WEBVTT 00:00.980 --> 00:05.840 Well, I think most of us realize that security and entrepreneurship go hand-in-hand. 00:06.120 --> 00:09.300 All the major players in the industry are venture-backed. 00:09.320 --> 00:15.140 Mostly, those companies are too young to vote or drink, let alone screw with their customers. 00:16.140 --> 00:25.380 So, if you're in security, at some point, you're going to work for a start-up, or you're going to buy products from a start-up, or you're going to invest in a start-up, or you're going to acquire one. 00:26.120 --> 00:30.040 So, you want to know what's going to happen to all these start-ups. 00:30.240 --> 00:31.920 Is there room for more of them? 00:32.080 --> 00:33.500 Which ones will succeed? 00:34.100 --> 00:37.840 Today, I'll discuss the long-term role of start-ups in the security ecosystem. 00:39.400 --> 00:53.340 But rather than speculate on the industry's future successes, because that's something I think that many of you are probably more capable to do than I am, or rather than hype my own investments, I think it's more instructive to highlight mistakes of the industry. 00:54.080 --> 01:01.460 Because, unfortunately, security doctors don't swear a Hippocratic oath to do no harm. 01:02.080 --> 01:04.820 And so far, the results have been disastrous. 01:12.580 --> 01:17.120 So, these are some of the questions that people ask me that I'll try to address today. 01:19.100 --> 01:24.560 So, next question is, why dwell on the mistakes? 01:25.480 --> 01:34.780 Well, 10 years ago, Dan Farmer popularized the notion that we can't secure our networks if we don't openly air our vulnerabilities and errors. 01:35.060 --> 01:38.760 And just this week, Michael Lynn reminded us of the same thing. 01:38.940 --> 01:46.420 A lesson that I think applies not only to information security, but also, I believe, to all challenging pursuits, including venture capital. 01:48.840 --> 01:57.840 And in case you think that I can only dish it out, but I can't take it in, you're welcome to take a look at the anti-portfolio that we at Vestamer published on our website. 01:57.840 --> 02:00.240 It's the only one of its kind in the industry. 02:00.400 --> 02:14.000 You can read in gory detail, if you like, about the, frankly, stupid reasons why we passed on the first investment rounds in Intel, FedEx, Apple, eBay, Google, many others. 02:15.360 --> 02:17.260 Good lessons there for us. 02:20.330 --> 02:28.130 So, this presentation is for investors who don't want to lose their capital. 02:28.650 --> 02:32.210 Entrepreneurs who want to navigate the landmines. 02:32.790 --> 02:36.050 Engineers who don't want to make the wrong career choice. 02:36.530 --> 02:41.370 Chief Information Security Officers and their staff who don't want to buy the wrong product. 02:42.670 --> 02:48.190 Also, anyone with money in the bank who wants to keep it safe. 02:48.190 --> 02:57.050 And, if that doesn't just about cover all of you, then I guess it's also for anybody who's looking to kill an hour between the two Fed presentations. 03:00.990 --> 03:07.250 So, still, I expect that many of you came here looking for more positive direction on tomorrow's great inventions. 03:07.890 --> 03:11.250 I feel obliged to offer something inspirational here. 03:11.250 --> 03:21.270 So, I've injected into my presentation some interstitial slides here and there offering up some great examples of entrepreneurial innovation. 03:21.370 --> 03:23.870 You'll see them popping up now and then. 03:26.390 --> 03:31.510 So, I've told you about some things that Bessemer Venture Partners has done wrong. 03:31.510 --> 03:39.650 Please give me just 30 seconds to tell you some things we've done right in an effort, perhaps, to lend some credibility to my ravings about the industry. 03:40.350 --> 03:43.310 So, here's the background. 03:43.310 --> 03:59.530 As the oldest venture capital practice in the nation, Bessemer has, for nearly a century, invested the family fortune of Henry Phipps, a 19th century entrepreneur who decided to reinvest his proceeds from the sale of Carnegie Steel into other tiny startups like W.R. 03:59.530 --> 04:01.430 Grace and Ingersoll Rand. 04:01.430 --> 04:15.490 More recently, Bessemer has funded the early stages of Parametric, Staple, Sienna, Cascade, VMX, Maxim, Veritas, Gartner Group, Perceptive Biosystems, and Skype. 04:15.670 --> 04:22.590 We have about 60 employees with offices in California, Massachusetts, New York, Bangalore, and Shanghai. 04:28.220 --> 04:33.860 We are the most active early stage venture firm in information security. 04:33.860 --> 04:37.780 You can see here we've invested in 17 security companies. 04:37.780 --> 04:39.720 Some of them are ones that I'm sure you know. 04:40.000 --> 04:42.300 Some you may be less familiar with. 04:42.300 --> 04:48.320 But one thing that's in common is that we work early on with experts in the security field to start these companies. 04:48.320 --> 05:05.560 Folks like Paul Makapetris at Nominum and Dan Farmer at Elemental, Bruce Schneier at Counterpain, Mark Mayfritt at EI, Gene Kim and Gene Spafford at Tripwire, and of course Ron Rivest at Verisign. 05:07.840 --> 05:15.160 All but the recent three early stage investments that we've made here of the 17 are all doing well. 05:15.160 --> 05:17.740 They all have run rates above $10 million. 05:18.320 --> 05:19.820 Five of them have gone public. 05:19.820 --> 05:21.820 One of them was acquired by Cisco. 05:22.900 --> 05:28.180 And among the 17 investments we've made there hasn't been a single realized or unrealized loss. 05:34.480 --> 05:55.660 We have a dedicated security team at the firm including myself, Divesh Garg who ran Broadcom Security Business Unit, Chini Krishnan who founded Valisert, Chris Risley who was CEO both of Nominum and previously of On Technology, after going public, Symantec acquired, 05:55.660 --> 05:59.580 and just a broad strong team of security professionals. 05:59.580 --> 06:10.540 In this team we commit ourselves, we commit our time and our resources to maintaining a very rich dialogue with chief information security officers in the industry. 06:10.680 --> 06:18.740 Many of you are probably here and you know first hand that we do this and we do that really to maintain a good pulse on the marketplace on behalf of our companies. 06:23.180 --> 06:24.660 Easier to spread. 06:27.240 --> 06:28.480 Let's see. 06:30.280 --> 06:37.360 Okay, so the biggest challenge for startups is that nobody wants to buy from startups. 06:37.360 --> 06:39.360 People want to buy products from big companies. 06:39.360 --> 06:40.600 They want to buy suites. 06:40.600 --> 06:42.840 And there are some very good reasons for this. 06:42.840 --> 06:44.460 Very valid reasons. 06:44.460 --> 06:50.100 Product suites from big companies offer integration at the console level. 06:50.100 --> 06:55.740 They offer integration at the appliance level, making security easier to deploy in a scalable fashion. 06:56.180 --> 06:58.660 These companies promise event correlation. 06:59.520 --> 07:01.760 And I think one day they might even deliver it. 07:02.600 --> 07:09.780 And of course they do offer better vendor viability than what a startup can do. 07:25.980 --> 07:32.480 So I'm just going to run through some slides that show you the product footprint of the major companies in the industry. 