start	end	text
980	5840	Well, I think most of us realize that security and entrepreneurship go hand-in-hand.
6120	9300	All the major players in the industry are venture-backed.
9320	13320	Mostly, those companies are too young to vote or drink,
13320	15140	let alone screw with their customers.
16140	20680	So, if you're in security, at some point, you're going to work for a start-up,
20680	22620	or you're going to buy products from a start-up,
22620	25380	or you're going to invest in a start-up, or you're going to acquire one.
26120	30040	So, you want to know what's going to happen to all these start-ups.
30240	33500	Is there room for more of them? Which ones will succeed?
34100	37840	Today, I'll discuss the long-term role of start-ups in the security ecosystem.
39400	43320	But rather than speculate on the industry's future successes,
43320	47500	because that's something I think that many of you are probably more capable to do than I am,
47500	49680	or rather than hype my own investments,
49680	53340	I think it's more instructive to highlight mistakes of the industry.
54080	61460	Because, unfortunately, security doctors don't swear a Hippocratic oath to do no harm.
62080	64820	And so far, the results have been disastrous.
72580	77120	So, these are some of the questions that people ask me that I'll try to address today.
79100	84560	So, next question is, why dwell on the mistakes?
85480	91220	Well, 10 years ago, Dan Farmer popularized the notion that we can't secure our networks
91220	94780	if we don't openly air our vulnerabilities and errors.
95060	98760	And just this week, Michael Lynn reminded us of the same thing.
98940	102720	A lesson that I think applies not only to information security,
102720	106420	but also, I believe, to all challenging pursuits, including venture capital.
108840	112860	And in case you think that I can only dish it out, but I can't take it in,
112860	117840	you're welcome to take a look at the anti-portfolio that we at Vestamer published on our website.
117840	120240	It's the only one of its kind in the industry.
120400	126080	You can read in gory detail, if you like, about the, frankly, stupid reasons
126080	134000	why we passed on the first investment rounds in Intel, FedEx, Apple, eBay, Google, many others.
135360	137260	Good lessons there for us.
140330	148130	So, this presentation is for investors who don't want to lose their capital.
148650	152210	Entrepreneurs who want to navigate the landmines.
152790	156050	Engineers who don't want to make the wrong career choice.
156530	161370	Chief Information Security Officers and their staff who don't want to buy the wrong product.
162670	168190	Also, anyone with money in the bank who wants to keep it safe.
168190	177050	And, if that doesn't just about cover all of you, then I guess it's also for anybody who's looking to kill an hour between the two Fed presentations.
180990	187250	So, still, I expect that many of you came here looking for more positive direction on tomorrow's great inventions.
187890	191250	I feel obliged to offer something inspirational here.
191250	201270	So, I've injected into my presentation some interstitial slides here and there offering up some great examples of entrepreneurial innovation.
201370	203870	You'll see them popping up now and then.
206390	211510	So, I've told you about some things that Bessemer Venture Partners has done wrong.
211510	219650	Please give me just 30 seconds to tell you some things we've done right in an effort, perhaps, to lend some credibility to my ravings about the industry.
220350	223310	So, here's the background.
223310	230930	As the oldest venture capital practice in the nation, Bessemer has, for nearly a century, invested the family fortune of Henry Phipps,
231090	241430	a 19th century entrepreneur who decided to reinvest his proceeds from the sale of Carnegie Steel into other tiny startups like W.R. Grace and Ingersoll Rand.
241430	255490	More recently, Bessemer has funded the early stages of Parametric, Staple, Sienna, Cascade, VMX, Maxim, Veritas, Gartner Group, Perceptive Biosystems, and Skype.
255670	262590	We have about 60 employees with offices in California, Massachusetts, New York, Bangalore, and Shanghai.
268220	273860	We are the most active early stage venture firm in information security.
273860	279720	You can see here we've invested in 17 security companies. Some of them are ones that I'm sure you know.
280000	282300	Some you may be less familiar with.
282300	288320	But one thing that's in common is that we work early on with experts in the security field to start these companies.
288320	305560	Folks like Paul Makapetris at Nominum and Dan Farmer at Elemental, Bruce Schneier at Counterpain, Mark Mayfritt at EI, Gene Kim and Gene Spafford at Tripwire, and of course Ron Rivest at Verisign.
307840	315160	All but the recent three early stage investments that we've made here of the 17 are all doing well.
315160	317740	They all have run rates above $10 million.
318320	321820	Five of them have gone public. One of them was acquired by Cisco.
322900	328180	And among the 17 investments we've made there hasn't been a single realized or unrealized loss.
334480	352520	We have a dedicated security team at the firm including myself, Divesh Garg who ran Broadcom Security Business Unit, Chini Krishnan who founded Valisert, Chris Risley who was CEO both of Nominum and previously of On Technology,
352760	359580	after going public, Symantec acquired, and just a broad strong team of security professionals.
359580	370540	In this team we commit ourselves, we commit our time and our resources to maintaining a very rich dialogue with chief information security officers in the industry.
370680	378740	Many of you are probably here and you know first hand that we do this and we do that really to maintain a good pulse on the marketplace on behalf of our companies.
383180	388480	Easier to spread. Let's see.
390280	397360	Okay, so the biggest challenge for startups is that nobody wants to buy from startups.
397360	400600	People want to buy products from big companies. They want to buy suites.
400600	404460	And there are some very good reasons for this. Very valid reasons.
404460	410100	Product suites from big companies offer integration at the console level.
410100	415740	They offer integration at the appliance level, making security easier to deploy in a scalable fashion.
416180	418660	These companies promise event correlation.
419520	421760	And I think one day they might even deliver it.
422600	429780	And of course they do offer better vendor viability than what a startup can do.
445980	452480	So I'm just going to run through some slides that show you the product footprint of the major companies in the industry.
452600	459300	And this is a taxonomy that we've developed internally to map out security products.
459760	466540	And the data for each company are probably about six months old. We last updated at the end of 2004.
466680	474560	But you get a feel for how the different companies have staked out their turf across the security landscape.
474560	480040	Here you have Symantec and of course McAfee.
481720	490060	Here's ISS. And as you can see, the large vendors, each of them offer suites that cover different aspects.
490060	495020	More than point solutions, but still they can't cover the whole landscape.
495020	510020	And so what happens is that enterprises really often pick one suite and then fill in all the holes around the products that are offered by that suite vendor.
