1
00:00:05,550 --> 00:00:06,450
...Tangent.

2
00:00:06,450 --> 00:00:08,970
He apparently is somewhere else.

3
00:00:08,970 --> 00:00:10,970
I happen to be walking by.

4
00:00:11,770 --> 00:00:20,550
And the illustrious group of, you know, representing, I guess corporate America is what you guys represent.

5
00:00:20,550 --> 00:00:21,310
Is that correct?

6
00:00:22,030 --> 00:00:22,690
Okay.

7
00:00:24,110 --> 00:00:24,790
CISO.

8
00:00:24,790 --> 00:00:27,830
They told me they wanted me to go ahead and step up here.

9
00:00:27,830 --> 00:00:33,830
If Dark Tangent comes in, I'll be happy to hand over the process to him.

10
00:00:33,830 --> 00:00:39,270
But in the meantime, this is kind of a... I mean, I literally just walked by.

11
00:00:39,270 --> 00:00:44,250
I have no idea what the panel is about or anything.

12
00:00:44,270 --> 00:00:50,370
Something along the lines of CISOs, and they're going to discuss a number of things.

13
00:00:50,370 --> 00:00:54,110
There's a few sample questions in the book in there.

14
00:00:54,850 --> 00:01:08,530
I think one of the sample questions was how do the panelists feel about security research, its impact upon the economy, impact upon the community.

15
00:01:08,530 --> 00:01:25,070
And I think that's especially timely when you consider what happened at Black Hat with Mike Lynn and the now former ISS employee being sued by a myriad of people, apparently.

16
00:01:26,310 --> 00:01:29,410
So why don't we have someone up here on the panel kind of jump in.

17
00:01:29,410 --> 00:01:32,070
You guys be thinking of questions, too, to ask these people.

18
00:01:32,070 --> 00:01:33,710
Actually, first off, let's just go down the line.

19
00:01:33,710 --> 00:01:37,650
You guys go down the line, introduce yourselves, tell who you are, and then we'll get to the question.

20
00:01:37,790 --> 00:01:38,630
Does that sound okay?

21
00:01:40,570 --> 00:01:45,590
Just name, title, and IP address of your VPN.

22
00:01:45,590 --> 00:01:46,990
Just to...

23
00:01:47,930 --> 00:01:49,090
Qualifications.

24
00:01:49,090 --> 00:01:50,770
Yeah, qualifications, too.

25
00:01:50,770 --> 00:01:52,370
So I'm Justin Semeny.

26
00:02:03,450 --> 00:02:05,530
Obviously, I have everything I can do.

27
00:02:07,380 --> 00:02:08,120
Wow.

28
00:02:08,740 --> 00:02:10,520
It's not working.

29
00:02:16,400 --> 00:02:19,540
I'm Justin Semeny from VeriSign.

30
00:02:19,540 --> 00:02:21,320
So I run information security.

31
00:02:22,280 --> 00:02:23,300
That's it?

32
00:02:23,300 --> 00:02:24,220
Wow.

33
00:02:24,900 --> 00:02:26,180
Qualifications.

34
00:02:26,260 --> 00:02:27,020
What's that?

35
00:02:27,020 --> 00:02:27,340
Qualifications .

36
00:02:27,340 --> 00:02:29,700
He's not qualified.

37
00:02:31,740 --> 00:02:36,000
Pamela Fusco, Chief Information Security Officer, Merck Pharmaceutical.

38
00:02:36,000 --> 00:02:37,580
I'm certifiable.

39
00:02:38,060 --> 00:02:39,140
Who next?

40
00:02:39,620 --> 00:02:42,260
This one?

41
00:02:42,260 --> 00:02:43,220
Yeah.

42
00:02:43,220 --> 00:02:44,420
I'm Scott Blake.

43
00:02:44,420 --> 00:02:47,580
I'm a CISO of Liberty Mutual Insurance Companies.

44
00:02:48,160 --> 00:02:52,720
My background is I was the VP of Information Security at Bindview Corporation.

45
00:02:52,720 --> 00:02:58,840
A couple ex-Bindview people around, I see, founded the Razor Security Research Team.

46
00:02:58,840 --> 00:03:07,160
And so I obviously have a bias for very much in favor of information security research, particularly basic research around vulnerabilities.

47
00:03:07,520 --> 00:03:17,520
I think it's essential to improving the technology that we have to work with as part of the businesses that we're trying to operate.

48
00:03:17,520 --> 00:03:18,960
So I'm all in favor.