07:32.600 --> 07:39.300 And this is a taxonomy that we've developed internally to map out security products. 07:39.760 --> 07:43.880 And the data for each company are probably about six months old. 07:43.880 --> 07:46.540 We last updated at the end of 2004. 07:46.680 --> 07:54.560 But you get a feel for how the different companies have staked out their turf across the security landscape. 07:54.560 --> 08:00.040 Here you have Symantec and of course McAfee. 08:01.720 --> 08:03.620 Here's ISS. 08:03.720 --> 08:10.060 And as you can see, the large vendors, each of them offer suites that cover different aspects. 08:10.060 --> 08:15.020 More than point solutions, but still they can't cover the whole landscape. 08:15.020 --> 08:30.020 And so what happens is that enterprises really often pick one suite and then fill in all the holes around the products that are offered by that suite vendor. 08:32.760 --> 08:36.340 So this is an inventive cold remedy. 08:43.610 --> 08:49.070 So then these big companies, they have these great suites and enterprises want to buy from them. 08:49.070 --> 08:51.550 So the question is, what are we smoking? 08:51.550 --> 08:57.050 We keep funding all these startups out there to compete against them and have a hard time selling. 08:57.690 --> 08:59.250 And why do we do that? 08:59.750 --> 09:02.370 And here's our thinking. 09:02.370 --> 09:07.390 Our thinking is that there are two major reasons why the startups have to exist. 09:07.390 --> 09:11.130 And in the long run, as a group at least, have to thrive. 09:11.590 --> 09:13.090 At least some of them. 09:13.190 --> 09:20.350 And the first reason is that there are constantly new protocols, applications and platforms that are being deployed in the network. 09:20.350 --> 09:26.310 And every time a new one comes along, then enterprises have to completely rethink their security. 09:26.330 --> 09:30.890 So that the security has to actually keep up with the new technologies quickly. 09:30.890 --> 09:36.390 It has to be the fastest changing element of the network because it has to move as quickly as everything else that's going on. 09:36.390 --> 09:41.930 And these are just some examples of protocols that enterprises are adopting now or have started to adopt last year. 09:41.930 --> 09:49.690 And every one of these things introduces important new vulnerabilities that change the way enterprises have to think about security. 09:49.910 --> 09:53.430 And then the second element is captured in this image here. 09:53.550 --> 09:57.390 And that is that security is very different from other elements of infrastructure. 09:57.730 --> 10:04.910 In other types of infrastructure, you're trying to basically... it's basically a battle of man versus nature. 10:04.910 --> 10:08.790 Trying to iron out the wrinkles, trying to get the products to work better. 10:08.830 --> 10:11.490 And asymptotically these products approach perfection. 10:11.630 --> 10:15.710 The way that routers and switches today basically work. 10:15.710 --> 10:19.870 They don't crash, we have enough bandwidth, basically they work fine. 10:20.710 --> 10:33.770 But security isn't like that because in security every time a company releases a product, you've got people who are... you've got many people who are actively trying to render it obsolete right away. 10:33.770 --> 10:36.250 Very creative and adaptive people. 10:36.310 --> 10:49.390 And if that's not enough, more recently the nature of that adaptation has changed now that the enemy is motivated less by ego, mischief and politics and motivated more by profit. 10:49.390 --> 10:53.750 Profit from spamming, profit from extortion, profit from ID theft. 10:53.750 --> 11:03.750 The enemy now has the patience, the resolve and the resources to continually escalate and continually adapt to the new products as they come out. 11:03.770 --> 11:17.270 And for this reason we believe that it's absolutely imperative that we continue to have startups, entrepreneurial teams, who are innovating new defenses against the tax. 11:17.630 --> 11:23.470 This is why I believe we've seen so much venture investment in startups. 11:23.470 --> 11:33.750 In the last two and a half years we've counted, and we may not know all of them, but we've counted 477 distinct companies that have received venture funding during that time. 11:34.430 --> 11:47.210 Obviously these companies aren't all going to be successful, but the level of innovation that's coming out of these 477 companies absolutely eclipses anything that's going on among the larger companies. 11:48.870 --> 11:55.330 So that's the role of the startup and that's the role that we try to fund. 11:55.970 --> 12:07.550 Now, with all these companies that are being funded, I'm sad to say that there aren't any public, there aren't any IPOs in the security industry since the beginning of 2003. 12:07.550 --> 12:15.990 So that's a lot of money going in and nothing really coming back to the hard working employees and the not so hard working investors in those companies. 12:16.510 --> 12:33.970 But what we do see is that, as we all know, mergers and acquisitions have really accelerated in the last couple of years, even beyond the peak of the bubble in terms of the number of deals and the number of dollars going to security companies. 12:34.370 --> 12:39.510 And that's because we have two types of companies in the ecosystem. 12:39.530 --> 12:42.550 We have the suite vendors who are great at integrating. 12:42.550 --> 12:44.910 Integrated consoles, integrated appliance. 12:45.170 --> 12:48.550 They offer, that's their value to the enterprise. 12:48.970 --> 12:51.650 Then you have the small companies who are the innovators. 12:51.670 --> 12:53.890 They produce the new defenses. 12:53.930 --> 12:56.950 Usually they're point solutions, but these are the new defenses. 12:56.950 --> 13:03.590 In order for the integrators to remain competitive, they have to assimilate the innovative solutions. 13:03.890 --> 13:15.530 And so, and so although journalists like to talk about what's happened in the last year as a consolidation in the industry, we don't view this as a phase of consolidation. 13:15.530 --> 13:17.650 We view this as a permanent fixture. 13:17.970 --> 13:19.930 This, this is going to persist. 13:19.930 --> 13:27.310 It's going to persist longer than the M&A string in the 90s where Cisco, 3Com and Lucent all acquired networking companies. 13:27.370 --> 13:31.750 Because again, those networking companies, eventually those products worked and they matured. 13:31.750 --> 13:35.350 But the best you can ever hope to do with a security product is tread water. 13:50.120 --> 13:51.980 No mess, no waste. 13:58.130 --> 14:04.510 So, now let me start to talk about why it is that we see some major bloopers and blunders in the industry. 14:05.250 --> 14:10.230 And it starts off with an analysis of people's state of minds when they buy products. 14:10.230 --> 14:16.530 And um, so I'm going to talk about reasons why people buy security technology. 14:16.530 --> 14:18.310 Why they pick one product or another. 14:18.310 --> 14:25.930 And the first reason, and this is one that I think we all agree is a very good reason, and one that a lot of attention is spent to here at Defcon. 