Well, I think most of us realize that security and entrepreneurship go hand-in-hand.
All the major players in the industry are venture-backed.
Mostly, those companies are too young to vote or drink,
let alone screw with their customers.
So, if you're in security, at some point, you're going to work for a start-up,
or you're going to buy products from a start-up,
or you're going to invest in a start-up, or you're going to acquire one.
So, you want to know what's going to happen to all these start-ups.
Is there room for more of them? Which ones will succeed?
Today, I'll discuss the long-term role of start-ups in the security ecosystem.
But rather than speculate on the industry's future successes,
because that's something I think that many of you are probably more capable to do than I am,
or rather than hype my own investments,
I think it's more instructive to highlight mistakes of the industry.
Because, unfortunately, security doctors don't swear a Hippocratic oath to do no harm.
And so far, the results have been disastrous.
So, these are some of the questions that people ask me that I'll try to address today.
So, next question is, why dwell on the mistakes?
Well, 10 years ago, Dan Farmer popularized the notion that we can't secure our networks
if we don't openly air our vulnerabilities and errors.
And just this week, Michael Lynn reminded us of the same thing.
A lesson that I think applies not only to information security,
but also, I believe, to all challenging pursuits, including venture capital.
And in case you think that I can only dish it out, but I can't take it in,
you're welcome to take a look at the anti-portfolio that we at Vestamer published on our website.
It's the only one of its kind in the industry.
You can read in gory detail, if you like, about the, frankly, stupid reasons
why we passed on the first investment rounds in Intel, FedEx, Apple, eBay, Google, many others.
Good lessons there for us.
So, this presentation is for investors who don't want to lose their capital.
Entrepreneurs who want to navigate the landmines.
Engineers who don't want to make the wrong career choice.
Chief Information Security Officers and their staff who don't want to buy the wrong product.
Also, anyone with money in the bank who wants to keep it safe.
And, if that doesn't just about cover all of you, then I guess it's also for anybody who's looking to kill an hour between the two Fed presentations.
So, still, I expect that many of you came here looking for more positive direction on tomorrow's great inventions.
I feel obliged to offer something inspirational here.
So, I've injected into my presentation some interstitial slides here and there offering up some great examples of entrepreneurial innovation.
You'll see them popping up now and then.
So, I've told you about some things that Bessemer Venture Partners has done wrong.
Please give me just 30 seconds to tell you some things we've done right in an effort, perhaps, to lend some credibility to my ravings about the industry.
So, here's the background.
As the oldest venture capital practice in the nation, Bessemer has, for nearly a century, invested the family fortune of Henry Phipps,
a 19th century entrepreneur who decided to reinvest his proceeds from the sale of Carnegie Steel into other tiny startups like W.R. Grace and Ingersoll Rand.
More recently, Bessemer has funded the early stages of Parametric, Staple, Sienna, Cascade, VMX, Maxim, Veritas, Gartner Group, Perceptive Biosystems, and Skype.
We have about 60 employees with offices in California, Massachusetts, New York, Bangalore, and Shanghai.
We are the most active early stage venture firm in information security.
You can see here we've invested in 17 security companies. Some of them are ones that I'm sure you know.
Some you may be less familiar with.
But one thing that's in common is that we work early on with experts in the security field to start these companies.
Folks like Paul Makapetris at Nominum and Dan Farmer at Elemental, Bruce Schneier at Counterpain, Mark Mayfritt at EI, Gene Kim and Gene Spafford at Tripwire, and of course Ron Rivest at Verisign.
All but the recent three early stage investments that we've made here of the 17 are all doing well.
They all have run rates above $10 million.
Five of them have gone public. One of them was acquired by Cisco.
And among the 17 investments we've made there hasn't been a single realized or unrealized loss.
We have a dedicated security team at the firm including myself, Divesh Garg who ran Broadcom Security Business Unit, Chini Krishnan who founded Valisert, Chris Risley who was CEO both of Nominum and previously of On Technology,
after going public, Symantec acquired, and just a broad strong team of security professionals.
In this team we commit ourselves, we commit our time and our resources to maintaining a very rich dialogue with chief information security officers in the industry.
Many of you are probably here and you know first hand that we do this and we do that really to maintain a good pulse on the marketplace on behalf of our companies.
Easier to spread. Let's see.
Okay, so the biggest challenge for startups is that nobody wants to buy from startups.
People want to buy products from big companies. They want to buy suites.
And there are some very good reasons for this. Very valid reasons.
Product suites from big companies offer integration at the console level.
They offer integration at the appliance level, making security easier to deploy in a scalable fashion.
These companies promise event correlation.