49
00:03:23,580 --> 00:03:24,160
Hey.

50
00:03:24,160 --> 00:03:24,460
Hey .

51
00:03:24,460 --> 00:03:25,440
Sorry, I'm late.

52
00:03:25,660 --> 00:03:27,980
I've been distracted by other business.

53
00:03:29,640 --> 00:03:31,520
I've got these slides up here, but I...

54
00:03:32,500 --> 00:03:32,820
Doesn't

55
00:03:36,590 --> 00:03:37,170
work.

56
00:03:37,170 --> 00:03:38,030
Doesn't work?

57
00:03:38,070 --> 00:03:39,470
Doesn't work.

58
00:03:40,930 --> 00:03:42,850
So you got through the introductions?

59
00:03:43,510 --> 00:03:43,930
No.

60
00:03:43,930 --> 00:03:44,750
Still going?

61
00:03:45,090 --> 00:03:46,410
Oh, okay.

62
00:03:47,270 --> 00:03:48,490
Thanks, Pam.

63
00:03:49,050 --> 00:03:50,370
Proud to serve.

64
00:03:52,610 --> 00:03:53,750
Hi, I'm David Mortman.

65
00:03:53,750 --> 00:03:56,170
I'm the Chief Information Security Officer for Siebel Systems.

66
00:03:56,170 --> 00:04:00,930
Most of you have the pleasure of having your personal information in one of my systems at one of these people's companies.

67
00:04:00,930 --> 00:04:02,890
So that's why I'm here.

68
00:04:04,530 --> 00:04:09,410
I'm Ken Files, CSO, Capital IQ, a division of Standard & Poor's.

69
00:04:10,810 --> 00:04:14,190
I'm Andre Gold, Director of Information Security for Kynan Airlines.

70
00:04:15,630 --> 00:04:22,050
And I'm Paul Simmons, CISO of ICI, and I sit on the board of the Jericho Forum.

71
00:04:22,050 --> 00:04:24,630
I think people were asking... you were asking about qualifications.

72
00:04:24,810 --> 00:04:28,530
The only qualification I hold is I'm a qualified whitewater canoe instructor.

73
00:04:32,210 --> 00:04:33,650
Okay, sorry I was late.

74
00:04:34,110 --> 00:04:36,330
Typically when we... we've tried this in the past.

75
00:04:36,330 --> 00:04:41,710
I had all these really nice questions and tried to get them off on certain topics.

76
00:04:41,890 --> 00:04:44,150
And we didn't have a lot of time for questions and answers.

77
00:04:44,190 --> 00:04:47,850
So this time I'm going to try something different, which is a lot more audience participation.

78
00:04:47,850 --> 00:04:50,310
I have a couple of questions for them first.

79
00:04:50,510 --> 00:04:52,650
And then we're going to let them talk about it for a while.

80
00:04:52,650 --> 00:04:53,690
I only have two or three.

81
00:04:53,690 --> 00:04:55,690
And then we're going to open it up to the general audience.

82
00:04:55,810 --> 00:05:03,190
And then my job is just to make sure that if you ask like a 30 second question, I'm going to distill it down into like a four second question.

83
00:05:03,190 --> 00:05:04,810
So keep that in mind.

84
00:05:06,250 --> 00:05:08,010
Okay, hey, so question.

85
00:05:08,150 --> 00:05:09,470
Would you hire hackers?

86
00:05:09,790 --> 00:05:14,030
How does the word hacker influence your hiring decision?

87
00:05:14,030 --> 00:05:18,430
Or are you purely concerned about criminal backgrounds?

88
00:05:21,130 --> 00:05:31,210
I mean, if somebody comes to you like a hobbit and says, I'm a self-described gray-bearded Unix hacker, whoever's got the most serious feelings about this?

89
00:05:31,210 --> 00:05:33,510
Well, I've hired a lot of hackers in my time.

90
00:05:33,510 --> 00:05:37,350
So I am very much in favor of using hackers.

91
00:05:37,350 --> 00:05:40,790
And I use the term really in the old school sense.

92
00:05:40,790 --> 00:05:50,010
I mean, we're talking about people who break things for the purpose of knowledge, who generate new knowledge about systems and software and what have you.

93
00:05:50,010 --> 00:05:54,090
And that's essential for doing security research.

94
00:05:54,150 --> 00:06:02,710
However, I would also add to that, that I would not ever recommend hiring a criminal.

95
00:06:03,070 --> 00:06:08,270
Now where the line gets drawn is sometimes a little bit fuzzy, but that may be a whole other discussion.