14:26.550 --> 14:34.230 I understand how this technology will likely secure important assets from entire classes of attack at a reasonable cost. 14:34.710 --> 14:41.310 And here we like to think that this is the only reason why people choose one security product over another. 14:41.490 --> 14:43.770 But wait, there are more reasons. 14:44.730 --> 14:46.150 Here's one. 14:46.490 --> 14:49.930 Lots of other people seem to think that this technology works. 14:50.010 --> 14:51.870 I guess that means I need it. 14:52.990 --> 15:00.810 This common, weak minded disposition to suspend skepticism explains a lot of the problems in our world. 15:00.870 --> 15:02.730 Beyond information security. 15:03.270 --> 15:10.350 Not only might others be wrong, and I'll point out some doozies today, but there simply is no one size fits all security mix. 15:10.570 --> 15:15.490 Nonetheless, this kind of thinking does drive a lot of purchasing from the big security companies. 15:15.810 --> 15:20.310 Here's another brain malfunction that drives sales for Symantec and Cisco. 15:21.170 --> 15:28.370 If an attack brings our network down, I'll be okay, so long as it brings everyone else's network down as well. 15:28.650 --> 15:43.090 So I'm just going to hide in the safety of the herd and buy whatever seems to be selling well, and never mind that we're seeing more targeted attacks today, but more importantly, that the consequences of an attack to my enterprise are pretty much the same regardless of whether it hits others. 15:44.070 --> 15:47.150 Okay, why else do we see people flocking to Symantec and Cisco? 15:47.150 --> 15:50.510 Well, I got a good deal on a bundle. 15:51.310 --> 15:57.530 I bought that big router or appliance over there, and the vendor threw in some cheap or maybe even some free licenses. 15:58.110 --> 16:05.350 It might not work, it might inconvenience my users, it might suck up IT resources, it might even be another vector of attack. 16:05.350 --> 16:07.150 But it was cheap. 16:07.890 --> 16:13.600 My favorite example of this cheap bundle nonsense is antivirus licenses for servers. 16:13.870 --> 16:23.710 You know, the computers that nobody ever uses for email or browsing, and the signature AV companies actually charge extra for putting their AV products on those servers. 16:26.200 --> 16:29.320 Let's see, um, what's another reason? 16:29.320 --> 16:32.200 Oh yes, okay, we need to convince somebody. 16:32.760 --> 16:45.160 It might be our chief security officer, or our chief information officer, or our chief executive officer, or maybe the board, or our auditors, or the regulators, or our customers, or maybe Congress. 16:45.160 --> 16:49.200 We have to convince somebody that we've got best practice security. 16:49.200 --> 16:52.100 Of course, best practices have been defined by somebody else. 16:52.620 --> 16:57.780 Those practices might imply working technology, but then again, they might not. 16:59.360 --> 17:06.640 Let's see, here's one that, that startups can also exploit, as well as big companies. 17:06.880 --> 17:12.480 A nasty attack crashed our network, and so I've got budget to deploy a defense. 17:13.320 --> 17:17.500 And you can always spot these folks, because they don't want to hear about how the product works. 17:17.500 --> 17:22.960 They just want to run a battery of attacks against the product to see if it defends against them. 17:22.960 --> 17:26.300 And these are the attacks that they suffered several months ago. 17:26.300 --> 17:34.740 And they seem to have, they seem to suffer from this delusion that next quarter's attack is going to be exactly the same as last quarter's attack. 17:34.860 --> 17:40.080 And so as long as this product stops last quarter's attack, they somehow think that they're protected. 17:40.080 --> 17:43.900 I, I can't believe how often I see this in accounts. 17:43.900 --> 17:46.540 It's rather frustrating. 17:46.780 --> 17:51.000 And then finally, the last reason, is that there's always relationship selling. 17:51.060 --> 17:57.220 You know, the vendor threw a wild party, and so, uh, you know, I should buy the product. 18:00.000 --> 18:02.960 Okay, well, maybe that one's not such a bad reason. 18:02.960 --> 18:06.080 I'm going to move that up to the, to the plus category. 18:11.120 --> 18:12.600 Let's see, alright. 18:12.600 --> 18:18.220 So, those are, we see a lot of poor reasons why people choose security technology that doesn't work. 18:18.220 --> 18:22.500 So, now what I'd like to do is really explain what I mean by bloopers, blights and blunders. 18:22.720 --> 18:28.140 And to do so, I'm first going to define, uh, two distinct classes of security technology. 18:28.760 --> 18:34.940 There's, let's call it the security technology that works, and the security technology that sells. 18:34.940 --> 18:39.340 Now, for those reasons we saw in the previous slide, these sets are not equivalent. 18:40.880 --> 18:50.760 Now, you know, my job at Bessemer is to find teams that have technology that works, and fund them into companies that have technology that sells. 18:50.760 --> 18:54.960 And of course, that intersection is where all the great security companies thrive. 18:56.360 --> 19:05.960 But, we also see a lot of security businesses with technology that doesn't work, and technology that doesn't sell. 19:06.640 --> 19:09.540 And, um, those all still get funded. 19:09.580 --> 19:11.360 And those are what I call bloopers. 19:11.680 --> 19:15.420 And I think, you know, blooper is a good name because it's sort of an innocent mistake. 19:15.420 --> 19:25.700 You know, maybe they blow about 100 million, 200 million dollars of venture capital, but at least they didn't actually, at least didn't actually cost any customers any money, because nobody ever bought it. 19:29.360 --> 19:32.800 Okay, then the next category of disaster. 19:33.580 --> 19:35.680 These are the blights on the industry. 19:35.680 --> 19:40.340 These are the technologies that don't work, but for one reason or another, everybody's buying them anyway. 19:40.960 --> 19:41.600 Right? 19:41.600 --> 19:43.640 And, um, we'll talk about those. 19:43.640 --> 19:50.040 Now, these cost the venture industry hundreds of millions of dollars, uh, developing these products. 19:50.040 --> 20:02.360 But more importantly, they cost, they can cost the industry a billion dollars a year buying these products, not to mention the costs that they incur trying to mop up the mess when the products don't actually work. 20:03.020 --> 20:05.160 And, um, I'll talk about some of those. 20:06.320 --> 20:15.580 And then, and then, uh, I'm going to spend actually more time on the third category, because the third one is actually something that maybe we can do about, something we can do about. 20:15.660 --> 20:21.180 And those, oh, I'm sorry, one thing I should mention is that the blights inevitably, the good news is that the blights inevitably 20:26.640 --> 20:27.500 is wasted. 20:27.580 --> 20:29.980 Now, the next category are the blunders. 20:30.360 --> 20:33.860 And the blunders, these are the ones that really scare me. 20:33.860 --> 20:38.220 These are the ones that, the technology doesn't work, but these are hot products. 