And I think one day they might even deliver it.
And of course they do offer better vendor viability than what a startup can do.
So I'm just going to run through some slides that show you the product footprint of the major companies in the industry.
And this is a taxonomy that we've developed internally to map out security products.
And the data for each company are probably about six months old. We last updated at the end of 2004.
But you get a feel for how the different companies have staked out their turf across the security landscape.
Here you have Symantec and of course McAfee.
Here's ISS. And as you can see, the large vendors, each of them offer suites that cover different aspects.
More than point solutions, but still they can't cover the whole landscape.
And so what happens is that enterprises really often pick one suite and then fill in all the holes around the products that are offered by that suite vendor.
So this is an inventive cold remedy.
So then these big companies, they have these great suites and enterprises want to buy from them.
So the question is, what are we smoking? We keep funding all these startups out there to compete against them and have a hard time selling.
And why do we do that? And here's our thinking.
Our thinking is that there are two major reasons why the startups have to exist.
And in the long run, as a group at least, have to thrive. At least some of them.
And the first reason is that there are constantly new protocols, applications and platforms that are being deployed in the network.
And every time a new one comes along, then enterprises have to completely rethink their security.
So that the security has to actually keep up with the new technologies quickly.
It has to be the fastest changing element of the network because it has to move as quickly as everything else that's going on.
And these are just some examples of protocols that enterprises are adopting now or have started to adopt last year.
And every one of these things introduces important new vulnerabilities that change the way enterprises have to think about security.
And then the second element is captured in this image here. And that is that security is very different from other elements of infrastructure.
In other types of infrastructure, you're trying to basically... it's basically a battle of man versus nature.
Trying to iron out the wrinkles, trying to get the products to work better.
And asymptotically these products approach perfection.
The way that routers and switches today basically work.
They don't crash, we have enough bandwidth, basically they work fine.
But security isn't like that because in security every time a company releases a product,
you've got people who are... you've got many people who are actively trying to render it obsolete right away.
Very creative and adaptive people.
And if that's not enough, more recently the nature of that adaptation has changed
now that the enemy is motivated less by ego, mischief and politics and motivated more by profit.
Profit from spamming, profit from extortion, profit from ID theft.
The enemy now has the patience, the resolve and the resources to continually escalate
and continually adapt to the new products as they come out.
And for this reason we believe that it's absolutely imperative
that we continue to have startups, entrepreneurial teams,
who are innovating new defenses against the tax.
This is why I believe we've seen so much venture investment in startups.
In the last two and a half years we've counted, and we may not know all of them,
but we've counted 477 distinct companies that have received venture funding during that time.
Obviously these companies aren't all going to be successful,
but the level of innovation that's coming out of these 477 companies
absolutely eclipses anything that's going on among the larger companies.
So that's the role of the startup and that's the role that we try to fund.
Now, with all these companies that are being funded,
I'm sad to say that there aren't any public, there aren't any IPOs
in the security industry since the beginning of 2003.
So that's a lot of money going in and nothing really coming back
to the hard working employees and the not so hard working investors in those companies.
But what we do see is that, as we all know, mergers and acquisitions
have really accelerated in the last couple of years,
even beyond the peak of the bubble in terms of the number of deals
and the number of dollars going to security companies.
And that's because we have two types of companies in the ecosystem.
We have the suite vendors who are great at integrating.
Integrated consoles, integrated appliance.
They offer, that's their value to the enterprise.
Then you have the small companies who are the innovators.
They produce the new defenses. Usually they're point solutions,
but these are the new defenses.
In order for the integrators to remain competitive,
they have to assimilate the innovative solutions.
And so, and so although journalists like to talk about
what's happened in the last year as a consolidation in the industry,
we don't view this as a phase of consolidation.
We view this as a permanent fixture.
This, this is going to persist.
It's going to persist longer than the M&A string in the 90s
where Cisco, 3Com and Lucent all acquired networking companies.
Because again, those networking companies,
eventually those products worked and they matured.
But the best you can ever hope to do with a security product is tread water.
No mess, no waste.
So, now let me start to talk about why it is that
we see some major bloopers and blunders in the industry.
And it starts off with an analysis of people's state of minds
when they buy products.
And um, so I'm going to talk about reasons why people buy security technology.
Why they pick one product or another.
And the first reason, and this is one that I think we all agree is a very good reason,
and one that a lot of attention is spent to here at Defcon.
I understand how this technology will likely secure important assets
from entire classes of attack at a reasonable cost.
And here we like to think that this is the only reason
why people choose one security product over another.
But wait, there are more reasons.
Here's one.