96
00:06:08,270 --> 00:06:14,110
I mean, would you do a Google search on their hacking handle and see if it pops up on some Chinese defacement team?

97
00:06:14,530 --> 00:06:31,860
I would definitely look at published research that somebody has done, and look at what participation in discussion lists, whether they've contributed positively to the community or not, and if there's somebody who has respect to their peers and so forth.

98
00:06:32,890 --> 00:06:48,100
I would not intentionally dig deep into other activities beyond those positive contributions to the research community, other than a criminal background check.

99
00:06:50,280 --> 00:06:52,340
I've hired people who've gone bad.

100
00:06:52,420 --> 00:06:55,700
So they were good when they came, and then they went to the other side.

101
00:06:55,780 --> 00:06:57,640
And the other thing is, I would do a Google search...

102
00:06:57,640 --> 00:06:59,460
Was it because they were reading 2600 or something?

103
00:06:59,460 --> 00:07:01,020
Because I'm really tough, man.

104
00:07:02,080 --> 00:07:06,380
No, and the other thing is, I would do a Google search, but if they're good, I'm not going to find it anyway.

105
00:07:08,020 --> 00:07:10,300
Yeah, I don't hire hackers.

106
00:07:10,300 --> 00:07:11,860
I hire intelligent people.

107
00:07:11,860 --> 00:07:15,760
And if the two kind of correlate to each other, then so be it.

108
00:07:16,020 --> 00:07:19,660
So you think this whole debate about hiring hackers is a non-issue, pretty much?

109
00:07:19,660 --> 00:07:26,620
I've got a 13-year-old daughter, so I'm pretty much well-tuned with that.

110
00:07:28,780 --> 00:07:34,100
There's a media misconception, I think that's out there, that hacker correlates to criminal.

111
00:07:34,640 --> 00:07:44,760
Which I think most of us would hopefully agree is wrong, that there may be certainly examples of correlation, but that doesn't necessarily prove the rule.

112
00:07:44,760 --> 00:07:46,340
It's sort of like a plumber, right?

113
00:07:46,340 --> 00:07:50,460
You can have a plumber, or you can have a criminal plumber, but they're still basically a plumber.

114
00:07:50,580 --> 00:07:53,130
So yeah, you can be a criminal hacker, or you can be a...

115
00:07:54,620 --> 00:07:59,740
Yeah, over in the UK we have a thing called check certification.

116
00:07:59,740 --> 00:08:01,980
I don't know if anyone here is check certified.

117
00:08:02,780 --> 00:08:06,880
Basically what it means, it's the only certification, as far as I know, in the world for hacking.

118
00:08:07,560 --> 00:08:10,480
And it's actually sponsored by the UK government.

119
00:08:10,780 --> 00:08:14,400
And it means that you're cleared to hack UK government systems.

120
00:08:14,460 --> 00:08:19,340
And that means they've done a background check, and they're happy with you working on government systems.

121
00:08:19,600 --> 00:08:21,260
And personally that's good enough for me.

122
00:08:21,260 --> 00:08:23,600
If you're check certified, I'll hire you anytime.

123
00:08:25,640 --> 00:08:27,980
Anybody have any questions or comments on that?

124
00:08:28,760 --> 00:08:30,600
Yeah, you in the red, please.

125
00:08:56,610 --> 00:09:02,050
So the question was, there was a presenter at Black Hat who was fired for giving his talk.

126
00:09:02,050 --> 00:09:05,350
And he quit two hours before his talk, apparently, but he wasn't fired.

127
00:09:05,350 --> 00:09:09,370
But had he not quit, he would have been fired.

128
00:09:09,370 --> 00:09:17,450
And the question was, would somebody like that have any hiring prospects at companies represented by these types?

129
00:09:17,730 --> 00:09:19,050
I'll answer that.

130
00:09:19,930 --> 00:09:21,570
Yes, I would hire him.

131
00:09:23,270 --> 00:09:26,670
Because I don't consider him to be a criminal.

132
00:09:27,030 --> 00:09:32,050
I consider him to be someone who has brought something to someone's attention.

133
00:09:32,410 --> 00:09:34,850
And he's gotten quite a bit of attention over it.

134
00:09:34,850 --> 00:09:39,190
But I think that we all learn from what has happened in the past, and I hope that we move forward.

135
00:09:39,190 --> 00:09:41,850
So I think that he's a qualified individual.