20:38.220 --> 20:48.520 These are the ones that everybody's talking about, and these are the ones that even some big companies are bringing into accounts, and everybody thinks are next year's products, and I would call them next year's blights. 20:48.540 --> 20:53.140 And I think we're going to see them, you know, on, on our landscape for quite some time, 20:56.640 --> 20:57.400 these technologies. 20:58.380 --> 21:15.360 My hope is that by illustrating some of these disasters and exposing the blights and blunders, I hope to assist you in avoiding the mistake of making a bad investment, a doomed career choice, a wasted product purchase, or even a dangerous choice of online bank. 21:16.860 --> 21:20.540 Here's another invention, but this one might be a blooper. 21:20.540 --> 21:24.460 This is a mobile computing invention of some sort. 21:32.180 --> 21:35.780 So, uh, I think I have to move a little quicker through these slides. 21:35.940 --> 21:37.400 Um, I'll start with the bloopers. 21:37.680 --> 21:49.160 Uh, so, you know, I think many of you may think this is wrong, and, you know, I'm, I look forward to some hearty debate, but the first, the first, and these are, by the way, these are past. 21:49.160 --> 21:50.040 I think these are proven. 21:50.040 --> 21:54.160 I mean, these are, these companies tried to make a go of it, and, and they failed. 21:54.160 --> 21:58.000 First, they're the, they're startups who tried to build universal consoles. 21:58.000 --> 22:02.400 And, of course, universal console is all about integration, not innovation. 22:02.480 --> 22:04.420 It's hard enough for the big companies to do it. 22:04.420 --> 22:07.340 It's almost, it's all, it's really difficult for HP. 22:07.460 --> 22:09.440 It's impossible for a startup. 22:09.500 --> 22:13.260 And no startup, and no enterprise is going to buy a universal console from a startup. 22:13.720 --> 22:17.120 Um, another area is enterprise DRM. 22:17.400 --> 22:19.740 So, there's been some great work done here. 22:19.740 --> 22:24.800 Companies like, uh, Authentica and Alkamedia, which Fingen acquired. 22:24.880 --> 22:28.340 You know, they built some great tools to make it happen. 22:28.340 --> 22:29.840 You can revoke the rights later. 22:29.840 --> 22:31.340 And it's really great technology. 22:31.340 --> 22:37.700 But what the industry has learned is that people just will not change their behavior in order to curb rights on a document further down. 22:37.760 --> 22:39.240 Um, Tumbleweed learned this. 22:39.240 --> 22:41.340 Slam Dunk Networks learned this. 22:41.460 --> 22:47.240 And, um, and now, you know, and people, and more, and more startups are continuing to learn this. 22:47.480 --> 22:54.060 Uh, and I think it's safe to bet that, you know, Microsoft is going to provide good enough DRM in office and, and that's going to be the end 22:58.000 --> 23:03.060 the risk of an embarrassing leak is episodic and difficult to quantify in terms of damage. 23:03.080 --> 23:07.920 You know, this, this category of product never stays in the top three concerns very long. 23:07.920 --> 23:13.440 And if you're not in the top three, then, you know, you, you, you ought to go home and figure something else to do. 23:13.960 --> 23:18.500 So, um, next area is enterprise DDoS protection. 23:18.820 --> 23:34.240 Uh, it may be sorely needed, but the truth is that if you're trying to stop the traffic when it gets to the edge , the only way that, the only way that DDoS is, the only way you can protect yourself against DDoS is in the network. 23:34.600 --> 23:45.840 Uh , there are services you can buy, like the Prolexic service that counterpaint cells, but, you know, Mazu and others, they figured out that they need to do something different than, than DDoS protection at the edge. 23:46.440 --> 23:51.400 Um, again, these are all big, big venture capital investments in all these categories. 23:51.540 --> 23:53.620 Uh, here's another one, PKI. 23:53.980 --> 24:15.060 Um, you know, I'm sure there are some, you know, applications like SSL, but in terms of trying to build applications on top of PKI yourself, uh, it just, just really doesn't, it's just really not worth it and, you know, personally I'm really pleased that Verisign managed to buy network solutions in other businesses and diversify away from this. 24:16.000 --> 24:22.720 Uh, so, uh, and then finally there's applet signing and I'll talk a little bit more about this later, but basically 24:28.000 --> 24:33.980 on this tent, most people who look at the name on an applet have no idea whether that's someone they can trust or not. 24:33.980 --> 24:36.220 And so, it really doesn't do any good. 24:37.580 --> 24:41.840 So, uh, there we've gone through the bloopers. 24:42.140 --> 24:43.940 Now the, now the blights. 24:43.940 --> 24:46.840 These are the ones that are still doing well in the market. 24:46.840 --> 24:48.120 Still selling well. 24:48.320 --> 24:50.340 And, uh, first there's IDS. 24:50.380 --> 24:52.320 And we all know the problems with IDS. 24:52.320 --> 25:03.540 They generate alerts, every year they get improved, which means they generate so many alerts that speaking of too much useless information, that's what these things generate. 25:03.800 --> 25:18.000 And, you know, companies who use these are forced to either hire 24 by 7 teams of expensive experts to go through these or outsource them to companies like Counterpain or Verisign to just manage all the alerts that are coming out of these IDSs. 25:18.940 --> 25:23.960 Um, the second category is what I would call unmanaged firewalls. 25:23.960 --> 25:25.380 So, you know, 25:36.860 --> 25:42.120 most of the, most of the firewalls, as you all know, are not configured. 25:42.120 --> 25:46.060 About half of them still have the default passwords in place. 25:46.400 --> 25:53.440 So, you know, half of the industry, half of the firewall industry is, uh, is wasted money. 25:55.420 --> 26:11.420 Um, and then, you know, there's my, you know, my favorite P, the, the server based signature AV, uh, because, you know, in case somebody comes along and wants to start doing email on your, on your websphere application server blade. 26:12.840 --> 26:15.880 Um, let's see. 26:17.480 --> 26:19.520 Now, onto the blunders. 26:19.920 --> 26:23.720 And I have really just sort of two, two, two slides on this. 26:23.720 --> 26:29.400 The first one is the, oh, I'm sorry, I forgot single sign-on, single sign-on, there's another blight. 26:29.640 --> 26:32.800 So single sign-on is, uh, sounds great. 26:32.800 --> 26:34.400 It seems like a really good idea. 26:34.560 --> 26:45.160 Um, but it turns out that it's really hard to integrate all your old apps and then keep all your new apps integrated and actually try to get the single sign-on to stay, to stay working. 26:45.280 --> 26:54.340 Um, I, I liken these things to the universal remote control that I, that I bought from my, you know, from my media system. 26:54.480 --> 27:02.180 Um, you know, it seemed like a good idea, but after a month or two it ends up being just one more remote control on the table to worry about. 27:02.520 --> 27:04.620 Just too hard to keep programmed, right? 27:05.360 --> 27:12.400 So, um, now by the way, there are some promising glimmers of innovation here in the area of web-based single sign-on which seems to work a little better. 