Lots of other people seem to think that this technology works.
I guess that means I need it.
This common, weak minded disposition to suspend skepticism
explains a lot of the problems in our world.
Beyond information security.
Not only might others be wrong, and I'll point out some doozies today,
but there simply is no one size fits all security mix.
Nonetheless, this kind of thinking does drive a lot of purchasing
from the big security companies.
Here's another brain malfunction that drives sales for Symantec and Cisco.
If an attack brings our network down, I'll be okay,
so long as it brings everyone else's network down as well.
So I'm just going to hide in the safety of the herd
and buy whatever seems to be selling well,
and never mind that we're seeing more targeted attacks today,
but more importantly, that the consequences of an attack to my enterprise
are pretty much the same regardless of whether it hits others.
Okay, why else do we see people flocking to Symantec and Cisco?
Well, I got a good deal on a bundle.
I bought that big router or appliance over there,
and the vendor threw in some cheap or maybe even some free licenses.
It might not work, it might inconvenience my users,
it might suck up IT resources,
it might even be another vector of attack.
But it was cheap.
My favorite example of this cheap bundle nonsense
is antivirus licenses for servers.
You know, the computers that nobody ever uses for email or browsing,
and the signature AV companies actually charge extra
for putting their AV products on those servers.
Let's see, um, what's another reason?
Oh yes, okay, we need to convince somebody.
It might be our chief security officer,
or our chief information officer, or our chief executive officer,
or maybe the board, or our auditors, or the regulators,
or our customers, or maybe Congress.
We have to convince somebody that we've got best practice security.
Of course, best practices have been defined by somebody else.
Those practices might imply working technology,
but then again, they might not.
Let's see, here's one that, that startups can also exploit,
as well as big companies.
A nasty attack crashed our network,
and so I've got budget to deploy a defense.
And you can always spot these folks,
because they don't want to hear about how the product works.
They just want to run a battery of attacks
against the product to see if it defends against them.
And these are the attacks that they suffered several months ago.
And they seem to have, they seem to suffer from this delusion
that next quarter's attack is going to be exactly the same
as last quarter's attack.
And so as long as this product stops last quarter's attack,
they somehow think that they're protected.
I, I can't believe how often I see this in accounts.
It's rather frustrating.
And then finally, the last reason,
is that there's always relationship selling.
You know, the vendor threw a wild party,
and so, uh, you know, I should buy the product.
Okay, well, maybe that one's not such a bad reason.
I'm going to move that up to the, to the plus category.
Let's see, alright.
So, those are, we see a lot of poor reasons
why people choose security technology that doesn't work.
So, now what I'd like to do is really explain
what I mean by bloopers, blights and blunders.
And to do so, I'm first going to define, uh,
two distinct classes of security technology.
There's, let's call it the security technology that works,
and the security technology that sells.
Now, for those reasons we saw in the previous slide,
these sets are not equivalent.
Now, you know, my job at Bessemer
is to find teams that have technology that works,
and fund them into companies that have technology that sells.
And of course, that intersection is where
all the great security companies thrive.
But, we also see a lot of security businesses
with technology that doesn't work,
and technology that doesn't sell.
And, um, those all still get funded.
And those are what I call bloopers.
And I think, you know, blooper is a good name
because it's sort of an innocent mistake.
You know, maybe they blow about 100 million,
200 million dollars of venture capital,
but at least they didn't actually,
at least didn't actually cost any customers any money,
because nobody ever bought it.
Okay, then the next category of disaster.
These are the blights on the industry.
These are the technologies that don't work,
but for one reason or another,
everybody's buying them anyway.
Right? And, um, we'll talk about those.
Now, these cost the venture industry
hundreds of millions of dollars,
uh, developing these products.
But more importantly, they cost,
they can cost the industry a billion dollars a year
buying these products,
not to mention the costs that they incur
trying to mop up the mess
when the products don't actually work.
And, um, I'll talk about some of those.
And then, and then, uh,
I'm going to spend actually more time
on the third category,
because the third one is actually something
that maybe we can do about,
something we can do about.
And those, oh, I'm sorry,
one thing I should mention
is that the blights inevitably,
the good news is that the blights inevitably
is wasted.
Now, the next category are the blunders.
And the blunders,
these are the ones that really scare me.
These are the ones that,
the technology doesn't work,
but these are hot products.
These are the ones that everybody's talking about,
and these are the ones that even some big companies
are bringing into accounts,
and everybody thinks are next year's products,
and I would call them next year's blights.
And I think we're going to see them,
you know, on, on our landscape
for quite some time,
these technologies.