512760	516340	So this is an inventive cold remedy.
523610	529070	So then these big companies, they have these great suites and enterprises want to buy from them.
529070	537050	So the question is, what are we smoking? We keep funding all these startups out there to compete against them and have a hard time selling.
537690	542370	And why do we do that? And here's our thinking.
542370	547390	Our thinking is that there are two major reasons why the startups have to exist.
547390	553090	And in the long run, as a group at least, have to thrive. At least some of them.
553190	560350	And the first reason is that there are constantly new protocols, applications and platforms that are being deployed in the network.
560350	566310	And every time a new one comes along, then enterprises have to completely rethink their security.
566330	570890	So that the security has to actually keep up with the new technologies quickly.
570890	576390	It has to be the fastest changing element of the network because it has to move as quickly as everything else that's going on.
576390	581930	And these are just some examples of protocols that enterprises are adopting now or have started to adopt last year.
581930	589690	And every one of these things introduces important new vulnerabilities that change the way enterprises have to think about security.
589910	597390	And then the second element is captured in this image here. And that is that security is very different from other elements of infrastructure.
597730	604910	In other types of infrastructure, you're trying to basically... it's basically a battle of man versus nature.
604910	608790	Trying to iron out the wrinkles, trying to get the products to work better.
608830	611490	And asymptotically these products approach perfection.
611630	615710	The way that routers and switches today basically work.
615710	619870	They don't crash, we have enough bandwidth, basically they work fine.
620710	627230	But security isn't like that because in security every time a company releases a product,
627230	633770	you've got people who are... you've got many people who are actively trying to render it obsolete right away.
633770	636250	Very creative and adaptive people.
636310	641970	And if that's not enough, more recently the nature of that adaptation has changed
641970	649390	now that the enemy is motivated less by ego, mischief and politics and motivated more by profit.
649390	653750	Profit from spamming, profit from extortion, profit from ID theft.
653750	659770	The enemy now has the patience, the resolve and the resources to continually escalate
660290	663750	and continually adapt to the new products as they come out.
663770	668770	And for this reason we believe that it's absolutely imperative
668770	673230	that we continue to have startups, entrepreneurial teams,
673230	677270	who are innovating new defenses against the tax.
677630	683470	This is why I believe we've seen so much venture investment in startups.
683470	688070	In the last two and a half years we've counted, and we may not know all of them,
688070	693750	but we've counted 477 distinct companies that have received venture funding during that time.
694430	697170	Obviously these companies aren't all going to be successful,
697170	702770	but the level of innovation that's coming out of these 477 companies
702770	707210	absolutely eclipses anything that's going on among the larger companies.
708870	715330	So that's the role of the startup and that's the role that we try to fund.
715970	718930	Now, with all these companies that are being funded,
719790	723970	I'm sad to say that there aren't any public, there aren't any IPOs
723970	727550	in the security industry since the beginning of 2003.
727550	731070	So that's a lot of money going in and nothing really coming back
731070	735990	to the hard working employees and the not so hard working investors in those companies.
736510	741130	But what we do see is that, as we all know, mergers and acquisitions
741870	746350	have really accelerated in the last couple of years,
746350	750930	even beyond the peak of the bubble in terms of the number of deals
750930	753970	and the number of dollars going to security companies.
754370	759510	And that's because we have two types of companies in the ecosystem.
759530	762550	We have the suite vendors who are great at integrating.
762550	764910	Integrated consoles, integrated appliance.
765170	768550	They offer, that's their value to the enterprise.
768970	771650	Then you have the small companies who are the innovators.
771670	775450	They produce the new defenses. Usually they're point solutions,
775450	776950	but these are the new defenses.
776950	779650	In order for the integrators to remain competitive,
779650	783590	they have to assimilate the innovative solutions.
783890	788530	And so, and so although journalists like to talk about
788530	792490	what's happened in the last year as a consolidation in the industry,
792490	795530	we don't view this as a phase of consolidation.
795530	797650	We view this as a permanent fixture.
797970	799930	This, this is going to persist.
799930	803130	It's going to persist longer than the M&A string in the 90s
803130	807310	where Cisco, 3Com and Lucent all acquired networking companies.
807370	809490	Because again, those networking companies,
809490	811750	eventually those products worked and they matured.
811750	815350	But the best you can ever hope to do with a security product is tread water.
830120	831980	No mess, no waste.
838130	841250	So, now let me start to talk about why it is that
841250	844510	we see some major bloopers and blunders in the industry.
845250	848790	And it starts off with an analysis of people's state of minds
848790	850230	when they buy products.
850230	856530	And um, so I'm going to talk about reasons why people buy security technology.
856530	858310	Why they pick one product or another.
858310	862410	And the first reason, and this is one that I think we all agree is a very good reason,
862410	865930	and one that a lot of attention is spent to here at Defcon.
866550	870710	I understand how this technology will likely secure important assets
870710	874230	from entire classes of attack at a reasonable cost.
874710	877490	And here we like to think that this is the only reason
877490	881310	why people choose one security product over another.
881490	883770	But wait, there are more reasons.
884730	886150	Here's one.
886490	889930	Lots of other people seem to think that this technology works.
890010	891870	I guess that means I need it.
892990	897670	This common, weak minded disposition to suspend skepticism
898490	900810	explains a lot of the problems in our world.
900870	902730	Beyond information security.
903270	906950	Not only might others be wrong, and I'll point out some doozies today,
906950	910350	but there simply is no one size fits all security mix.
910570	913230	Nonetheless, this kind of thinking does drive a lot of purchasing
913230	915490	from the big security companies.
915810	920310	Here's another brain malfunction that drives sales for Symantec and Cisco.
921170	925190	If an attack brings our network down, I'll be okay,
925190	928370	so long as it brings everyone else's network down as well.
928650	930950	So I'm just going to hide in the safety of the herd
930950	933190	and buy whatever seems to be selling well,
933190	936390	and never mind that we're seeing more targeted attacks today,
936950	939770	but more importantly, that the consequences of an attack to my enterprise
939770	943090	are pretty much the same regardless of whether it hits others.
944070	947150	Okay, why else do we see people flocking to Symantec and Cisco?
947150	950510	Well, I got a good deal on a bundle.
951310	954130	I bought that big router or appliance over there,
954130	957530	and the vendor threw in some cheap or maybe even some free licenses.