27:12.400 --> 27:18.620 Companies like Accentuate that are, um, that are making this a little easier, but I'm still very skeptical. 27:20.540 --> 27:22.060 So now the blunders. 27:22.260 --> 27:30.700 So the first one is the, so suppose it's successor to intrusion detection. 27:31.220 --> 27:42.900 And, and everybody said, okay, intrusion detection doesn't work, we need something that doesn't just generate alert, it can actually stop the attack in real time because it takes too long for the people to sort through the alerts. 27:43.200 --> 27:45.120 So intrusion prevention is the answer. 27:45.120 --> 28:00.680 And we saw a whole generation of these systems proliferate and we even saw Cisco and Intercept, uh, Cisco and McAfee buy Okina and Intercept from some very, very lucky investors uh, and bring, and they're bringing these things to market, uh, with, with a lot of gusto. 28:01.020 --> 28:16.140 Um, the fundamental , the fundamental premise behind these products , which I find just laughable , is that every attack creates a visible anomaly, and every anomaly indicates that there's an attack going on. 28:16.740 --> 28:25.560 If you don't believe that that's true, then it's inevitable that anomaly based intrusion prevention systems will cause false positives . 28:26.120 --> 28:37.220 And if they cause false positives, then then you can be sure that the very first thing that's going to happen when some customer is blocked from a website is that, that intrusion prevention system is going to be turned into monitor only mode. 28:37.480 --> 28:38.660 Which means, guess what? 28:38.660 --> 28:40.000 Now it's an IDS again. 28:40.160 --> 28:42.760 Generating alerts for somebody to, to, to look through. 28:42.860 --> 28:45.560 Now there are some other problems with these things too that I mentioned. 28:45.600 --> 28:48.540 You know, they were, they're really slow because they have to look at all the traffic. 28:48.540 --> 28:52.220 They require weeks of training, so you can't deploy them right away. 28:52.220 --> 28:59.100 If anything changes on the server that you're watching, like the number of users or the applications or the configuration, then you have to retrain it. 28:59.100 --> 29:03.720 All in all a very non scalable solution, but the big killer is the fact that it has false positives. 29:03.720 --> 29:07.040 Just doesn't make sense for something that's supposed to be in line. 29:07.640 --> 29:13.040 Um, what's required here are intrusion prevention systems that have zero false positives. 29:13.580 --> 29:18.120 Uh, there are some on the market that use signature based approaches. 29:18.320 --> 29:23.000 Those of course have zero false positives, but they don't provide zero day protection. 29:23.220 --> 29:25.960 Um, we believe this is a big area of opportunity. 29:25.960 --> 29:30.500 We funded a company called Determina that we believe has the solution to this space. 29:30.840 --> 29:36.120 Um, and you know, I expect that there will be other companies trying to tackle this as well. 29:40.710 --> 29:42.350 Okay, now my favorite. 29:45.430 --> 29:51.710 So this one, this one is a set of technologies that I see coming strong into the market. 29:51.770 --> 29:57.030 Raising lots of venture capital and getting a lot of money, mostly from banks to deploy them. 29:57.670 --> 30:06.890 And uh, and the damages from these, these blunders I think are gonna be, are gonna be more costly than any others that we've seen. 30:07.130 --> 30:09.910 So I'm gonna start, let me just start down the list. 30:09.910 --> 30:26.330 The first one is the desire of vendors, the belief that people have that somehow there's some client software that people can give you or some inbox software that people can give you that will prevent phishing at the inbox. 30:26.950 --> 30:32.070 A red, yellow or green light that knows which sites are phishing and which ones aren't. 30:32.310 --> 30:37.670 Well, the bottom line is that software has no way of knowing what you think you're talking to. 30:37.670 --> 30:40.050 It doesn't know that you think you're talking to Citigroup. 30:40.390 --> 30:49.710 And, and so, you know, unless you're only going to browse on a whitelist, which nobody wants to do, these, these red, yellow, green lights are not gonna work. 30:49.710 --> 31:01.070 They assume that phishers are not gonna adapt, that they're not gonna change their IP addresses, that they're not gonna figure out ways to, they're not, they're not gonna use zombies in the United States that have IP addresses that don't look like they're, 31:01.070 --> 31:02.710 you know, coming from Russia. 31:03.010 --> 31:08.230 Um, you know, it's, it's, these are quite naive defences. 31:08.490 --> 31:13.210 Um, people sometimes think that they can apply rules to look at it and tell whether it's phishing. 31:13.210 --> 31:16.430 Well, the whole point of phishing is that it looks like a real email. 31:16.610 --> 31:20.010 It looks like a, it looks like a real, you know, site or a real email. 31:20.010 --> 31:27.110 There's just, you know, there's just no way to, for a technology to be smarter than a human being in terms of seeing those patterns. 31:28.410 --> 31:37.110 Um, then there are simple mechanisms that, that vendors come out with that defeat very certain phishing mechanisms, like URL masking. 31:37.150 --> 31:42.350 Again, these assume absolutely zero creativity or adaptation on the part of the phishers. 31:42.370 --> 31:48.690 Um, you know, they're, they, they'll just do, you know, they'll just get URLs that look like they're real URLs. 31:48.810 --> 31:56.190 If I saw the URL citygrouponline.com, I have no idea if that's a real, that's a valid URL or not. 31:57.390 --> 32:14.410 Um, and, and none of these phishing preventions, by the way, would stop you from new kinds of phishing attacks, like the bogus camera store that collects people's credit card information for selling cheap cameras and the way they get the traffic is by buying the keyword on Google for camera. 32:14.410 --> 32:19.190 They get the top placement and they get all this traffic coming and people looking, oh, look at these cheap cameras. 32:19.250 --> 32:24.770 And then of course they use the, they, then they use the credit cards they steal to actually pay Google for the keyword. 32:24.810 --> 32:26.210 That's my favorite part of it. 32:28.250 --> 32:32.150 So, you know, we're looking at, um, oh, let me, okay, next one. 32:33.430 --> 32:35.710 There's this idea that we want to empower the user. 32:35.710 --> 32:36.930 Give the user more information. 32:36.930 --> 32:38.990 You're about to go to a non-SSL page. 32:39.050 --> 32:41.670 You're, this certificate's about to expire. 32:41.770 --> 32:46.410 Um, you're, there's a license agreement that you should read and sign and then you'll know what you're getting into. 32:46.710 --> 32:49.950 Uh, there's, you know, this is the person who signed this applet. 32:49.950 --> 32:51.310 This is the person who owns this domain. 32:51.310 --> 32:53.350 This is the person who's behind this email address. 32:53.550 --> 32:58.670 All these are attempts to give the user information and thereby empower the user to make decisions. 32:58.690 --> 33:02.050 The problem is, again, outside this tent, no one knows what to do with that information. 