My hope is that by illustrating
some of these disasters
and exposing the blights and blunders,
I hope to assist you
in avoiding the mistake
of making a bad investment,
a doomed career choice,
a wasted product purchase,
or even a dangerous choice
of online bank.
Here's another invention,
but this one might be a blooper.
This is a mobile computing
invention of some sort.
So, uh, I think I have to move
a little quicker through these slides.
Um, I'll start with the bloopers.
Uh, so, you know, I think
many of you may think this is wrong,
and, you know, I'm, I look forward
to some hearty debate,
but the first, the first,
and these are, by the way, these are past.
I think these are proven.
I mean, these are, these companies
tried to make a go of it, and, and they failed.
First, they're the, they're startups
who tried to build universal consoles.
And, of course, universal console
is all about integration, not innovation.
It's hard enough for the big companies
to do it. It's almost, it's all,
it's really difficult for HP.
It's impossible for a startup.
And no startup, and no enterprise
is going to buy a universal console
from a startup. Um, another area
is enterprise DRM.
So, there's been some great work
done here. Companies like, uh,
Authentica and Alkamedia,
which Fingen acquired.
You know, they built some great tools
to make it happen. You can revoke
the rights later. And it's really
great technology. But what the
industry has learned is that people
just will not change their behavior
in order to curb rights on a document
further down. Um, Tumbleweed learned
this. Slam Dunk Networks learned
this. And, um, and now, you know,
and people, and more, and more
startups are continuing to learn this.
Uh, and I think it's safe to bet
that, you know, Microsoft is going
to provide good enough DRM in office
and, and that's going to be the end
the risk of an embarrassing leak
is episodic and difficult to
quantify in terms of damage. You
know, this, this category of
product never stays in the top
three concerns very long. And if
you're not in the top three, then,
you know, you, you, you ought to
go home and figure something else
to do. So, um, next area is
enterprise DDoS protection. Uh,
it may be sorely needed, but the
truth is that if you're trying to
stop the traffic when it gets to
the edge, the only way that, the
only way that DDoS is, the only
way you can protect yourself
against DDoS is in the network.
Uh, there are services you can
buy, like the Prolexic service
that counterpaint cells, but, you
know, Mazu and others, they
figured out that they need to do
something different than, than
DDoS protection at the edge. Um,
again, these are all big, big
venture capital investments in
all these categories. Uh, here's
another one, PKI. Um, you know,
I'm sure there are some, you
know, applications like SSL, but
in terms of trying to build
applications on top of PKI
yourself, uh, it just, just
really doesn't, it's just really
not worth it and, you know,
personally I'm really pleased
that Verisign managed to buy
network solutions in other
businesses and diversify away
from this. Uh, so, uh, and then
finally there's applet signing
and I'll talk a little bit more
about this later, but basically
on this tent, most people who
look at the name on an applet
have no idea whether that's
someone they can trust or not.
And so, it really doesn't do
any good. So, uh, there we've
gone through the bloopers. Now
the, now the blights. These are
the ones that are still doing
well in the market. Still
selling well. And, uh, first
there's IDS. And we all know
the problems with IDS. They
generate alerts, every year
they get improved, which means
they generate so many alerts
that speaking of too much
useless information, that's
what these things generate.
And, you know, companies who
use these are forced to either
hire 24 by 7 teams of expensive
experts to go through these or
outsource them to companies
like Counterpain or Verisign
to just manage all the alerts
that are coming out of these
IDSs. Um, the second category
is what I would call unmanaged
firewalls. So, you know,
most of the, most of the
firewalls, as you all know,
are not configured. About
half of them still have the
default passwords in place.
So, you know, half of the
industry, half of the firewall
industry is, uh, is wasted
money. Um, and then, you
know, there's my, you know,
my favorite P, the, the server
based signature AV, uh,
because, you know, in case
somebody comes along and wants
to start doing email on your,
on your websphere application
server blade. Um, let's see.
Now, onto the blunders. And
I have really just sort of
two, two, two slides on this.