958110	961250	It might not work, it might inconvenience my users,
961250	963250	it might suck up IT resources,
963250	965350	it might even be another vector of attack.
965350	967150	But it was cheap.
967890	970630	My favorite example of this cheap bundle nonsense
970630	973600	is antivirus licenses for servers.
973870	977590	You know, the computers that nobody ever uses for email or browsing,
977590	980850	and the signature AV companies actually charge extra
980850	983710	for putting their AV products on those servers.
986200	989320	Let's see, um, what's another reason?
989320	992200	Oh yes, okay, we need to convince somebody.
992760	995000	It might be our chief security officer,
995000	998000	or our chief information officer, or our chief executive officer,
998000	1002140	or maybe the board, or our auditors, or the regulators,
1002140	1005160	or our customers, or maybe Congress.
1005160	1009200	We have to convince somebody that we've got best practice security.
1009200	1012100	Of course, best practices have been defined by somebody else.
1012620	1015500	Those practices might imply working technology,
1015500	1017780	but then again, they might not.
1019360	1025300	Let's see, here's one that, that startups can also exploit,
1025300	1026640	as well as big companies.
1026880	1029740	A nasty attack crashed our network,
1029740	1032480	and so I've got budget to deploy a defense.
1033320	1035100	And you can always spot these folks,
1035100	1037500	because they don't want to hear about how the product works.
1037500	1039900	They just want to run a battery of attacks
1040760	1042960	against the product to see if it defends against them.
1042960	1046300	And these are the attacks that they suffered several months ago.
1046300	1049420	And they seem to have, they seem to suffer from this delusion
1049420	1053280	that next quarter's attack is going to be exactly the same
1053280	1054740	as last quarter's attack.
1054860	1057880	And so as long as this product stops last quarter's attack,
1057880	1060080	they somehow think that they're protected.
1060080	1063900	I, I can't believe how often I see this in accounts.
1063900	1066540	It's rather frustrating.
1066780	1068700	And then finally, the last reason,
1068700	1071000	is that there's always relationship selling.
1071060	1074740	You know, the vendor threw a wild party,
1074740	1077220	and so, uh, you know, I should buy the product.
1080000	1082960	Okay, well, maybe that one's not such a bad reason.
1082960	1086080	I'm going to move that up to the, to the plus category.
1091120	1092600	Let's see, alright.
1092600	1095320	So, those are, we see a lot of poor reasons
1095320	1098220	why people choose security technology that doesn't work.
1098220	1100320	So, now what I'd like to do is really explain
1100320	1102500	what I mean by bloopers, blights and blunders.
1102720	1105600	And to do so, I'm first going to define, uh,
1105600	1108140	two distinct classes of security technology.
1108760	1112700	There's, let's call it the security technology that works,
1112700	1114940	and the security technology that sells.
1114940	1117660	Now, for those reasons we saw in the previous slide,
1117660	1119340	these sets are not equivalent.
1120880	1123460	Now, you know, my job at Bessemer
1123460	1126700	is to find teams that have technology that works,
1126700	1130760	and fund them into companies that have technology that sells.
1130760	1132200	And of course, that intersection is where
1132200	1134960	all the great security companies thrive.
1136360	1141080	But, we also see a lot of security businesses
1141080	1144020	with technology that doesn't work,
1144020	1145960	and technology that doesn't sell.
1146640	1149540	And, um, those all still get funded.
1149580	1151360	And those are what I call bloopers.
1151680	1153680	And I think, you know, blooper is a good name
1153680	1155420	because it's sort of an innocent mistake.
1155420	1157740	You know, maybe they blow about 100 million,
1157740	1159680	200 million dollars of venture capital,
1159680	1161460	but at least they didn't actually,
1161460	1164120	at least didn't actually cost any customers any money,
1164120	1165700	because nobody ever bought it.
1169360	1172800	Okay, then the next category of disaster.
1173580	1175680	These are the blights on the industry.
1175680	1177580	These are the technologies that don't work,
1177580	1178780	but for one reason or another,
1178780	1180340	everybody's buying them anyway.
1180960	1183640	Right? And, um, we'll talk about those.
1183640	1186000	Now, these cost the venture industry
1186000	1187560	hundreds of millions of dollars,
1188100	1190040	uh, developing these products.
1190040	1191980	But more importantly, they cost,
1191980	1194240	they can cost the industry a billion dollars a year
1194720	1196340	buying these products,
1196640	1198980	not to mention the costs that they incur
1199420	1200600	trying to mop up the mess
1200600	1202360	when the products don't actually work.
1203020	1205160	And, um, I'll talk about some of those.
1206320	1208300	And then, and then, uh,
1208300	1209740	I'm going to spend actually more time
1209740	1210800	on the third category,
1210800	1212100	because the third one is actually something
1212100	1214160	that maybe we can do about,
1214160	1215580	something we can do about.
1215660	1217520	And those, oh, I'm sorry,
1217520	1218200	one thing I should mention
1218200	1219600	is that the blights inevitably,
1219600	1221180	the good news is that the blights inevitably
1226640	1227500	is wasted.
1227580	1229980	Now, the next category are the blunders.
1230360	1231780	And the blunders,
1231780	1233860	these are the ones that really scare me.
1233860	1234900	These are the ones that,
1234900	1236620	the technology doesn't work,
1236620	1238220	but these are hot products.
1238220	1240380	These are the ones that everybody's talking about,
1240380	1242440	and these are the ones that even some big companies
1242440	1243760	are bringing into accounts,
1243760	1246320	and everybody thinks are next year's products,
1246320	1248520	and I would call them next year's blights.
1248540	1250620	And I think we're going to see them,
1250620	1251840	you know, on, on our landscape
1251840	1253140	for quite some time,
1256640	1257400	these technologies.
1258380	1260100	My hope is that by illustrating
1260100	1262000	some of these disasters
1262000	1264440	and exposing the blights and blunders,
1264440	1265620	I hope to assist you
1265620	1266600	in avoiding the mistake
1266600	1268220	of making a bad investment,
1268380	1269920	a doomed career choice,
1270120	1271480	a wasted product purchase,
1271480	1273400	or even a dangerous choice
1273400	1275360	of online bank.
1276860	1278160	Here's another invention,
1278160	1280540	but this one might be a blooper.