136
00:09:42,150 --> 00:09:48,630
And if I had a position and he passed the HR criminal blah, blah, blah, he would be gainfully employed.

137
00:09:49,970 --> 00:09:51,230
Anybody else?

138
00:09:52,050 --> 00:09:53,670
I just second it.

139
00:09:54,050 --> 00:09:57,950
Insofar as there was a call for security research.

140
00:09:57,950 --> 00:10:00,050
I don't currently run a security research team.

141
00:10:00,110 --> 00:10:01,870
But if I did, then sure.

142
00:10:02,330 --> 00:10:03,730
With the same caveat.

143
00:10:04,170 --> 00:10:06,210
I think there's another question over here.

144
00:10:06,310 --> 00:10:06,870
Sir?

145
00:10:30,270 --> 00:10:31,770
What are your peers up to?

146
00:10:31,770 --> 00:10:33,110
Are they hiding from this issue?

147
00:10:33,110 --> 00:10:34,290
Are they indifferent?

148
00:10:34,690 --> 00:10:37,810
I think it's our responsibility to bring security to their attention.

149
00:10:37,810 --> 00:10:39,070
That's what they pay me for.

150
00:10:39,070 --> 00:10:41,610
And I'm lucky in that respect.

151
00:10:41,610 --> 00:10:44,830
I get quite a bit of support from the executive staff.

152
00:10:45,250 --> 00:10:50,250
And I think that they would trust the opinion of what I'm bringing to the table.

153
00:10:50,250 --> 00:10:53,290
But I also trust, it's not just me, it's my team.

154
00:10:53,430 --> 00:10:58,250
And I have about five people in this room that come with me to Black Hat and to DEF CON.

155
00:10:58,250 --> 00:10:59,630
And I trust them.

156
00:10:59,690 --> 00:11:02,170
And if they're, you know, they're going to be working with these people.

157
00:11:02,350 --> 00:11:04,910
I just sign the paperwork and pay the bills, right?

158
00:11:04,910 --> 00:11:10,370
So if they're in agreement that an individual such as that is welcome on the team, I'll be damned.

159
00:11:10,370 --> 00:11:13,430
Then I'll take it to the highest level I need to to get the person hired.

160
00:11:15,350 --> 00:11:17,890
One more question, we'll move on to a new one.

161
00:11:17,890 --> 00:11:18,250
Sir ?

162
00:11:21,570 --> 00:11:23,770
I'm sorry, talk a bit louder, please.

163
00:11:34,660 --> 00:11:38,480
Well, that's a broader question than whether or not they're going to hire hackers.

164
00:11:38,480 --> 00:11:39,600
It's a privacy question.

165
00:11:40,260 --> 00:11:42,880
We could ask them about the Patriot Act later, that's not a problem.

166
00:11:42,880 --> 00:11:45,500
But is it a hiring a hacker related type question?

167
00:11:47,520 --> 00:11:48,380
What's that?

168
00:11:49,700 --> 00:11:51,760
That has violated the Patriot Act?

169
00:11:59,930 --> 00:12:02,790
It's being done every five seconds.

170
00:12:02,790 --> 00:12:06,430
I mean, plenty of people are hacking every day and they're not being busted on the Patriot Act.

171
00:12:09,630 --> 00:12:11,550
Okay, so let's move on to the next...

172
00:12:11,550 --> 00:12:13,070
Oh, do you have one more question, sir?

173
00:12:38,490 --> 00:12:39,610
Right, right.

174
00:12:39,610 --> 00:12:41,830
And I think there's a question on this earlier.

175
00:12:41,830 --> 00:12:45,410
His question was, how do you rate private versus professional experience?

176
00:12:45,450 --> 00:12:47,910
Versus maybe academic security experience?

177
00:12:47,910 --> 00:12:50,570
And weigh that in a hiring type decision?

178
00:12:50,610 --> 00:12:53,750
And it also kind of relates to what we talked about earlier, which is certification.

179
00:12:53,990 --> 00:13:01,370
You know, would you hire somebody with a CISSP or a security MCSE over somebody with nothing?

180
00:13:01,590 --> 00:13:04,030
So, from

181
00:13:07,790 --> 00:13:11,590
my perspective, actually, work experience...

182
00:13:12,670 --> 00:13:14,170
Would you turn it off again?

183
00:13:14,170 --> 00:13:15,150
No, you have to be really close to me.

184
00:13:15,470 --> 00:13:18,590
So the work experience actually means a lot.