The first one is the, oh,
I'm sorry, I forgot single
sign-on, single sign-on,
there's another blight. So
single sign-on is, uh, sounds
great. It seems like a really
good idea. Um, but it turns
out that it's really hard to
integrate all your old apps
and then keep all your new
apps integrated and actually
try to get the single sign-on
to stay, to stay working. Um,
I, I liken these things to
the universal remote control
that I, that I bought from
my, you know, from my media
system. Um, you know, it
seemed like a good idea, but
after a month or two it
ends up being just one more
remote control on the table
to worry about. Just too
hard to keep programmed,
right? So, um, now by the
way, there are some
promising glimmers of
innovation here in the area
of web-based single sign-on
which seems to work a little
better. Companies like
Accentuate that are, um,
that are making this a
little easier, but I'm
still very skeptical. So
now the blunders. So the
first one is the, so
suppose it's successor to
intrusion detection. And,
and everybody said, okay,
intrusion detection doesn't
work, we need something
that doesn't just generate
alert, it can actually stop
the attack in real time
because it takes too long
for the people to sort
through the alerts. So
intrusion prevention is the
answer. And we saw a whole
generation of these systems
proliferate and we even saw
Cisco and Intercept, uh,
Cisco and McAfee buy Okina
and Intercept from some
very, very lucky investors
uh, and bring, and they're
bringing these things to
market, uh, with, with a
lot of gusto. Um, the
fundamental, the fundamental
premise behind these
products, which I find just
laughable, is that every
attack creates a visible
anomaly, and every anomaly
indicates that there's an
attack going on. If you
don't believe that that's
true, then it's inevitable
that anomaly based intrusion
prevention systems will
cause false positives. And
if they cause false
then you can be sure that the very first thing that's going to happen when some customer is
blocked from a website is that, that intrusion prevention system is going to be turned into
monitor only mode. Which means, guess what? Now it's an IDS again. Generating alerts for
somebody to, to, to look through. Now there are some other problems with these things too
that I mentioned. You know, they were, they're really slow because they have to look at all
the traffic. They require weeks of training, so you can't deploy them right away. If
anything changes on the server that you're watching, like the number of users or the
applications or the configuration, then you have to retrain it. All in all a very non
scalable solution, but the big killer is the fact that it has false positives. Just doesn't
make sense for something that's supposed to be in line. Um, what's required here are
intrusion prevention systems that have zero false positives. Uh, there are some on the
market that use signature based approaches. Those of course have zero false positives, but
they don't provide zero day protection. Um, we believe this is a big area of opportunity.
We funded a company called Determina that we believe has the solution to this space. Um, and
you know, I expect that there will be other companies trying to tackle this as well. Okay, now
my favorite. So this one, this one is a set of technologies that I see coming strong into
the market. Raising lots of venture capital and getting a lot of money, mostly from banks
to deploy them. And uh, and the damages from these, these blunders I think are gonna be, are
gonna be more costly than any others that we've seen. So I'm gonna start, let me just start
down the list. The first one is the desire of vendors, the belief that people have that
somehow there's some client software that people can give you or some inbox software that
people can give you that will prevent phishing at the inbox. A red, yellow or green light
that knows which sites are phishing and which ones aren't. Well, the bottom line is that
software has no way of knowing what you think you're talking to. It doesn't know that you
think you're talking to Citigroup. And, and so, you know, unless you're only going to browse
on a whitelist, which nobody wants to do, these, these red, yellow, green lights are not
gonna work. They assume that phishers are not gonna adapt, that they're not gonna change
their IP addresses, that they're not gonna figure out ways to, they're not, they're not
gonna use zombies in the United States that have IP addresses that don't look like they're,
you know, coming from Russia. Um, you know, it's, it's, these are quite naive defences. Um,
people sometimes think that they can apply rules to look at it and tell whether it's
phishing. Well, the whole point of phishing is that it looks like a real email. It looks
like a, it looks like a real, you know, site or a real email. There's just, you know, there's
just no way to, for a technology to be smarter than a human being in terms of seeing those
patterns. Um, then there are simple mechanisms that, that vendors come out with that defeat
very certain phishing mechanisms, like URL masking. Again, these assume absolutely zero
creativity or adaptation on the part of the phishers. Um, you know, they're, they, they'll
just do, you know, they'll just get URLs that look like they're real URLs. If I saw the URL
citygrouponline.com, I have no idea if that's a real, that's a valid URL or not. Um, and, and
none of these phishing preventions, by the way, would stop you from new kinds of phishing
attacks, like the bogus camera store that collects people's credit card information for
selling cheap cameras and the way they get the traffic is by buying the keyword on Google
for camera. They get the top placement and they get all this traffic coming and people
looking, oh, look at these cheap cameras. And then of course they use the, they, then they
use the credit cards they steal to actually pay Google for the keyword. That's my favorite
part of it. So, you know, we're looking at, um, oh, let me, okay, next one. There's this
idea that we want to empower the user. Give the user more information. You're about to go to
a non-SSL page. You're, this certificate's about to expire. Um, you're, there's a license
agreement that you should read and sign and then you'll know what you're getting into. Uh,
there's, you know, this is the person who signed this applet. This is the person who owns this
domain. This is the person who's behind this email address. All these are attempts to give
the user information and thereby empower the user to make decisions. The problem is, again,
outside this tent, no one knows what to do with that information. Some window pops up and
says their certificate expired or they're about to browse somewhere else. What do they do?