1280540	1281660	This is a mobile computing
1282720	1284460	invention of some sort.
1292180	1294100	So, uh, I think I have to move
1294200	1295780	a little quicker through these slides.
1295940	1297400	Um, I'll start with the bloopers.
1297680	1299840	Uh, so, you know, I think
1299840	1301700	many of you may think this is wrong,
1301700	1303580	and, you know, I'm, I look forward
1303580	1305080	to some hearty debate,
1305080	1307680	but the first, the first,
1307680	1309160	and these are, by the way, these are past.
1309160	1310040	I think these are proven.
1310040	1311640	I mean, these are, these companies
1311640	1314160	tried to make a go of it, and, and they failed.
1314160	1315500	First, they're the, they're startups
1315500	1318000	who tried to build universal consoles.
1318000	1320100	And, of course, universal console
1320100	1322400	is all about integration, not innovation.
1322480	1323920	It's hard enough for the big companies
1323920	1325520	to do it. It's almost, it's all,
1325520	1327340	it's really difficult for HP.
1327460	1329440	It's impossible for a startup.
1329500	1331000	And no startup, and no enterprise
1331000	1332260	is going to buy a universal console
1332260	1335000	from a startup. Um, another area
1335000	1337120	is enterprise DRM.
1337400	1339040	So, there's been some great work
1339040	1341200	done here. Companies like, uh,
1341200	1343460	Authentica and Alkamedia,
1343460	1344800	which Fingen acquired.
1344880	1346200	You know, they built some great tools
1348000	1348800	to make it happen. You can revoke
1348800	1350200	the rights later. And it's really
1350200	1352000	great technology. But what the
1352000	1353040	industry has learned is that people
1353040	1354380	just will not change their behavior
1354380	1356580	in order to curb rights on a document
1356580	1358580	further down. Um, Tumbleweed learned
1358580	1360560	this. Slam Dunk Networks learned
1360560	1363780	this. And, um, and now, you know,
1363780	1365620	and people, and more, and more
1365620	1367240	startups are continuing to learn this.
1367480	1369280	Uh, and I think it's safe to bet
1369280	1370840	that, you know, Microsoft is going
1370840	1372580	to provide good enough DRM in office
1372580	1374060	and, and that's going to be the end
1378000	1379140	the risk of an embarrassing leak
1379140	1380580	is episodic and difficult to
1380580	1383120	quantify in terms of damage. You
1383120	1385040	know, this, this category of
1385040	1386380	product never stays in the top
1386380	1388220	three concerns very long. And if
1388220	1390100	you're not in the top three, then,
1390100	1391240	you know, you, you, you ought to
1391240	1392680	go home and figure something else
1392680	1396520	to do. So, um, next area is
1396520	1399700	enterprise DDoS protection. Uh,
1399700	1401140	it may be sorely needed, but the
1401140	1403320	truth is that if you're trying to
1403320	1405240	stop the traffic when it gets to
1408000	1409000	the edge, the only way that, the
1409000	1411340	only way that DDoS is, the only
1411340	1412020	way you can protect yourself
1412020	1414240	against DDoS is in the network.
1414600	1415580	Uh, there are services you can
1415580	1417100	buy, like the Prolexic service
1417100	1419300	that counterpaint cells, but, you
1419300	1421440	know, Mazu and others, they
1421440	1422380	figured out that they need to do
1422380	1423840	something different than, than
1423840	1426980	DDoS protection at the edge. Um,
1426980	1429040	again, these are all big, big
1429040	1430280	venture capital investments in
1430280	1432220	all these categories. Uh, here's
1432220	1436100	another one, PKI. Um, you know,
1438000	1439280	I'm sure there are some, you
1439280	1440980	know, applications like SSL, but
1440980	1442340	in terms of trying to build
1442340	1443800	applications on top of PKI
1443800	1445720	yourself, uh, it just, just
1445720	1446820	really doesn't, it's just really
1446820	1448260	not worth it and, you know,
1448260	1449360	personally I'm really pleased
1449360	1451200	that Verisign managed to buy
1451200	1452220	network solutions in other
1452220	1454200	businesses and diversify away
1454200	1458200	from this. Uh, so, uh, and then
1458200	1459360	finally there's applet signing
1459360	1460920	and I'll talk a little bit more
1460920	1462720	about this later, but basically
1468000	1469940	on this tent, most people who
1469940	1471100	look at the name on an applet
1471100	1472420	have no idea whether that's
1472420	1473980	someone they can trust or not.
1473980	1475440	And so, it really doesn't do
1475440	1480500	any good. So, uh, there we've
1480500	1482580	gone through the bloopers. Now
1482580	1484280	the, now the blights. These are
1484280	1485940	the ones that are still doing
1485940	1487080	well in the market. Still
1487080	1489160	selling well. And, uh, first
1489160	1490980	there's IDS. And we all know
1490980	1492520	the problems with IDS. They
1492520	1494560	generate alerts, every year
1494560	1495660	they get improved, which means
1498000	1498940	they generate so many alerts
1498940	1500700	that speaking of too much
1500700	1502240	useless information, that's
1502240	1503540	what these things generate.
1503800	1505400	And, you know, companies who
1505400	1507380	use these are forced to either
1507380	1509600	hire 24 by 7 teams of expensive
1509600	1511500	experts to go through these or
1511500	1512820	outsource them to companies
1512820	1514520	like Counterpain or Verisign
1514520	1516200	to just manage all the alerts
1516200	1516980	that are coming out of these
1516980	1521120	IDSs. Um, the second category
1521120	1522880	is what I would call unmanaged
1522880	1525380	firewalls. So, you know,
1536860	1539160	most of the, most of the
1539680	1540700	firewalls, as you all know,
1540700	1542440	are not configured. About
1542440	1543960	half of them still have the
1544220	1546060	default passwords in place.
1546400	1548860	So, you know, half of the
1548860	1550360	industry, half of the firewall
1550360	1552620	industry is, uh, is wasted
1552620	1556860	money. Um, and then, you
1556860	1557980	know, there's my, you know,
1557980	1560720	my favorite P, the, the server
1560720	1563940	based signature AV, uh,
1563940	1565220	because, you know, in case
1565220	1566300	somebody comes along and wants
1566300	1567860	to start doing email on your,
1567860	1569180	on your websphere application
1570240	1575880	server blade. Um, let's see.