185
00:13:18,610 --> 00:13:25,630
When we get specific down into the skill sets of actually hacking or breaking applications or breaking OSs or networks, etc.

186
00:13:25,770 --> 00:13:33,630
I agree, there's not really a lot of corporate jobs that you can actually reference on a resume in order to prove those skill sets.

187
00:13:33,630 --> 00:13:36,630
A lot of that actually just comes out in the interview process.

188
00:13:36,750 --> 00:13:40,390
You break them down and be able to say, how would you do X, Y, and Z?

189
00:13:40,390 --> 00:13:44,890
Or what is your mentality or thought process going through an actual attack?

190
00:13:44,890 --> 00:13:48,090
And making sure that it's mature and it's done in a well-defined manner.

191
00:13:48,090 --> 00:13:51,350
And it's not a script-kitty kind of attack.

192
00:13:51,350 --> 00:13:54,870
It's actually very well thought out and very detailed.

193
00:13:56,250 --> 00:13:58,750
I mean, so just to expand on that a little bit.

194
00:13:59,870 --> 00:14:07,310
Degrees, certifications, they hold their place in a sense that you have concepts as well as degrees.

195
00:14:07,310 --> 00:14:12,350
And our organization as well allows for mobility up that corporate ladder, so to speak, as well.

196
00:14:12,350 --> 00:14:21,670
But when I'm out there like Pam said and everything else, looking to bring on people to augment my staff or respective duties and everything else, it's all about the experience.

197
00:14:21,750 --> 00:14:27,530
I mean, the degrees and those type of things, they're okay, but they're kind of like the last thing that I look at.

198
00:14:27,530 --> 00:14:29,550
It's like, okay, where has this guy or girl been?

199
00:14:29,550 --> 00:14:31,790
What have they done and what can they bring to the organization?

200
00:14:33,530 --> 00:14:36,850
Half the people in my team don't actually have degrees of any sort.

201
00:14:36,850 --> 00:14:38,790
I think they have high school degrees probably.

202
00:14:40,590 --> 00:14:45,870
Work experience is more of a metric for getting the resumes onto my desk than for actually as a hiring metric at that point.

203
00:14:46,390 --> 00:14:51,450
More important than actually even experience for me and my team is just getting the ideas.

204
00:14:51,650 --> 00:14:53,430
I can teach them the technical skills they need to have.

205
00:14:53,430 --> 00:14:55,530
I can teach them the project management skills they need.

206
00:14:55,530 --> 00:15:03,250
But if they just don't get it, they don't get the idea of security, they don't get the idea of risk management, it doesn't matter if they've been doing this for 10 years or if they have a PhD in computer science.

207
00:15:03,250 --> 00:15:04,150
I don't care.

208
00:15:08,170 --> 00:15:21,970
Getting this back to reality, the bottom line is when you're faced with 600 or 800 CVs on your desk or certainly going through a human resources department, you go degree, no degree, degree, no degree, degree, no degree.

209
00:15:22,490 --> 00:15:28,670
Ultimately, a relevant degree says that you are capable of a certain degree of learning.

210
00:15:29,050 --> 00:15:34,710
And yeah, absolutely, you bring them into your business and you teach them and you put them on training courses and everything else.

211
00:15:34,710 --> 00:15:39,490
But the degree says at least they have the capability and the wherewithal to go out and learn new skills.

212
00:15:39,490 --> 00:15:44,430
And it might not be perfect, but it is generally a fact of life in the corporate world.

213
00:15:44,950 --> 00:15:49,270
The other qualification I tack onto that is publications.

214
00:15:49,790 --> 00:16:06,550
For someone who's going to be doing research or red team kinds of activities, I would want to see published new vulnerabilities or published papers on techniques, things like that, as part of the qualification, seconding the other things that have been said.

215
00:16:06,550 --> 00:16:08,250
Degrees do count, unfortunately.

216
00:16:11,250 --> 00:16:15,250
I think one thing being left out of the equation is attitude also.

217
00:16:15,850 --> 00:16:19,070
If you've got the worst attitude and you're the best hacker, I don't want you.

218
00:16:19,070 --> 00:16:21,610
If you can't play well with others, I don't want you.

219
00:16:26,650 --> 00:16:30,610
We'll have one last question and then we'll move on to a new topic.

220
00:16:49,990 --> 00:16:55,690
I think you've got to let them devote a certain amount of their time.

221
00:16:56,070 --> 00:17:02,070
I don't have my folks doing 100% of their focused time on one particular task.