They don't know what to do, so they just go browse. It's, the, the, the information becomes
useless. Here's another, here's another last resort of the clueless. You see a lot of banks
talking about this. The answer is educating the users. We just have to train people not to
click on the bad stuff and that's gonna solve the phishing problem or the ID theft. Well, how
does that, how does that solve farming? Where the DNS is, is, is redirecting your traffic. Or
how does it solve malware that redirects your browser somewhere else? Or the bogus camera
store? I mean, redirecting, you know, train, educating the users is again a very naive and
really, uh, negligent answer to the, to, to protecting our bank accounts. Okay. Here's
another thing we see, this is another attempt hopefully to stop phishing, is authenticating
the email source. Sender ID and, and DKIM and, and whatever, you know, the other standards
wars here. Well, again, you're authenticating the source, but as we know, most of the
people who register for those systems are actually spammers. So, you know, it, it doesn't
really tell you anything about the behaviour of the email. You might see some name behind the
email source, but it doesn't give you any, any real good information. Okay, so what are the
banks thinking? They're thinking, okay, we have to provide stronger authentication.
Passwords aren't good enough. We have to authenticate everybody who comes to our site and
we're gonna have to do it with, with real strong authentication. Well, everyone knows that
there are trade-offs between security, convenience and cost. And you can't apply the most
inconvenient and the costliest security to everybody who comes to your website. You have to
profile. You have to be smart about it. If you've ever flown El Al Airlines, you know how they
do it. They only inconvenience a few people, not everybody. This is gonna be an unscalable
solution. It's gonna be too expensive. Here's another, here's another mistake. They're
focusing all their authentication efforts on the login. The login is the least dangerous part
of the session. What about the part where I withdraw cash? Or where I change my address?
Those are the risky things and it turns out that those are a very small number of sessions. If
you focus the authentication on the risky transactions, as opposed to the login, then again
you have a much better way of focusing the security resources, the cost and the
inconvenience on the sessions that matter. Banks think okay, we're gonna use strong
authentication because passwords aren't good enough. We'll use smart cards like the secure ID
card or time based codes. I'm gonna loop the next three together. We're gonna use biometrics,
fingerprints to authenticate. Or we're gonna use watermarks to educate the user so that they
know that this is not, this is not, uh, they know that this is a real site. Of course if
you're logging in from a new computer, then we have to ask you some challenging questions
and we have to authenticate you and, and, you know, we'll do that and then show you the
watermark. Well these last three, these are all really expensive. Not the last one so much,
but those first two. Two factor authentication has a total cost of ownership of $20 per user
per year. That would be okay maybe if they worked. But all three of these defenses are all,
are all, uh, defeatable by either man in the middle attacks. So all the phishers have to do
is while they're collecting your data, your time code or your biometric information,
they're turning around and logging into your bank at the same time. And they can do the same
thing with the watermark. Sit in between and get the watermark. Or they're also subject to
malware based slip streamers. So malware that sits on your computer and then waits for you to
log in using all of this expensive technology and then just, you know, takes over your
session. Does something on your PC or hands it over to somebody else. So, and you can, and
those attacks are out there. They may not be very common, but you can be sure that when
Bank of America deploys these defenses, that those attacks are going to become a lot more
common. No reason why not. So, this is why I've stopped banking online. My money's not
safe. And I feel like I want to give some prescription as to how I think this is going to
get better. I think the landscape is going to be blighted for some time, but eventually,
what banks are going to learn to do is they're going to learn to authenticate the
transaction, not the login. They're going to learn to profile the transaction. Profile the
user. Profile the session. Where is this coming from? Is this an IP address we've seen
before? Is this a normal thing for this customer to be doing? Is this just a dangerous
transaction? Is this a change of address transaction which is dangerous or is this just
somebody looking at his or her balances? And then, depending upon how dangerous it is,
we're going to escalate the response. We're going to have costlier and costlier and more and
convenient security based upon the risk. With the penultimate authentication being not
two-factor authentication, but multi-channel authentication. Because two-factor
authentication doesn't work if the channel itself has been compromised, which is what malware
does to a PC. Smart cards, biometrics, the reasons they don't stop malware or slipstreaming
is because the channel's been compromised. But if you do multi-channel authentication,
then you, you defeat those, those mechanisms. Unless that, unless the attacker is able to
compromise, identify the two simultaneous channels and, and, and compromise them, which is,
you know, many, many years out from now. Uh, there actually, and I'll say there actually is,
there actually are a set of startups that are now starting to deliver this kind of technology,
although I think it's going to be a while before banks recognize it. Uh, Authentify and
CYOTA have joined together to provide a service to banks so that they can do this, uh, for
their online banking. A very cheap, scalable solution. Yeah? Okay. So what, so the question
is, what does it mean to authenticate the transaction? So, I'll just take the Authentify
CYOTA solution for a second and illustrate. Somebody comes to the bank and logs in. Just let
them use a password. It's not the most secure thing in the world, but it's okay. Let them use
the password. By the way, keep track of how many times it took them to get in. If it took
them a long time because they had to do many passwords, that increases the risk, of course.