1577480	1580320	Now, onto the blunders. And
1580320	1581800	I have really just sort of
1581800	1583720	two, two, two slides on this.
1583720	1586900	The first one is the, oh,
1586900	1587800	I'm sorry, I forgot single
1587800	1587960	sign-on, single sign-on,
1587960	1589760	there's another blight. So
1589760	1592340	single sign-on is, uh, sounds
1592340	1593400	great. It seems like a really
1593400	1595900	good idea. Um, but it turns
1595900	1597680	out that it's really hard to
1597680	1599180	integrate all your old apps
1599180	1600640	and then keep all your new
1600640	1601740	apps integrated and actually
1601740	1603040	try to get the single sign-on
1603040	1605800	to stay, to stay working. Um,
1605800	1607500	I, I liken these things to
1607500	1609580	the universal remote control
1610560	1611900	that I, that I bought from
1611900	1613480	my, you know, from my media
1613480	1615460	system. Um, you know, it
1615460	1616720	seemed like a good idea, but
1617960	1618920	after a month or two it
1618920	1619920	ends up being just one more
1619920	1621060	remote control on the table
1621060	1623080	to worry about. Just too
1623080	1624060	hard to keep programmed,
1624060	1626220	right? So, um, now by the
1626220	1626920	way, there are some
1626920	1628220	promising glimmers of
1628220	1629800	innovation here in the area
1629800	1631160	of web-based single sign-on
1631160	1632040	which seems to work a little
1632040	1632900	better. Companies like
1632900	1635300	Accentuate that are, um,
1635300	1636260	that are making this a
1636260	1637660	little easier, but I'm
1637660	1641080	still very skeptical. So
1641080	1643020	now the blunders. So the
1643020	1647940	first one is the, so
1647940	1649400	suppose it's successor to
1649400	1651740	intrusion detection. And,
1651740	1652880	and everybody said, okay,
1652880	1653840	intrusion detection doesn't
1653840	1655320	work, we need something
1655320	1656320	that doesn't just generate
1656320	1658300	alert, it can actually stop
1658300	1659860	the attack in real time
1659860	1660940	because it takes too long
1660940	1661840	for the people to sort
1661840	1663680	through the alerts. So
1663680	1664780	intrusion prevention is the
1664780	1665700	answer. And we saw a whole
1665700	1667000	generation of these systems
1667720	1668760	proliferate and we even saw
1668760	1671440	Cisco and Intercept, uh,
1671440	1673100	Cisco and McAfee buy Okina
1673100	1674060	and Intercept from some
1674060	1675460	very, very lucky investors
1676060	1677340	uh, and bring, and they're
1677340	1677920	bringing these things to
1677920	1679700	market, uh, with, with a
1679700	1682860	lot of gusto. Um, the
1682860	1684900	fundamental, the fundamental
1684900	1685860	premise behind these
1685860	1688000	products, which I find just
1688000	1690260	laughable, is that every
1690420	1691500	attack creates a visible
1691500	1694500	anomaly, and every anomaly
1694500	1695260	indicates that there's an
1695260	1697900	attack going on. If you
1697900	1699020	don't believe that that's
1699020	1701860	true, then it's inevitable
1701860	1703980	that anomaly based intrusion
1703980	1704960	prevention systems will
1704960	1707160	cause false positives. And
1707160	1707900	if they cause false
1707900	1711460	then you can be sure that the very first thing that's going to happen when some customer is
1711460	1716080	blocked from a website is that, that intrusion prevention system is going to be turned into
1716080	1720960	monitor only mode. Which means, guess what? Now it's an IDS again. Generating alerts for
1720960	1724620	somebody to, to, to look through. Now there are some other problems with these things too
1724620	1727760	that I mentioned. You know, they were, they're really slow because they have to look at all
1727760	1732440	the traffic. They require weeks of training, so you can't deploy them right away. If
1732440	1736040	anything changes on the server that you're watching, like the number of users or the
1736040	1740180	applications or the configuration, then you have to retrain it. All in all a very non
1740180	1744360	scalable solution, but the big killer is the fact that it has false positives. Just doesn't
1744360	1749520	make sense for something that's supposed to be in line. Um, what's required here are
1749520	1755420	intrusion prevention systems that have zero false positives. Uh, there are some on the
1755420	1760360	market that use signature based approaches. Those of course have zero false positives, but
1760360	1765960	they don't provide zero day protection. Um, we believe this is a big area of opportunity.
1765960	1771200	We funded a company called Determina that we believe has the solution to this space. Um, and
1771200	1781450	you know, I expect that there will be other companies trying to tackle this as well. Okay, now
1781450	1790830	my favorite. So this one, this one is a set of technologies that I see coming strong into
1790830	1795890	the market. Raising lots of venture capital and getting a lot of money, mostly from banks
1795890	1803410	to deploy them. And uh, and the damages from these, these blunders I think are gonna be, are
1803410	1809010	gonna be more costly than any others that we've seen. So I'm gonna start, let me just start
1809010	1818110	down the list. The first one is the desire of vendors, the belief that people have that
1818110	1822970	somehow there's some client software that people can give you or some inbox software that
1822970	1828970	people can give you that will prevent phishing at the inbox. A red, yellow or green light
1828970	1833610	that knows which sites are phishing and which ones aren't. Well, the bottom line is that
1833610	1838410	software has no way of knowing what you think you're talking to. It doesn't know that you
1838410	1843970	think you're talking to Citigroup. And, and so, you know, unless you're only going to browse
1843970	1849250	on a whitelist, which nobody wants to do, these, these red, yellow, green lights are not
1849250	1852710	gonna work. They assume that phishers are not gonna adapt, that they're not gonna change
1852710	1856350	their IP addresses, that they're not gonna figure out ways to, they're not, they're not
1856350	1861070	gonna use zombies in the United States that have IP addresses that don't look like they're,
1861070	1869290	you know, coming from Russia. Um, you know, it's, it's, these are quite naive defences. Um,
1869290	1872930	people sometimes think that they can apply rules to look at it and tell whether it's
1872930	1877170	phishing. Well, the whole point of phishing is that it looks like a real email. It looks
1877170	1881290	like a, it looks like a real, you know, site or a real email. There's just, you know, there's
1881290	1886250	just no way to, for a technology to be smarter than a human being in terms of seeing those
1886250	1893790	patterns. Um, then there are simple mechanisms that, that vendors come out with that defeat
1893790	1899410	very certain phishing mechanisms, like URL masking. Again, these assume absolutely zero
1899410	1904950	creativity or adaptation on the part of the phishers. Um, you know, they're, they, they'll
1904950	1910030	just do, you know, they'll just get URLs that look like they're real URLs. If I saw the URL
1911430	1918430	citygrouponline.com, I have no idea if that's a real, that's a valid URL or not. Um, and, and
1918430	1922510	none of these phishing preventions, by the way, would stop you from new kinds of phishing
1922510	1927810	attacks, like the bogus camera store that collects people's credit card information for
1927810	1933090	selling cheap cameras and the way they get the traffic is by buying the keyword on Google
1933090	1937430	for camera. They get the top placement and they get all this traffic coming and people
1937430	1941330	looking, oh, look at these cheap cameras. And then of course they use the, they, then they
1941330	1945370	use the credit cards they steal to actually pay Google for the keyword. That's my favorite
1945370	1953950	part of it. So, you know, we're looking at, um, oh, let me, okay, next one. There's this
1953950	1957590	idea that we want to empower the user. Give the user more information. You're about to go to
1957670	1963390	a non-SSL page. You're, this certificate's about to expire. Um, you're, there's a license
1963390	1967390	agreement that you should read and sign and then you'll know what you're getting into. Uh,
1967390	1970910	there's, you know, this is the person who signed this applet. This is the person who owns this
1970910	1975370	domain. This is the person who's behind this email address. All these are attempts to give
1975370	1979690	the user information and thereby empower the user to make decisions. The problem is, again,
1979690	1983610	outside this tent, no one knows what to do with that information. Some window pops up and
1983610	1987270	says their certificate expired or they're about to browse somewhere else. What do they do?
