37:00,950 --> 00:37:04,590 So, and you can, and those attacks are out there. 377 00:37:04,630 --> 00:37:11,470 They may not be very common, but you can be sure that when Bank of America deploys these defenses, that those attacks are going to become a lot more common. 378 00:37:11,770 --> 00:37:12,950 No reason why not. 379 00:37:13,610 --> 00:37:17,150 So, this is why I've stopped banking online. 380 00:37:19,150 --> 00:37:20,630 My money's not safe. 381 00:37:22,410 --> 00:37:26,830 And I feel like I want to give some prescription as to how I think this is going to get better. 382 00:37:26,830 --> 00:37:35,010 I think the landscape is going to be blighted for some time, but eventually, what banks are going to learn to do is they're going to learn to authenticate the transaction, not the login. 383 00:37:35,550 --> 00:37:39,010 They're going to learn to profile the transaction. 384 00:37:39,010 --> 00:37:39,950 Profile the user. 385 00:37:39,950 --> 00:37:40,850 Profile the session. 386 00:37:40,850 --> 00:37:42,030 Where is this coming from? 387 00:37:42,030 --> 00:37:44,010 Is this an IP address we've seen before? 388 00:37:44,010 --> 00:37:46,530 Is this a normal thing for this customer to be doing? 389 00:37:47,890 --> 00:37:50,010 Is this just a dangerous transaction? 390 00:37:50,190 --> 00:37:54,830 Is this a change of address transaction which is dangerous or is this just somebody looking at his or her balances? 391 00:37:55,950 --> 00:38:00,410 And then, depending upon how dangerous it is, we're going to escalate the response. 392 00:38:00,410 --> 00:38:05,190 We're going to have costlier and costlier and more and convenient security based upon the risk. 393 00:38:05,190 --> 00:38:11,070 With the penultimate authentication being not two-factor authentication, but multi-channel authentication. 394 00:38:11,070 --> 00:38:18,210 Because two-factor authentication doesn't work if the channel itself has been compromised, which is what malware does to a PC. 395 00:38:19,130 --> 00:38:26,490 Smart cards, biometrics, the reasons they don't stop malware or slipstreaming is because the channel's been compromised. 396 00:38:26,830 --> 00:38:32,950 But if you do multi-channel authentication, then you, you defeat those, those mechanisms. 397 00:38:32,950 --> 00:38:42,970 Unless that, unless the attacker is able to compromise, identify the two simultaneous channels and, and, and compromise them, which is, you know, many, many years out from now. 398 00:38:45,270 --> 00:38:55,950 Uh, there actually, and I'll say there actually is, there actually are a set of startups that are now starting to deliver this kind of technology, although I think it's going to be a while before banks recognize it. 399 00:38:56,010 --> 00:39:06,210 Uh, Authentify and CYOTA have joined together to provide a service to banks so that they can do this, uh, for their online banking. 400 00:39:06,210 --> 00:39:08,190 A very cheap, scalable solution. 401 00:39:08,630 --> 00:39:09,250 Yeah? 402 00:39:13,280 --> 00:39:14,080 Okay. 403 00:39:14,080 --> 00:39:16,880 So what, so the question is, what does it mean to authenticate the transaction? 404 00:39:17,060 --> 00:39:21,260 So, I'll just take the Authentify CYOTA solution for a second and illustrate. 405 00:39:21,540 --> 00:39:23,680 Somebody comes to the bank and logs in. 406 00:39:23,680 --> 00:39:25,240 Just let them use a password. 407 00:39:25,260 --> 00:39:27,480 It's not the most secure thing in the world, but it's okay. 408 00:39:27,480 --> 00:39:28,680 Let them use the password. 409 00:39:29,280 --> 00:39:32,020 By the way, keep track of how many times it took them to get in. 410 00:39:32,020 --> 00:39:36,500 If it took them a long time because they had to do many passwords, that increases the risk, of course. 411 00:39:37,780 --> 00:39:40,080 Then, then see what are they doing in the bank account. 412 00:39:40,080 --> 00:39:43,940 If they're just looking at their balances, then maybe the password security is enough. 413 00:39:44,320 --> 00:39:49,320 But if they're trying to do something else, then you want to escalate the security. 414 00:39:49,320 --> 00:39:54,460 Maybe you want to ask them some challenge and response questions before they, before they look at their balances. 415 00:39:54,820 --> 00:39:58,760 Maybe they're doing something more dangerous, like changing their address. 416 00:39:58,760 --> 00:40:02,680 In which case you want to ask them more challenge and response questions. 