Then, then see what are they doing in the bank account. If they're just looking at their
balances, then maybe the password security is enough. But if they're trying to do something
else, then you want to escalate the security. Maybe you want to ask them some challenge and
response questions before they, before they look at their balances. Maybe they're doing
something more dangerous, like changing their address. In which case you want to ask them
more challenge and response questions. Maybe they're trying to actually move cash out of
the account. At which point you say, okay, because this transaction is a risky transaction,
we're going to give you a code, 3174. And now we're going to say, we know three telephone
numbers that you've got on record. Home, cell and work. Which one do you want us to call?
You don't say the number, you just identify which one. Your phone rings, a computer calls
you up and says, do you want to, do you want to, uh, do you want to authorize the transfer of
$50,000 to the Boys and Girls Club of, of Belfast? And then, you know, if so, enter the code
on your, on your web session. And if you enter 3174, then that, that authenticates that
very specific transaction. So you're authenticating the transaction, you're showing this is
what I want, wanted you to do. Rather than authenticating the session and then allowing
somebody else to wreak havoc on the session. And it also limits the security focus to just the
risky transactions. Does that answer the question? Okay, so, more advice, and this is for
email providers. Um, restore credibility to email, not through domain authentication, but
through behavior tracking. And I think this is going to be the domain of some interesting
startups, like maybe Goodmail and Habeas, where they actually track the behavior of email
senders and then use that reputational data in order to make judgements as to whether
somebody is a, is a spammer or a phisher. Um, you know, there's a, the, the major, there's a
bigger downside to spam and phish than the fact that we, that our email is untrustworthy.
And that's the fact that, that our trusted relationships, banks and e-commerce partners, can
no longer use email to talk to us. Two years ago, if Citibank sent me a message, I would have
responded. Of course, today, who would respond to a message from Citigroup or Fidelity on
their email? Email is a lost cause. We have to somehow fix that. Question? Does behavior
tracking step far beyond the boundaries of, of privacy? That's the question. Well, yes, just
in the same way that questions at the airport, uh, intrude upon your privacy for that as
well. Um, you know, I think that people who want to send you email, like Citibank or Amazon,
they're going to be okay with the idea that somebody's tracking their behavior. Um, you know,
and there may be situations where it steps beyond the bounds, but, you know, if somebody, I
don't think any, I can't imagine where, where a company's going to have a problem if it's
tracking phishing activity of somebody overseas and saying this is an IP address that you
want to be careful about. Are there legal loopholes that, that weaken the, the business
model? Yeah, well, there, it's possible those would have to be, you know, litigated. Um,
okay, uh, let's see, last one. End user security tools. We have to get over this idea that the
answer to security is to give the user more information and empower them. We have to start
thinking about what we can do to help the user make judgment calls. Is this a license
agreement you want to click on? Is this an email form that you want to put your email
address in? Or is this going to generate a lot of spam? Is it okay to, to, to navigate to
this site? We're going to see more and more, we're going to see companies coming out with
warnings that help us make those decisions. That, that highlight links that are going to
bring us to a site with malware on it. Or warn us when we're going to do something that
maybe we want to think twice about. That is much more useful end user security. Another
idea. Okay, so, you know, we're always trying to think about where there are opportunities to,
to make the security industry better. I can share with you, these are some of the questions
that we ask ourselves these days about whether there are opportunities. And these are
things I'd love to hear from people here at Defcon about. Uh, questions like, you know, is
it possible to build accurate and reputational services? Uh, for email, for IP addresses, for
uh, ISP behavior? So that you know which ISPs are, are good internet citizens and which ones
aren't. Um, do we, are there security vulnerabilities to RSS and Atom that require some
kind of uh, you know, security mechanisms? I don't know, I don't know what those would be,
but my guess is that there are, there are some vulnerabilities there. Um, and then one that I'm
very concerned about and that is VoIP on my, spam on my VoIP phone. You know, spam on my
inbox, that's sort of a hassle, but spam on my VoIP phone, I mean that is just downright
obnoxious because my phone is gonna ring every time somebody wants to sell me something and I
can't apply Bayesian rule filters like I can with spam because you don't know what the
message is until the phone rings. And so, you know, this is an area where I think, you know,
there's room for some great reputational services or something to, to try to solve this
problem. Um, I put here on the slide my coordinates for contact. Uh, you can hear me, you
know, blather more on my blog at, at whohastimeforthis.blogspot.com where, where, uh, I
love to discuss, you know, blights and blunders. And so, um, so, uh, please, please visit my
blog. And then, um, I'd like to close with a little anecdote. This, by the way, in case it's
not clear, is an, is an indoor sundial. Let's see, just gonna... yeah. So, um, so, uh,
um, that one's my favorite. Okay, so, so, uh, you know, so to a large extent, venture
capitalists like me, we play a role in the ecosystem of being gatekeepers for capital as to
which of these security projects are gonna get funded. And so, you know, it's our job to try
to spot these blunders before they happen. But we also need to appreciate the market that
exists out there and all the innovation that's there. And, and so, you know, I, I am not
cynical about the number of startups that are being funded. I, I think it's a good thing.