33:02.510 --> 33:06.570 Some window pops up and says their certificate expired or they're about to browse somewhere else. 33:06.690 --> 33:07.270 What do they do? 33:07.270 --> 33:09.150 They don't know what to do, so they just go browse. 33:09.290 --> 33:12.030 It's, the, the, the information becomes useless. 33:13.010 --> 33:16.410 Here's another, here's another last resort of the clueless. 33:16.410 --> 33:18.250 You see a lot of banks talking about this. 33:18.250 --> 33:20.170 The answer is educating the users. 33:20.170 --> 33:25.930 We just have to train people not to click on the bad stuff and that's gonna solve the phishing problem or the ID theft. 33:25.930 --> 33:29.210 Well, how does that, how does that solve farming? 33:29.210 --> 33:31.910 Where the DNS is, is, is redirecting your traffic. 33:31.910 --> 33:36.250 Or how does it solve malware that redirects your browser somewhere else? 33:36.250 --> 33:37.870 Or the bogus camera store? 33:37.870 --> 33:48.950 I mean, redirecting, you know, train, educating the users is again a very naive and really, uh, negligent answer to the, to, to protecting our bank accounts. 33:49.850 --> 33:50.770 Okay. 33:51.010 --> 33:56.470 Here's another thing we see, this is another attempt hopefully to stop phishing, is authenticating the email source. 33:56.470 --> 34:02.590 Sender ID and, and DKIM and, and whatever, you know, the other standards wars here. 34:02.830 --> 34:10.110 Well, again, you're authenticating the source, but as we know, most of the people who register for those systems are actually spammers. 34:10.490 --> 34:15.430 So, you know, it, it doesn't really tell you anything about the behaviour of the email. 34:15.430 --> 34:21.830 You might see some name behind the email source, but it doesn't give you any, any real good information. 34:23.130 --> 34:25.150 Okay, so what are the banks thinking? 34:25.150 --> 34:27.690 They're thinking, okay, we have to provide stronger authentication. 34:27.790 --> 34:28.810 Passwords aren't good enough. 34:28.810 --> 34:34.090 We have to authenticate everybody who comes to our site and we're gonna have to do it with, with real strong authentication. 34:35.130 --> 34:39.190 Well, everyone knows that there are trade-offs between security, convenience and cost. 34:39.370 --> 34:46.730 And you can't apply the most inconvenient and the costliest security to everybody who comes to your website. 34:46.730 --> 34:47.890 You have to profile. 34:47.970 --> 34:49.310 You have to be smart about it. 34:49.310 --> 34:52.610 If you've ever flown El Al Airlines, you know how they do it. 34:52.610 --> 34:55.350 They only inconvenience a few people, not everybody. 34:55.830 --> 34:57.870 This is gonna be an unscalable solution. 34:57.870 --> 34:59.210 It's gonna be too expensive. 34:59.670 --> 35:01.910 Here's another, here's another mistake. 35:02.050 --> 35:05.050 They're focusing all their authentication efforts on the login. 35:05.350 --> 35:08.590 The login is the least dangerous part of the session. 35:08.590 --> 35:10.990 What about the part where I withdraw cash? 35:10.990 --> 35:12.810 Or where I change my address? 35:13.290 --> 35:17.010 Those are the risky things and it turns out that those are a very small number of sessions. 35:17.010 --> 35:29.510 If you focus the authentication on the risky transactions, as opposed to the login, then again you have a much better way of focusing the security resources, the cost and the inconvenience on the sessions that matter. 35:31.430 --> 35:34.870 Banks think okay, we're gonna use strong authentication because passwords aren't good enough. 35:34.870 --> 35:39.410 We'll use smart cards like the secure ID card or time based codes. 35:39.810 --> 35:41.830 I'm gonna loop the next three together. 35:42.650 --> 35:47.470 We're gonna use biometrics, fingerprints to authenticate. 35:47.470 --> 35:55.930 Or we're gonna use watermarks to educate the user so that they know that this is not, this is not, uh, they know that this is a real site. 35:56.210 --> 36:05.930 Of course if you're logging in from a new computer, then we have to ask you some challenging questions and we have to authenticate you and, and, you know, we'll do that and then show you the watermark. 36:05.930 --> 36:09.610 Well these last three, these are all really expensive. 36:09.610 --> 36:11.650 Not the last one so much, but those first two. 36:12.410 --> 36:16.810 Two factor authentication has a total cost of ownership of $20 per user per year. 36:18.090 --> 36:21.250 That would be okay maybe if they worked. 36:21.370 --> 36:29.890 But all three of these defenses are all, are all, uh, defeatable by either man in the middle attacks. 36:29.890 --> 36:38.930 So all the phishers have to do is while they're collecting your data, your time code or your biometric information, they're turning around and logging into your bank at the same time. 36:39.350 --> 36:41.350 And they can do the same thing with the watermark. 36:41.350 --> 36:43.730 Sit in between and get the watermark. 36:45.970 --> 36:49.570 Or they're also subject to malware based slip streamers. 36:49.570 --> 36:57.590 So malware that sits on your computer and then waits for you to log in using all of this expensive technology and then just, you know, takes over your session. 36:57.590 --> 37:00.130 Does something on your PC or hands it over to somebody else. 37:00.950 --> 37:04.590 So, and you can, and those attacks are out there. 37:04.630 --> 37:11.470 They may not be very common, but you can be sure that when Bank of America deploys these defenses, that those attacks are going to become a lot more common. 37:11.770 --> 37:12.950 No reason why not. 37:13.610 --> 37:17.150 So, this is why I've stopped banking online. 37:19.150 --> 37:20.630 My money's not safe. 37:22.410 --> 37:26.830 And I feel like I want to give some prescription as to how I think this is going to get better. 37:26.830 --> 37:35.010 I think the landscape is going to be blighted for some time, but eventually, what banks are going to learn to do is they're going to learn to authenticate the transaction, not the login. 37:35.550 --> 37:39.010 They're going to learn to profile the transaction. 37:39.010 --> 37:39.950 Profile the user. 37:39.950 --> 37:40.850 Profile the session. 37:40.850 --> 37:42.030 Where is this coming from? 37:42.030 --> 37:44.010 Is this an IP address we've seen before? 37:44.010 --> 37:46.530 Is this a normal thing for this customer to be doing? 37:47.890 --> 37:50.010 Is this just a dangerous transaction? 37:50.190 --> 37:54.830 Is this a change of address transaction which is dangerous or is this just somebody looking at his or her balances? 37:55.950 --> 38:00.410 And then, depending upon how dangerous it is, we're going to escalate the response. 38:00.410 --> 38:05.190 We're going to have costlier and costlier and more and convenient security based upon the risk. 38:05.190 --> 38:11.070 With the penultimate authentication being not two-factor authentication, but multi-channel authentication. 38:11.070 --> 38:18.210 Because two-factor authentication doesn't work if the channel itself has been compromised, which is what malware does to a PC. 38:19.130 --> 38:26.490 Smart cards, biometrics, the reasons they don't stop malware or slipstreaming is because the channel's been compromised. 