1987270	1991270	They don't know what to do, so they just go browse. It's, the, the, the information becomes
1991270	1997410	useless. Here's another, here's another last resort of the clueless. You see a lot of banks
1997410	2001970	talking about this. The answer is educating the users. We just have to train people not to
2001970	2006290	click on the bad stuff and that's gonna solve the phishing problem or the ID theft. Well, how
2006290	2011970	does that, how does that solve farming? Where the DNS is, is, is redirecting your traffic. Or
2011970	2017390	how does it solve malware that redirects your browser somewhere else? Or the bogus camera
2017390	2023170	store? I mean, redirecting, you know, train, educating the users is again a very naive and
2023170	2031470	really, uh, negligent answer to the, to, to protecting our bank accounts. Okay. Here's
2031470	2035630	another thing we see, this is another attempt hopefully to stop phishing, is authenticating
2035630	2041690	the email source. Sender ID and, and DKIM and, and whatever, you know, the other standards
2041690	2047190	wars here. Well, again, you're authenticating the source, but as we know, most of the
2047190	2053270	people who register for those systems are actually spammers. So, you know, it, it doesn't
2053270	2057570	really tell you anything about the behaviour of the email. You might see some name behind the
2057570	2064610	email source, but it doesn't give you any, any real good information. Okay, so what are the
2064610	2067690	banks thinking? They're thinking, okay, we have to provide stronger authentication.
2067790	2071410	Passwords aren't good enough. We have to authenticate everybody who comes to our site and
2071410	2076230	we're gonna have to do it with, with real strong authentication. Well, everyone knows that
2076230	2082570	there are trade-offs between security, convenience and cost. And you can't apply the most
2082570	2087090	inconvenient and the costliest security to everybody who comes to your website. You have to
2087090	2091830	profile. You have to be smart about it. If you've ever flown El Al Airlines, you know how they
2091830	2097230	do it. They only inconvenience a few people, not everybody. This is gonna be an unscalable
2097230	2102330	solution. It's gonna be too expensive. Here's another, here's another mistake. They're
2102330	2107670	focusing all their authentication efforts on the login. The login is the least dangerous part
2107670	2112810	of the session. What about the part where I withdraw cash? Or where I change my address?
2113290	2117390	Those are the risky things and it turns out that those are a very small number of sessions. If
2117390	2122630	you focus the authentication on the risky transactions, as opposed to the login, then again
2122630	2126710	you have a much better way of focusing the security resources, the cost and the
2126710	2133110	inconvenience on the sessions that matter. Banks think okay, we're gonna use strong
2133110	2136590	authentication because passwords aren't good enough. We'll use smart cards like the secure ID
2136590	2144550	card or time based codes. I'm gonna loop the next three together. We're gonna use biometrics,
2144550	2151550	fingerprints to authenticate. Or we're gonna use watermarks to educate the user so that they
2151550	2156910	know that this is not, this is not, uh, they know that this is a real site. Of course if
2156910	2160910	you're logging in from a new computer, then we have to ask you some challenging questions
2161430	2165470	and we have to authenticate you and, and, you know, we'll do that and then show you the
2165470	2170590	watermark. Well these last three, these are all really expensive. Not the last one so much,
2170590	2175850	but those first two. Two factor authentication has a total cost of ownership of $20 per user
2175850	2184530	per year. That would be okay maybe if they worked. But all three of these defenses are all,
2184530	2191410	are all, uh, defeatable by either man in the middle attacks. So all the phishers have to do
2191410	2195790	is while they're collecting your data, your time code or your biometric information,
2195790	2200410	they're turning around and logging into your bank at the same time. And they can do the same
2200410	2207530	thing with the watermark. Sit in between and get the watermark. Or they're also subject to
2207530	2212510	malware based slip streamers. So malware that sits on your computer and then waits for you to
2212510	2217190	log in using all of this expensive technology and then just, you know, takes over your
2217190	2222910	session. Does something on your PC or hands it over to somebody else. So, and you can, and
2222910	2227270	those attacks are out there. They may not be very common, but you can be sure that when
2227270	2230810	Bank of America deploys these defenses, that those attacks are going to become a lot more
2230810	2239970	common. No reason why not. So, this is why I've stopped banking online. My money's not
2239970	2246070	safe. And I feel like I want to give some prescription as to how I think this is going to
2246070	2250330	get better. I think the landscape is going to be blighted for some time, but eventually,
2250330	2253390	what banks are going to learn to do is they're going to learn to authenticate the
2253390	2259570	transaction, not the login. They're going to learn to profile the transaction. Profile the
2259570	2263290	user. Profile the session. Where is this coming from? Is this an IP address we've seen
2263290	2269030	before? Is this a normal thing for this customer to be doing? Is this just a dangerous
2269030	2273030	transaction? Is this a change of address transaction which is dangerous or is this just
2273030	2278690	somebody looking at his or her balances? And then, depending upon how dangerous it is,
2278690	2282930	we're going to escalate the response. We're going to have costlier and costlier and more and
2282930	2287490	convenient security based upon the risk. With the penultimate authentication being not
2287490	2292150	two-factor authentication, but multi-channel authentication. Because two-factor
2292150	2296770	authentication doesn't work if the channel itself has been compromised, which is what malware
2296770	2304090	does to a PC. Smart cards, biometrics, the reasons they don't stop malware or slipstreaming
2304090	2309870	is because the channel's been compromised. But if you do multi-channel authentication,
2309870	2315310	then you, you defeat those, those mechanisms. Unless that, unless the attacker is able to
2315310	2320990	compromise, identify the two simultaneous channels and, and, and compromise them, which is,