And, you know, the, the, and what I want, and the story I wanted to tell you happened the
Saturday night after I made my twelfth security investment in a company called Syota. Um, my,
my wife, Natalie, she took me out to, uh, the movies that Saturday night to see Born
Supremacy. And, um, we were going to this theatre in Mountain View with a lot of, uh, movie
theatres in it. And, you know, thanks to Fandango we righteously walked right past the long
lines of teenagers and we go into the lobby and I'm trying to explain to Natalie why it is
that these companies I'm investing in, they're not the same company over and over. Cause she
asked me, she says, why is it, it looks like you just keep investing in the same thing over
and over again? You know, she looked, you know, she saw those same seven, seventeen
companies I put up on the page and when I tell her what they do, they all sound exactly the
same to her. And she said, why do you do this? I'm trying to figure out how to explain to her
why I keep doing this. Now, in this, in this movie theatre, in this movie theatre, they
implemented a security mechanism to prevent movie theft. Instead of collecting tickets at
the front, like they used to, well, they had a problem that people would go see a movie, then
they'd come out in the lobby, then they'd go see another movie. So they moved the ticket
collection out to the, the hallways coming off the lobby and then after a movie, they usher
everybody out to the lobby. So, if you wanna go back in, you, you need to give a ticket. No
ticket, no movie. That's the security mechanism. So I thought, okay, there's gotta be
vulnerability here, so I said, watch this. I walked over to the front door, I waited for a
little lull in the traffic and then I, um, preferred my handout and muttered as nonchalantly
as I could, tickets, tickets. And, you know, a bevy of teenagers approached and, you know, the
first one gave me his ticket, that was the riskiest, but then the rest of them were cake. I
mean, you know, they were jabbering on about football games and SAT prep and meanwhile
their tickets were just accumulating in my hand, not looking at me. And it took them, you
know, a good five minutes as they sort of wafted over to one of the ticket stands and they
got to the ticket stand and then literally they spent another two minutes among them
trying to figure out which one of them had the tickets. Cause they forgot that they gave me
the tickets at the door. And then, by then they figured out that they'd been phished, they
turned around and I was there, I returned, I returned their assets and, um, fortunately
they didn't kick mine. Uh, so, um, so, you know, my wife understood that security is hard.
And, uh, that's why I, like, like most of the people in this room I imagine, really find it so
intriguing. Um, as we, we should all keep in mind that as we craft new technologies, we're
all gonna make mistakes now and then, um, but that's okay, so long as we critically assess
our bloopers before they bloom into full-blown blunders. Thank you very much. I am, we
have time for a question? No? One, one question. Yes? Uh, I mentioned, I didn't, I didn't say
Verisign was a blight. The question is why did I mention Verisign as a blight? Oh, why
didn't I? Oh, uh, PKI is a blight. Um, there are certain aspects of PKI, by the way, like
SSL that work great. I mean, SSL is terrific. SSL, you know, there wouldn't, a lot of
e-commerce would have been stalled if it weren't for SSL. Verisign, though, is in a lot of
other businesses besides PKI. You know, they're in the registry business, they're in the
wireless billing business, they're in a lot of business, and also in a lot of security
businesses, a lot of outsourced security services. Um, so Verisign does a lot of good
things. I think PKI is just, was just a technology that was just, uh, you know, never
justified it, justified the, uh, the, the hassle. Okay, thank you. Quick...