417 00:40:02,780 --> 00:40:05,260 Maybe they're trying to actually move cash out of the account. 418 00:40:05,260 --> 00:40:13,720 At which point you say, okay, because this transaction is a risky transaction, we're going to give you a code, 3174. 419 00:40:13,860 --> 00:40:16,960 And now we're going to say, we know three telephone numbers that you've got on record. 420 00:40:16,960 --> 00:40:17,760 Home, cell and work. 421 00:40:17,760 --> 00:40:19,140 Which one do you want us to call? 422 00:40:19,140 --> 00:40:21,680 You don't say the number, you just identify which one. 423 00:40:21,860 --> 00:40:36,300 Your phone rings, a computer calls you up and says, do you want to, do you want to, uh, do you want to authorize the transfer of $50,000 to the Boys and Girls Club of, of Belfast? 424 00:40:36,520 --> 00:40:41,440 And then, you know, if so, enter the code on your, on your web session. 425 00:40:41,560 --> 00:40:46,440 And if you enter 3174, then that, that authenticates that very specific transaction. 426 00:40:46,840 --> 00:40:50,360 So you're authenticating the transaction, you're showing this is what I want, wanted you to do. 427 00:40:50,420 --> 00:40:55,460 Rather than authenticating the session and then allowing somebody else to wreak havoc on the session. 428 00:40:55,460 --> 00:40:59,680 And it also limits the security focus to just the risky transactions. 429 00:41:01,640 --> 00:41:03,860 Does that answer the question? 430 00:41:05,040 --> 00:41:09,080 Okay, so, more advice, and this is for email providers. 431 00:41:09,300 --> 00:41:15,720 Um, restore credibility to email, not through domain authentication, but through behavior tracking. 432 00:41:15,720 --> 00:41:29,220 And I think this is going to be the domain of some interesting startups, like maybe Goodmail and Habeas, where they actually track the behavior of email senders and then use that reputational data in order to make judgements as to whether somebody is a, 433 00:41:29,220 --> 00:41:31,480 is a spammer or a phisher. 434 00:41:31,760 --> 00:41:40,380 Um, you know, there's a, the, the major, there's a bigger downside to spam and phish than the fact that we, that our email is untrustworthy. 435 00:41:40,380 --> 00:41:47,360 And that's the fact that, that our trusted relationships, banks and e-commerce partners, can no longer use email to talk to us. 436 00:41:47,360 --> 00:41:50,780 Two years ago, if Citibank sent me a message, I would have responded. 437 00:41:50,780 --> 00:41:55,620 Of course, today, who would respond to a message from Citigroup or Fidelity on their email? 438 00:41:55,660 --> 00:41:56,840 Email is a lost cause. 439 00:41:56,840 --> 00:41:58,160 We have to somehow fix that. 440 00:41:58,160 --> 00:41:59,020 Question? 441 00:42:04,790 --> 00:42:09,390 Does behavior tracking step far beyond the boundaries of, of privacy? 442 00:42:09,390 --> 00:42:10,550 That's the question. 443 00:42:10,610 --> 00:42:17,310 Well, yes, just in the same way that questions at the airport, uh, intrude upon your privacy for that as well. 444 00:42:17,430 --> 00:42:25,490 Um, you know, I think that people who want to send you email, like Citibank or Amazon, they're going to be okay with the idea that somebody's tracking their behavior. 445 00:42:26,410 --> 00:42:41,210 Um, you know, and there may be situations where it steps beyond the bounds, but, you know, if somebody, I don't think any, I can't imagine where, where a company's going to have a problem if it's tracking phishing activity of somebody overseas and saying this is an IP address that you want to be careful about. 446 00:42:46,840 --> 00:42:51,040 Are there legal loopholes that, that weaken the, the business model? 447 00:42:51,420 --> 00:42:57,960 Yeah, well, there, it's possible those would have to be, you know, litigated. 448 00:42:59,320 --> 00:43:04,340 Um, okay, uh, let's see, last one. 449 00:43:04,960 --> 00:43:06,660 End user security tools. 450 00:43:06,660 --> 00:43:13,380 We have to get over this idea that the answer to security is to give the user more information and empower them. 451 00:43:13,380 --> 00:43:18,080 We have to start thinking about what we can do to help the user make judgment calls. 452 00:43:18,080 --> 00:43:20,280 Is this a license agreement you want to click on? 453 00:43:20,280 --> 00:43:22,960 Is this an email form that you want to put your email address in? 454 00:43:22,960 --> 00:43:24,860 Or is this going to generate a lot of spam? 455 00:43:25,200 --> 00:43:28,340 Is it okay to, to, to navigate to this site? 456 00:43:28,380 --> 00:43:34,560 We're going to see more and more, we're going to see companies coming out with warnings that help us make those decisions. 