222
00:17:02,070 --> 00:17:05,470
I let them work in different areas of security.

223
00:17:05,470 --> 00:17:10,690
We provide them with the training that they'd like to go to within reason.

224
00:17:11,530 --> 00:17:13,290
Those are just a few of the things.

225
00:17:13,290 --> 00:17:19,770
We also do peer training and sit-downs, lunches, outings, that sort of thing.

226
00:17:20,770 --> 00:17:22,450
Send them to DEF CON.

227
00:17:23,110 --> 00:17:24,070
Thanks, Pam.

228
00:17:25,970 --> 00:17:33,870
Next topic is kind of near and dear to my heart, related to the whole Enron case, and that's data retention.

229
00:17:33,870 --> 00:17:38,990
In the wake of Microsoft, how long do you keep data?

230
00:17:38,990 --> 00:17:46,370
Do you do it as a defensive measure against lawsuit, or is it just sheer log bloat?

231
00:17:46,530 --> 00:17:51,730
What's your overall thought on log retention, data retention?

232
00:17:51,730 --> 00:17:52,450
Anybody?

233
00:17:52,870 --> 00:17:54,870
I'll jump in here.

234
00:17:55,150 --> 00:18:03,030
Log retention, or data retention more specifically, can actually be driven more by external legislation.

235
00:18:03,030 --> 00:18:07,890
Be it credit card information, personal information, et cetera.

236
00:18:07,890 --> 00:18:14,230
So there's a lot of limitations and requirements on how long we have to hold it and when we actually have to delete it.

237
00:18:14,370 --> 00:18:21,430
Outside of that, the perspective is basically, on a yearly time frame, we go through most of the data.

238
00:18:22,870 --> 00:18:33,130
The main reason for keeping the data is not only providing a service from the application side, but it's also being able to go back in time for issues like litigation.

239
00:18:34,190 --> 00:18:37,070
So would you say a year, six months, ten years?

240
00:18:37,070 --> 00:18:38,330
I would say about a year.

241
00:18:38,330 --> 00:18:43,450
There are certain things that we have that definitely go beyond that, but about a year is pretty much the baseline.

242
00:18:44,130 --> 00:18:52,690
Unfortunately, we delete data a lot sooner than that, unless there are regulatory requirements around that data.

243
00:18:52,690 --> 00:18:56,490
Data has proven to be a liability to us as well within court.

244
00:18:56,490 --> 00:19:05,770
And so our legal department actually comes down and mandates that data over the 60 days actually be removed and be expunged from the environment.

245
00:19:06,030 --> 00:19:16,830
Our data retention policy is about 80 pages, and it's driven by a wide variety of state and federal legislation for different types of information.

246
00:19:18,130 --> 00:19:22,850
And there are a lot of different things, and everything has its own rules for how it gets...

247
00:19:22,850 --> 00:19:24,750
So it's a total nightmare mess.

248
00:19:25,350 --> 00:19:28,430
I wouldn't call it a nightmare, but it's complex.

249
00:19:29,010 --> 00:19:42,150
Yeah, I mean, we're driven by legislation, and we've got places, because we're a chemical company, where we have to keep data on people, and particularly their state of health, for ten years after they die.

250
00:19:42,150 --> 00:19:49,690
So potentially, that's up to 100 years, which is a real issue because, of course, media changes the whole time.

251
00:19:49,690 --> 00:19:51,630
Media doesn't have a 100-year lifetime.

252
00:19:51,630 --> 00:19:53,730
I was going to say, you've got a lot of money in MacStore and Hitachi, then.

253
00:19:53,850 --> 00:19:55,210
We're going back to microfiche.

254
00:19:55,210 --> 00:19:57,710
Microfiche is about the only thing that actually works properly.

255
00:20:00,410 --> 00:20:01,730
Okay, sir.

256
00:20:09,120 --> 00:20:13,620
The question is, how many of you have assigned policies dictating how long you'll keep the data?

257
00:20:13,700 --> 00:20:14,380
Signed policy?

258
00:20:14,380 --> 00:20:15,520
Yeah, signed policy.

259
00:20:15,680 --> 00:20:16,380
Everybody.

260
00:20:16,860 --> 00:20:29,880
We keep data 100 years in the pharmaceutical industry, which is crazy, because when you store data 100 years from now, the technology that we used in, like, you know, 1801, it doesn't exist in 2005.

261
00:20:36,410 --> 00:20:38,110
I'm sorry, who's speaking now?

262
00:20:38,270 --> 00:20:39,510
Stand up, please.