2320990	2329190	you know, many, many years out from now. Uh, there actually, and I'll say there actually is,
2329190	2333290	there actually are a set of startups that are now starting to deliver this kind of technology,
2333290	2337950	although I think it's going to be a while before banks recognize it. Uh, Authentify and
2337950	2345130	CYOTA have joined together to provide a service to banks so that they can do this, uh, for
2345130	2355020	their online banking. A very cheap, scalable solution. Yeah? Okay. So what, so the question
2355020	2359120	is, what does it mean to authenticate the transaction? So, I'll just take the Authentify
2359120	2364140	CYOTA solution for a second and illustrate. Somebody comes to the bank and logs in. Just let
2364140	2367860	them use a password. It's not the most secure thing in the world, but it's okay. Let them use
2367860	2372360	the password. By the way, keep track of how many times it took them to get in. If it took
2372360	2376500	them a long time because they had to do many passwords, that increases the risk, of course.
2377780	2380900	Then, then see what are they doing in the bank account. If they're just looking at their
2380900	2385640	balances, then maybe the password security is enough. But if they're trying to do something
2385640	2391080	else, then you want to escalate the security. Maybe you want to ask them some challenge and
2391080	2395820	response questions before they, before they look at their balances. Maybe they're doing
2395820	2400860	something more dangerous, like changing their address. In which case you want to ask them
2400860	2404520	more challenge and response questions. Maybe they're trying to actually move cash out of
2404520	2410180	the account. At which point you say, okay, because this transaction is a risky transaction,
2410180	2415620	we're going to give you a code, 3174. And now we're going to say, we know three telephone
2415620	2419140	numbers that you've got on record. Home, cell and work. Which one do you want us to call?
2419140	2424760	You don't say the number, you just identify which one. Your phone rings, a computer calls
2424760	2432920	you up and says, do you want to, do you want to, uh, do you want to authorize the transfer of
2432920	2439780	$50,000 to the Boys and Girls Club of, of Belfast? And then, you know, if so, enter the code
2439780	2444940	on your, on your web session. And if you enter 3174, then that, that authenticates that
2444940	2449080	very specific transaction. So you're authenticating the transaction, you're showing this is
2449080	2453060	what I want, wanted you to do. Rather than authenticating the session and then allowing
2453060	2458340	somebody else to wreak havoc on the session. And it also limits the security focus to just the
2458340	2467720	risky transactions. Does that answer the question? Okay, so, more advice, and this is for
2467720	2474240	email providers. Um, restore credibility to email, not through domain authentication, but
2474240	2477820	through behavior tracking. And I think this is going to be the domain of some interesting
2477820	2483320	startups, like maybe Goodmail and Habeas, where they actually track the behavior of email
2483320	2488380	senders and then use that reputational data in order to make judgements as to whether
2488380	2495620	somebody is a, is a spammer or a phisher. Um, you know, there's a, the, the major, there's a
2495620	2500720	bigger downside to spam and phish than the fact that we, that our email is untrustworthy.
2500720	2505440	And that's the fact that, that our trusted relationships, banks and e-commerce partners, can
2505440	2510280	no longer use email to talk to us. Two years ago, if Citibank sent me a message, I would have
2510280	2514760	responded. Of course, today, who would respond to a message from Citigroup or Fidelity on
2514760	2525630	their email? Email is a lost cause. We have to somehow fix that. Question? Does behavior
2525630	2531970	tracking step far beyond the boundaries of, of privacy? That's the question. Well, yes, just
2531970	2536670	in the same way that questions at the airport, uh, intrude upon your privacy for that as
2536670	2541730	well. Um, you know, I think that people who want to send you email, like Citibank or Amazon,
2541730	2547230	they're going to be okay with the idea that somebody's tracking their behavior. Um, you know,
2547230	2551290	and there may be situations where it steps beyond the bounds, but, you know, if somebody, I
2551290	2555870	don't think any, I can't imagine where, where a company's going to have a problem if it's
2555870	2559910	tracking phishing activity of somebody overseas and saying this is an IP address that you
2559910	2570200	want to be careful about. Are there legal loopholes that, that weaken the, the business
2570200	2580780	model? Yeah, well, there, it's possible those would have to be, you know, litigated. Um,
2580780	2589860	okay, uh, let's see, last one. End user security tools. We have to get over this idea that the
2589860	2594200	answer to security is to give the user more information and empower them. We have to start
2594200	2598860	thinking about what we can do to help the user make judgment calls. Is this a license
2598860	2602360	agreement you want to click on? Is this an email form that you want to put your email
2602360	2607520	address in? Or is this going to generate a lot of spam? Is it okay to, to, to navigate to
2607520	2612280	this site? We're going to see more and more, we're going to see companies coming out with
2612280	2616660	warnings that help us make those decisions. That, that highlight links that are going to
2616660	2620700	bring us to a site with malware on it. Or warn us when we're going to do something that
2620700	2629210	maybe we want to think twice about. That is much more useful end user security. Another
2629210	2639330	idea. Okay, so, you know, we're always trying to think about where there are opportunities to,
2639330	2642950	to make the security industry better. I can share with you, these are some of the questions
2642950	2646550	that we ask ourselves these days about whether there are opportunities. And these are
2646550	2651770	things I'd love to hear from people here at Defcon about. Uh, questions like, you know, is
2651770	2658610	it possible to build accurate and reputational services? Uh, for email, for IP addresses, for
2658610	2663990	uh, ISP behavior? So that you know which ISPs are, are good internet citizens and which ones
2663990	2671850	aren't. Um, do we, are there security vulnerabilities to RSS and Atom that require some