457 00:43:34,660 --> 00:43:38,820 That, that highlight links that are going to bring us to a site with malware on it. 458 00:43:38,820 --> 00:43:42,160 Or warn us when we're going to do something that maybe we want to think twice about. 459 00:43:42,180 --> 00:43:45,280 That is much more useful end user security. 460 00:43:48,810 --> 00:43:49,990 Another idea. 461 00:43:51,510 --> 00:44:01,150 Okay, so, you know, we're always trying to think about where there are opportunities to, to make the security industry better. 462 00:44:01,150 --> 00:44:06,290 I can share with you, these are some of the questions that we ask ourselves these days about whether there are opportunities. 463 00:44:06,290 --> 00:44:09,690 And these are things I'd love to hear from people here at Defcon about. 464 00:44:09,690 --> 00:44:15,710 Uh, questions like, you know, is it possible to build accurate and reputational services? 465 00:44:15,850 --> 00:44:20,570 Uh, for email, for IP addresses, for uh, ISP behavior? 466 00:44:20,570 --> 00:44:24,710 So that you know which ISPs are, are good internet citizens and which ones aren't. 467 00:44:24,910 --> 00:44:34,510 Um, do we, are there security vulnerabilities to RSS and Atom that require some kind of uh, you know, security mechanisms? 468 00:44:34,510 --> 00:44:38,930 I don't know, I don't know what those would be, but my guess is that there are, there are some vulnerabilities there. 469 00:44:39,190 --> 00:44:44,370 Um, and then one that I'm very concerned about and that is VoIP on my, spam on my VoIP phone. 470 00:44:44,450 --> 00:45:01,390 You know, spam on my inbox, that's sort of a hassle, but spam on my VoIP phone, I mean that is just downright obnoxious because my phone is gonna ring every time somebody wants to sell me something and I can't apply Bayesian rule filters like I can with spam because you don't know what the message is until the phone rings. 471 00:45:01,530 --> 00:45:09,770 And so, you know, this is an area where I think, you know, there's room for some great reputational services or something to, to try to solve this problem. 472 00:45:09,830 --> 00:45:13,410 Um, I put here on the slide my coordinates for contact. 473 00:45:13,470 --> 00:45:23,710 Uh, you can hear me, you know, blather more on my blog at, at whohastimeforthis.blogspot.com where, where, uh, I love to discuss, you know, blights and blunders. 474 00:45:24,210 --> 00:45:29,250 And so, um, so, uh, please, please visit my blog. 475 00:45:29,650 --> 00:45:34,670 And then, um, I'd like to close with a little anecdote. 476 00:45:34,770 --> 00:45:38,470 This, by the way, in case it's not clear, is an, is an indoor sundial. 477 00:45:38,730 --> 00:45:43,390 Let's see, just gonna... yeah. 478 00:45:44,590 --> 00:45:47,050 So, um, so, uh, um, that one's my favorite. 479 00:45:47,790 --> 00:46:02,190 Okay, so, so, uh, you know, so to a large extent, venture capitalists like me, we play a role in the ecosystem of being gatekeepers for capital as to which of these security projects are gonna get funded. 480 00:46:02,470 --> 00:46:07,350 And so, you know, it's our job to try to spot these blunders before they happen. 481 00:46:07,350 --> 00:46:13,510 But we also need to appreciate the market that exists out there and all the innovation that's there. 482 00:46:14,750 --> 00:46:20,770 And, and so, you know, I, I am not cynical about the number of startups that are being funded. 483 00:46:20,770 --> 00:46:22,450 I, I think it's a good thing. 484 00:46:22,550 --> 00:46:34,190 And, you know, the, the, and what I want, and the story I wanted to tell you happened the Saturday night after I made my twelfth security investment in a company called Syota. 485 00:46:34,450 --> 00:46:40,050 Um, my, my wife, Natalie, she took me out to, uh, the movies that Saturday night to see Born Supremacy. 486 00:46:40,530 --> 00:46:46,530 And, um, we were going to this theatre in Mountain View with a lot of, uh, movie theatres in it. 487 00:46:46,930 --> 00:47:04,030 And, you know, thanks to Fandango we righteously walked right past the long lines of teenagers and we go into the lobby and I'm trying to explain to Natalie why it is that these companies I'm investing in, they're not the same company over and over. 488 00:47:04,030 --> 00:47:08,150 Cause she asked me, she says, why is it, it looks like you just keep investing in the same thing over and over again? 