263
00:20:39,570 --> 00:20:40,710
Oh, okay.

264
00:20:43,630 --> 00:20:46,270
So the question is, how do you secure that data once it's archived?

265
00:20:46,270 --> 00:20:50,450
Do you put it in a big hole in the wall, or do you... hole in the ground?

266
00:20:50,910 --> 00:20:51,670
Salt mines.

267
00:20:51,670 --> 00:20:52,390
Salt mines.

268
00:20:52,390 --> 00:20:54,570
Salt mines are really good.

269
00:20:56,510 --> 00:20:57,350
Sunglasses?

270
00:21:07,060 --> 00:21:07,640
Right, right.

271
00:21:07,640 --> 00:21:11,600
So now that you're storing data for 100 years or whatever, does it ever come in handy?

272
00:21:11,600 --> 00:21:13,580
Have you ever actually used it for anything?

273
00:21:14,340 --> 00:21:17,100
Ten years, but we were founded in 95, so...

274
00:21:19,440 --> 00:21:23,080
I think the furthest we've had to go back is in the order of about 30 years.

275
00:21:23,200 --> 00:21:25,140
We were founded in 1928.

276
00:21:25,820 --> 00:21:27,900
What was the circumstance for that?

277
00:21:27,900 --> 00:21:33,360
It was a health claim against us for a disease that they developed, and they blamed it on us.

278
00:21:33,820 --> 00:21:34,860
It wasn't me.

279
00:21:36,660 --> 00:21:38,960
It didn't... they didn't win it.

280
00:21:40,300 --> 00:21:46,040
I don't know what the exact number is for us, but the company was founded in 1912, and we sell life insurance and have since then.

281
00:21:46,040 --> 00:21:48,600
So, probably that far back.

282
00:21:56,930 --> 00:21:58,010
General counsel.

283
00:21:58,150 --> 00:21:58,950
Legal.

284
00:22:00,150 --> 00:22:03,090
Pretty much everybody raise your hand if it's driven by legal.

285
00:22:03,470 --> 00:22:04,290
Yeah.

286
00:22:05,290 --> 00:22:07,830
If you could have your way, would you get rid of it?

287
00:22:09,070 --> 00:22:09,690
No.

288
00:22:09,690 --> 00:22:12,350
So you think it is in the appropriate position.

289
00:22:12,350 --> 00:22:14,830
So that's totally the correct location for that.

290
00:22:14,830 --> 00:22:15,450
Okay.

291
00:22:22,390 --> 00:22:23,310
Absolutely.

292
00:22:29,640 --> 00:22:35,860
Yeah, the data retention policies dictate not only how long to retain, but also when to destroy.

293
00:22:35,860 --> 00:22:42,800
So a lot of our policies are written in terms of the maximum retention period, not only the minimum required retention period.

294
00:22:42,800 --> 00:22:44,860
And when you reach those maximums, you just purge.

295
00:22:44,860 --> 00:22:45,260
Yep.

296
00:22:45,260 --> 00:22:49,300
And hopefully that Stone Mountain place doesn't have your hands on their tapes, right?

297
00:22:49,620 --> 00:22:51,340
They probably lost it anyway.

298
00:23:01,080 --> 00:23:08,360
Do you think that the burden or the overhead impaired by performing these retention policies is a burden on the business function?

299
00:23:12,130 --> 00:23:12,750
Yeah.

300
00:23:13,650 --> 00:23:18,970
At ICI Corporate Centre in London, we have a 15-month deletion policy on email.

301
00:23:19,270 --> 00:23:24,810
And basically we force our employees, when it comes up to 15 months, to actually sort it, go through it.

302
00:23:24,810 --> 00:23:25,730
This is automated.

303
00:23:25,730 --> 00:23:28,450
It puts it into a bucket and says, you will sort this.

304
00:23:29,350 --> 00:23:41,650
And you're forced to go through and either delete it or put it into the archiving system, at which point you have to give it a title, a date, what it's about, and when it needs to be deleted automatically.

305
00:23:41,790 --> 00:23:42,950
But yeah, absolutely.

306
00:23:42,990 --> 00:23:46,530
You can work on projects for three years in some cases.

307
00:23:46,530 --> 00:23:47,640
So yeah, it's a real problem.

308
00:23:48,150 --> 00:23:54,090
There are certain issues where we have internal monitoring projects to monitor individual activity.

309
00:23:54,210 --> 00:23:57,850
And we actually have a very short retention for that data.