2671850	2676170	kind of uh, you know, security mechanisms? I don't know, I don't know what those would be,
2676170	2680090	but my guess is that there are, there are some vulnerabilities there. Um, and then one that I'm
2680090	2685350	very concerned about and that is VoIP on my, spam on my VoIP phone. You know, spam on my
2685350	2690710	inbox, that's sort of a hassle, but spam on my VoIP phone, I mean that is just downright
2690710	2694970	obnoxious because my phone is gonna ring every time somebody wants to sell me something and I
2694970	2699450	can't apply Bayesian rule filters like I can with spam because you don't know what the
2699450	2704850	message is until the phone rings. And so, you know, this is an area where I think, you know,
2704850	2709110	there's room for some great reputational services or something to, to try to solve this
2709110	2715230	problem. Um, I put here on the slide my coordinates for contact. Uh, you can hear me, you
2715230	2720870	know, blather more on my blog at, at whohastimeforthis.blogspot.com where, where, uh, I
2720870	2728410	love to discuss, you know, blights and blunders. And so, um, so, uh, please, please visit my
2728410	2735910	blog. And then, um, I'd like to close with a little anecdote. This, by the way, in case it's
2735910	2745210	not clear, is an, is an indoor sundial. Let's see, just gonna... yeah. So, um, so, uh,
2745230	2754670	um, that one's my favorite. Okay, so, so, uh, you know, so to a large extent, venture
2754670	2759850	capitalists like me, we play a role in the ecosystem of being gatekeepers for capital as to
2759850	2764330	which of these security projects are gonna get funded. And so, you know, it's our job to try
2764330	2770970	to spot these blunders before they happen. But we also need to appreciate the market that
2770970	2777350	exists out there and all the innovation that's there. And, and so, you know, I, I am not
2778110	2782450	cynical about the number of startups that are being funded. I, I think it's a good thing.
2782550	2788570	And, you know, the, the, and what I want, and the story I wanted to tell you happened the
2788570	2795230	Saturday night after I made my twelfth security investment in a company called Syota. Um, my,
2795230	2799070	my wife, Natalie, she took me out to, uh, the movies that Saturday night to see Born
2799070	2805470	Supremacy. And, um, we were going to this theatre in Mountain View with a lot of, uh, movie
2805470	2812910	theatres in it. And, you know, thanks to Fandango we righteously walked right past the long
2812910	2819950	lines of teenagers and we go into the lobby and I'm trying to explain to Natalie why it is
2819950	2824270	that these companies I'm investing in, they're not the same company over and over. Cause she
2824270	2827250	asked me, she says, why is it, it looks like you just keep investing in the same thing over
2827250	2831450	and over again? You know, she looked, you know, she saw those same seven, seventeen
2831450	2835390	companies I put up on the page and when I tell her what they do, they all sound exactly the
2835390	2838770	same to her. And she said, why do you do this? I'm trying to figure out how to explain to her
2839870	2844890	why I keep doing this. Now, in this, in this movie theatre, in this movie theatre, they
2844890	2850570	implemented a security mechanism to prevent movie theft. Instead of collecting tickets at
2850570	2855450	the front, like they used to, well, they had a problem that people would go see a movie, then
2855450	2858690	they'd come out in the lobby, then they'd go see another movie. So they moved the ticket
2858690	2863210	collection out to the, the hallways coming off the lobby and then after a movie, they usher
2863210	2867690	everybody out to the lobby. So, if you wanna go back in, you, you need to give a ticket. No
2867690	2873610	ticket, no movie. That's the security mechanism. So I thought, okay, there's gotta be
2873610	2878930	vulnerability here, so I said, watch this. I walked over to the front door, I waited for a
2878930	2885430	little lull in the traffic and then I, um, preferred my handout and muttered as nonchalantly
2885450	2893870	as I could, tickets, tickets. And, you know, a bevy of teenagers approached and, you know, the
2893870	2899070	first one gave me his ticket, that was the riskiest, but then the rest of them were cake. I
2899070	2903690	mean, you know, they were jabbering on about football games and SAT prep and meanwhile
2903690	2908550	their tickets were just accumulating in my hand, not looking at me. And it took them, you
2908550	2914410	know, a good five minutes as they sort of wafted over to one of the ticket stands and they
2914410	2918910	got to the ticket stand and then literally they spent another two minutes among them
2918910	2922670	trying to figure out which one of them had the tickets. Cause they forgot that they gave me
2922670	2927110	the tickets at the door. And then, by then they figured out that they'd been phished, they
2927110	2932590	turned around and I was there, I returned, I returned their assets and, um, fortunately
2932590	2941710	they didn't kick mine. Uh, so, um, so, you know, my wife understood that security is hard.
2941710	2948390	And, uh, that's why I, like, like most of the people in this room I imagine, really find it so
2948390	2955310	intriguing. Um, as we, we should all keep in mind that as we craft new technologies, we're
2955310	2962210	all gonna make mistakes now and then, um, but that's okay, so long as we critically assess
2962210	2972430	our bloopers before they bloom into full-blown blunders. Thank you very much. I am, we
2972430	2989580	have time for a question? No? One, one question. Yes? Uh, I mentioned, I didn't, I didn't say
2989580	2994360	Verisign was a blight. The question is why did I mention Verisign as a blight? Oh, why
2994360	3001920	didn't I? Oh, uh, PKI is a blight. Um, there are certain aspects of PKI, by the way, like
3001920	3006420	SSL that work great. I mean, SSL is terrific. SSL, you know, there wouldn't, a lot of
3006540	3010800	e-commerce would have been stalled if it weren't for SSL. Verisign, though, is in a lot of
3010800	3016500	other businesses besides PKI. You know, they're in the registry business, they're in the
3016500	3019740	wireless billing business, they're in a lot of business, and also in a lot of security
3019740	3024040	businesses, a lot of outsourced security services. Um, so Verisign does a lot of good
3024040	3028720	things. I think PKI is just, was just a technology that was just, uh, you know, never
3028720	3038680	justified it, justified the, uh, the, the hassle. Okay, thank you. Quick...