489 00:47:08,370 --> 00:47:16,230 You know, she looked, you know, she saw those same seven, seventeen companies I put up on the page and when I tell her what they do, they all sound exactly the same to her. 490 00:47:16,390 --> 00:47:17,270 And she said, why do you do this? 491 00:47:17,270 --> 00:47:21,510 I'm trying to figure out how to explain to her why I keep doing this. 492 00:47:21,510 --> 00:47:28,170 Now, in this, in this movie theatre, in this movie theatre, they implemented a security mechanism to prevent movie theft. 493 00:47:28,610 --> 00:47:37,550 Instead of collecting tickets at the front, like they used to, well, they had a problem that people would go see a movie, then they'd come out in the lobby, then they'd go see another movie. 494 00:47:37,550 --> 00:47:44,650 So they moved the ticket collection out to the, the hallways coming off the lobby and then after a movie, they usher everybody out to the lobby. 495 00:47:44,810 --> 00:47:47,550 So, if you wanna go back in, you, you need to give a ticket. 496 00:47:47,550 --> 00:47:48,730 No ticket, no movie. 497 00:47:48,730 --> 00:47:50,370 That's the security mechanism. 498 00:47:50,510 --> 00:47:56,210 So I thought, okay, there's gotta be vulnerability here, so I said, watch this. 499 00:47:56,310 --> 00:48:08,410 I walked over to the front door, I waited for a little lull in the traffic and then I, um, preferred my handout and muttered as nonchalantly as I could, tickets, tickets. 500 00:48:09,250 --> 00:48:18,990 And, you know, a bevy of teenagers approached and, you know, the first one gave me his ticket, that was the riskiest, but then the rest of them were cake. 501 00:48:18,990 --> 00:48:27,510 I mean, you know, they were jabbering on about football games and SAT prep and meanwhile their tickets were just accumulating in my hand, not looking at me. 502 00:48:27,550 --> 00:48:40,870 And it took them, you know, a good five minutes as they sort of wafted over to one of the ticket stands and they got to the ticket stand and then literally they spent another two minutes among them trying to figure out which one of them had the tickets. 503 00:48:40,870 --> 00:48:43,850 Cause they forgot that they gave me the tickets at the door. 504 00:48:43,850 --> 00:48:54,050 And then, by then they figured out that they'd been phished, they turned around and I was there, I returned, I returned their assets and, um, fortunately they didn't kick mine. 505 00:48:54,430 --> 00:49:01,710 Uh, so, um, so, you know, my wife understood that security is hard. 506 00:49:01,710 --> 00:49:09,150 And, uh, that's why I, like, like most of the people in this room I imagine, really find it so intriguing. 507 00:49:09,610 --> 00:49:26,350 Um, as we, we should all keep in mind that as we craft new technologies, we're all gonna make mistakes now and then, um, but that's okay, so long as we critically assess our bloopers before they bloom into full-blown blunders. 508 00:49:26,770 --> 00:49:28,170 Thank you very much. 509 00:49:28,170 --> 00:49:33,810 I am, we have time for a question? 510 00:49:33,830 --> 00:49:34,710 No? 511 00:49:36,590 --> 00:49:38,510 One, one question. 512 00:49:40,990 --> 00:49:41,870 Yes? 513 00:49:46,140 --> 00:49:50,820 Uh, I mentioned, I didn't, I didn't say Verisign was a blight. 514 00:49:50,820 --> 00:49:53,660 The question is why did I mention Verisign as a blight? 515 00:49:54,080 --> 00:49:55,320 Oh, why didn't I? 516 00:49:55,600 --> 00:49:58,960 Oh, uh, PKI is a blight. 517 00:49:59,040 --> 00:50:03,060 Um, there are certain aspects of PKI, by the way, like SSL that work great. 518 00:50:03,060 --> 00:50:04,380 I mean, SSL is terrific. 519 00:50:04,820 --> 00:50:08,740 SSL, you know, there wouldn't, a lot of e-commerce would have been stalled if it weren't for SSL. 520 00:50:09,740 --> 00:50:13,500 Verisign, though, is in a lot of other businesses besides PKI. 521 00:50:13,680 --> 00:50:22,020 You know, they're in the registry business, they're in the wireless billing business, they're in a lot of business, and also in a lot of security businesses, a lot of outsourced security services. 522 00:50:22,360 --> 00:50:24,720 Um, so Verisign does a lot of good things. 523 00:50:24,720 --> 00:50:32,380 I think PKI is just, was just a technology that was just, uh, you know, never justified it, justified the, uh, the, the hassle. 524 00:50:33,500 --> 00:50:35,660 Okay, thank you. 525 00:50:38,040 --> 00:50:38,680 Quick...