38:26.830 --> 38:32.950 But if you do multi-channel authentication, then you, you defeat those, those mechanisms. 38:32.950 --> 38:42.970 Unless that, unless the attacker is able to compromise, identify the two simultaneous channels and, and, and compromise them, which is, you know, many, many years out from now. 38:45.270 --> 38:55.950 Uh, there actually, and I'll say there actually is, there actually are a set of startups that are now starting to deliver this kind of technology, although I think it's going to be a while before banks recognize it. 38:56.010 --> 39:06.210 Uh, Authentify and CYOTA have joined together to provide a service to banks so that they can do this, uh, for their online banking. 39:06.210 --> 39:08.190 A very cheap, scalable solution. 39:08.630 --> 39:09.250 Yeah? 39:13.280 --> 39:14.080 Okay. 39:14.080 --> 39:16.880 So what, so the question is, what does it mean to authenticate the transaction? 39:17.060 --> 39:21.260 So, I'll just take the Authentify CYOTA solution for a second and illustrate. 39:21.540 --> 39:23.680 Somebody comes to the bank and logs in. 39:23.680 --> 39:25.240 Just let them use a password. 39:25.260 --> 39:27.480 It's not the most secure thing in the world, but it's okay. 39:27.480 --> 39:28.680 Let them use the password. 39:29.280 --> 39:32.020 By the way, keep track of how many times it took them to get in. 39:32.020 --> 39:36.500 If it took them a long time because they had to do many passwords, that increases the risk, of course. 39:37.780 --> 39:40.080 Then, then see what are they doing in the bank account. 39:40.080 --> 39:43.940 If they're just looking at their balances, then maybe the password security is enough. 39:44.320 --> 39:49.320 But if they're trying to do something else, then you want to escalate the security. 39:49.320 --> 39:54.460 Maybe you want to ask them some challenge and response questions before they, before they look at their balances. 39:54.820 --> 39:58.760 Maybe they're doing something more dangerous, like changing their address. 39:58.760 --> 40:02.680 In which case you want to ask them more challenge and response questions. 40:02.780 --> 40:05.260 Maybe they're trying to actually move cash out of the account. 40:05.260 --> 40:13.720 At which point you say, okay, because this transaction is a risky transaction, we're going to give you a code, 3174. 40:13.860 --> 40:16.960 And now we're going to say, we know three telephone numbers that you've got on record. 40:16.960 --> 40:17.760 Home, cell and work. 40:17.760 --> 40:19.140 Which one do you want us to call? 40:19.140 --> 40:21.680 You don't say the number, you just identify which one. 40:21.860 --> 40:36.300 Your phone rings, a computer calls you up and says, do you want to, do you want to, uh, do you want to authorize the transfer of $50,000 to the Boys and Girls Club of, of Belfast? 40:36.520 --> 40:41.440 And then, you know, if so, enter the code on your, on your web session. 40:41.560 --> 40:46.440 And if you enter 3174, then that, that authenticates that very specific transaction. 40:46.840 --> 40:50.360 So you're authenticating the transaction, you're showing this is what I want, wanted you to do. 40:50.420 --> 40:55.460 Rather than authenticating the session and then allowing somebody else to wreak havoc on the session. 40:55.460 --> 40:59.680 And it also limits the security focus to just the risky transactions. 41:01.640 --> 41:03.860 Does that answer the question? 41:05.040 --> 41:09.080 Okay, so, more advice, and this is for email providers. 41:09.300 --> 41:15.720 Um, restore credibility to email, not through domain authentication, but through behavior tracking. 41:15.720 --> 41:29.220 And I think this is going to be the domain of some interesting startups, like maybe Goodmail and Habeas, where they actually track the behavior of email senders and then use that reputational data in order to make judgements as to whether somebody is a, 41:29.220 --> 41:31.480 is a spammer or a phisher. 41:31.760 --> 41:40.380 Um, you know, there's a, the, the major, there's a bigger downside to spam and phish than the fact that we, that our email is untrustworthy. 41:40.380 --> 41:47.360 And that's the fact that, that our trusted relationships, banks and e-commerce partners, can no longer use email to talk to us. 41:47.360 --> 41:50.780 Two years ago, if Citibank sent me a message, I would have responded. 41:50.780 --> 41:55.620 Of course, today, who would respond to a message from Citigroup or Fidelity on their email? 41:55.660 --> 41:56.840 Email is a lost cause. 41:56.840 --> 41:58.160 We have to somehow fix that. 41:58.160 --> 41:59.020 Question? 42:04.790 --> 42:09.390 Does behavior tracking step far beyond the boundaries of, of privacy? 42:09.390 --> 42:10.550 That's the question. 42:10.610 --> 42:17.310 Well, yes, just in the same way that questions at the airport, uh, intrude upon your privacy for that as well. 42:17.430 --> 42:25.490 Um, you know, I think that people who want to send you email, like Citibank or Amazon, they're going to be okay with the idea that somebody's tracking their behavior. 42:26.410 --> 42:41.210 Um, you know, and there may be situations where it steps beyond the bounds, but, you know, if somebody, I don't think any, I can't imagine where, where a company's going to have a problem if it's tracking phishing activity of somebody overseas and saying this is an IP address that you want to be careful about. 42:46.840 --> 42:51.040 Are there legal loopholes that, that weaken the, the business model? 42:51.420 --> 42:57.960 Yeah, well, there, it's possible those would have to be, you know, litigated. 42:59.320 --> 43:04.340 Um, okay, uh, let's see, last one. 43:04.960 --> 43:06.660 End user security tools. 43:06.660 --> 43:13.380 We have to get over this idea that the answer to security is to give the user more information and empower them. 43:13.380 --> 43:18.080 We have to start thinking about what we can do to help the user make judgment calls. 43:18.080 --> 43:20.280 Is this a license agreement you want to click on? 43:20.280 --> 43:22.960 Is this an email form that you want to put your email address in? 43:22.960 --> 43:24.860 Or is this going to generate a lot of spam? 43:25.200 --> 43:28.340 Is it okay to, to, to navigate to this site? 43:28.380 --> 43:34.560 We're going to see more and more, we're going to see companies coming out with warnings that help us make those decisions. 43:34.660 --> 43:38.820 That, that highlight links that are going to bring us to a site with malware on it. 43:38.820 --> 43:42.160 Or warn us when we're going to do something that maybe we want to think twice about. 43:42.180 --> 43:45.280 That is much more useful end user security. 43:48.810 --> 43:49.990 Another idea. 43:51.510 --> 44:01.150 Okay, so, you know, we're always trying to think about where there are opportunities to, to make the security industry better. 44:01.150 --> 44:06.290 I can share with you, these are some of the questions that we ask ourselves these days about whether there are opportunities. 44:06.290 --> 44:09.690 And these are things I'd love to hear from people here at Defcon about. 44:09.690 --> 44:15.710 Uh, questions like, you know, is it possible to build accurate and reputational services? 44:15.850 --> 44:20.570 Uh, for email, for IP addresses, for uh, ISP behavior? 44:20.570 --> 44:24.710 So that you know which ISPs are, are good internet citizens and which ones aren't. 44:24.910 --> 44:34.510 Um, do we, are there security vulnerabilities to RSS and Atom that require some kind of uh, you know, security mechanisms? 44:34.510 --> 44:38.930 I don't know, I don't know what those would be, but my guess is that there are, there are some vulnerabilities there. 44:39.190 --> 44:44.370 Um, and then one that I'm very concerned about and that is VoIP on my, spam on my VoIP phone. 44:44.450 --> 45:01.390 You know, spam on my inbox, that's sort of a hassle, but spam on my VoIP phone, I mean that is just downright obnoxious because my phone is gonna ring every time somebody wants to sell me something and I can't apply Bayesian rule filters like I can with spam because you don't know what the message is until the phone rings. 45:01.530 --> 45:09.770 And so, you know, this is an area where I think, you know, there's room for some great reputational services or something to, to try to solve this problem. 45:09.830 --> 45:13.410 Um, I put here on the slide my coordinates for contact. 45:13.470 --> 45:23.710 Uh, you can hear me, you know, blather more on my blog at, at whohastimeforthis.blogspot.com where, where, uh, I love to discuss, you know, blights and blunders. 45:24.210 --> 45:29.250 And so, um, so, uh, please, please visit my blog. 45:29.650 --> 45:34.670 And then, um, I'd like to close with a little anecdote. 45:34.770 --> 45:38.470 This, by the way, in case it's not clear, is an, is an indoor sundial. 45:38.730 --> 45:43.390 Let's see, just gonna... yeah. 45:44.590 --> 45:47.050 So, um, so, uh, um, that one's my favorite. 45:47.790 --> 46:02.190 Okay, so, so, uh, you know, so to a large extent, venture capitalists like me, we play a role in the ecosystem of being gatekeepers for capital as to which of these security projects are gonna get funded. 46:02.470 --> 46:07.350 And so, you know, it's our job to try to spot these blunders before they happen. 46:07.350 --> 46:13.510 But we also need to appreciate the market that exists out there and all the innovation that's there. 46:14.750 --> 46:20.770 And, and so, you know, I, I am not cynical about the number of startups that are being funded. 46:20.770 --> 46:22.450 I, I think it's a good thing. 46:22.550 --> 46:34.190 And, you know, the, the, and what I want, and the story I wanted to tell you happened the Saturday night after I made my twelfth security investment in a company called Syota. 46:34.450 --> 46:40.050 Um, my, my wife, Natalie, she took me out to, uh, the movies that Saturday night to see Born Supremacy. 46:40.530 --> 46:46.530 And, um, we were going to this theatre in Mountain View with a lot of, uh, movie theatres in it. 46:46.930 --> 47:04.030 And, you know, thanks to Fandango we righteously walked right past the long lines of teenagers and we go into the lobby and I'm trying to explain to Natalie why it is that these companies I'm investing in, they're not the same company over and over. 47:04.030 --> 47:08.150 Cause she asked me, she says, why is it, it looks like you just keep investing in the same thing over and over again? 47:08.370 --> 47:16.230 You know, she looked, you know, she saw those same seven, seventeen companies I put up on the page and when I tell her what they do, they all sound exactly the same to her. 47:16.390 --> 47:17.270 And she said, why do you do this? 47:17.270 --> 47:21.510 I'm trying to figure out how to explain to her why I keep doing this. 47:21.510 --> 47:28.170 Now, in this, in this movie theatre, in this movie theatre, they implemented a security mechanism to prevent movie theft. 47:28.610 --> 47:37.550 Instead of collecting tickets at the front, like they used to, well, they had a problem that people would go see a movie, then they'd come out in the lobby, then they'd go see another movie. 47:37.550 --> 47:44.650 So they moved the ticket collection out to the, the hallways coming off the lobby and then after a movie, they usher everybody out to the lobby. 47:44.810 --> 47:47.550 So, if you wanna go back in, you, you need to give a ticket. 47:47.550 --> 47:48.730 No ticket, no movie. 47:48.730 --> 47:50.370 That's the security mechanism. 47:50.510 --> 47:56.210 So I thought, okay, there's gotta be vulnerability here, so I said, watch this. 47:56.310 --> 48:08.410 I walked over to the front door, I waited for a little lull in the traffic and then I, um, preferred my handout and muttered as nonchalantly as I could, tickets, tickets. 48:09.250 --> 48:18.990 And, you know, a bevy of teenagers approached and, you know, the first one gave me his ticket, that was the riskiest, but then the rest of them were cake. 48:18.990 --> 48:27.510 I mean, you know, they were jabbering on about football games and SAT prep and meanwhile their tickets were just accumulating in my hand, not looking at me. 48:27.550 --> 48:40.870 And it took them, you know, a good five minutes as they sort of wafted over to one of the ticket stands and they got to the ticket stand and then literally they spent another two minutes among them trying to figure out which one of them had the tickets. 48:40.870 --> 48:43.850 Cause they forgot that they gave me the tickets at the door. 48:43.850 --> 48:54.050 And then, by then they figured out that they'd been phished, they turned around and I was there, I returned, I returned their assets and, um, fortunately they didn't kick mine. 48:54.430 --> 49:01.710 Uh, so, um, so, you know, my wife understood that security is hard. 49:01.710 --> 49:09.150 And, uh, that's why I, like, like most of the people in this room I imagine, really find it so intriguing. 49:09.610 --> 49:26.350 Um, as we, we should all keep in mind that as we craft new technologies, we're all gonna make mistakes now and then, um, but that's okay, so long as we critically assess our bloopers before they bloom into full-blown blunders. 49:26.770 --> 49:28.170 Thank you very much. 49:28.170 --> 49:33.810 I am, we have time for a question? 49:33.830 --> 49:34.710 No? 49:36.590 --> 49:38.510 One, one question. 49:40.990 --> 49:41.870 Yes? 49:46.140 --> 49:50.820 Uh, I mentioned, I didn't, I didn't say Verisign was a blight. 49:50.820 --> 49:53.660 The question is why did I mention Verisign as a blight? 49:54.080 --> 49:55.320 Oh, why didn't I? 49:55.600 --> 49:58.960 Oh, uh, PKI is a blight. 49:59.040 --> 50:03.060 Um, there are certain aspects of PKI, by the way, like SSL that work great. 50:03.060 --> 50:04.380 I mean, SSL is terrific. 50:04.820 --> 50:08.740 SSL, you know, there wouldn't, a lot of e-commerce would have been stalled if it weren't for SSL. 50:09.740 --> 50:13.500 Verisign, though, is in a lot of other businesses besides PKI. 50:13.680 --> 50:22.020 You know, they're in the registry business, they're in the wireless billing business, they're in a lot of business, and also in a lot of security businesses, a lot of outsourced security services. 50:22.360 --> 50:24.720 Um, so Verisign does a lot of good things. 50:24.720 --> 50:32.380 I think PKI is just, was just a technology that was just, uh, you know, never justified it, justified the, uh, the, the hassle. 50:33.500 --> 50:35.660 Okay, thank you. 50:38.040 --> 50:38.680 Quick...