310
00:23:57,850 --> 00:24:01,090
Obviously, there's a lot of personal stuff going through the network.

311
00:24:01,090 --> 00:24:09,390
And we do have investigations that we need to go back a year to really see what the full activity of a particular individual is.

312
00:24:09,390 --> 00:24:13,890
So that would be one of the cases that we would have that it would impede what we do personally.

313
00:24:13,890 --> 00:24:27,530
From a business standpoint, I mean, really the federal requirements or the industry requirements on data retention that are applicable to us really kind of really has changed the business and how they perform the service.

314
00:24:27,530 --> 00:24:29,950
So not really from a service standpoint.

315
00:24:31,230 --> 00:24:33,070
Okay, I've got one more question.

316
00:24:33,070 --> 00:24:34,070
Oh, sir.

317
00:24:42,590 --> 00:24:45,910
So the question is, are there data privacy laws surrounding how you retain the data?

318
00:24:45,910 --> 00:24:47,250
Do you have to keep it encrypted?

319
00:24:47,410 --> 00:24:48,210
Rot13?

320
00:24:48,330 --> 00:24:50,310
You know, how do you keep it encrypted?

321
00:24:50,670 --> 00:24:52,770
The paper files are really hard to encrypt.

322
00:24:52,770 --> 00:24:53,670
Rot12 , its successor.

323
00:24:53,830 --> 00:24:54,230
Yeah .

324
00:24:56,310 --> 00:24:59,430
So you say microfiche, and then you physically have control of it.

325
00:24:59,430 --> 00:25:01,830
And then you put it somewhere and hope it doesn't burn down.

326
00:25:01,870 --> 00:25:09,250
So when you look at things like PCI, or Visa's MasterCard certification program, where they actually require the encryption of credit card data.

327
00:25:09,530 --> 00:25:11,670
Well, for the companies that do it.

328
00:25:13,330 --> 00:25:14,490
We all do.

329
00:25:14,490 --> 00:25:15,210
Absolutely.

330
00:25:16,510 --> 00:25:24,830
Basically, going back to the point, I think the encryption of the actual data on the tapes before they're shipped out is very important.

331
00:25:24,870 --> 00:25:31,830
The encryption of the data within the database is, even though they're running in production, like the credit card data, social security numbers, et cetera.

332
00:25:31,830 --> 00:25:36,910
I mean, it's absolutely imperative that we do that because application security is getting a lot more dangerous nowadays.

333
00:25:37,230 --> 00:25:41,090
And without it, it's just a recipe for disaster.

334
00:25:41,370 --> 00:25:47,810
So from a data encryption perspective, it also depends on what the data is and where the data is going.

335
00:25:47,810 --> 00:25:50,190
So there's encryption regulations.

336
00:25:50,190 --> 00:25:52,290
Data in transit needs to be encrypted.

337
00:25:52,290 --> 00:25:54,750
But in some cases, data at rest does not.

338
00:25:54,750 --> 00:25:59,410
There's also, because we're international, different encryption laws.

339
00:25:59,410 --> 00:26:02,170
Paris is different than what we do in Germany.

340
00:26:02,690 --> 00:26:03,950
Location of the data.

341
00:26:03,950 --> 00:26:06,010
There's no off-site storage in Germany.

342
00:26:06,010 --> 00:26:06,570
And I may be wrong.

343
00:26:06,570 --> 00:26:07,230
It may have changed.

344
00:26:07,230 --> 00:26:08,530
But last I checked, it wasn't.

345
00:26:08,530 --> 00:26:15,870
So we have to be very careful when we're talking about what we're doing with what parts of the data and with what region specific as well.

346
00:26:16,510 --> 00:26:17,950
And which algorithms.

347
00:26:19,910 --> 00:26:21,530
So Jeff's a little busy.

348
00:26:21,950 --> 00:26:22,530
Sorry.

349
00:26:22,530 --> 00:26:26,130
Yeah, there's some action going around pool two right now I needed to know about.

350
00:26:27,850 --> 00:26:29,830
I'll chime in on that if I could, actually.

351
00:26:29,830 --> 00:26:30,530
Pool two action?

352
00:26:31,090 --> 00:26:32,930
No, not that.

353
00:26:33,670 --> 00:26:36,370
I mean, I don't know if anyone remembers the quote.

354
00:26:36,470 --> 00:26:37,610
I don't know if Bruce is here.

355
00:26:37,610 --> 00:26:43,870
But it was, if you think encryption will solve your problem, you don't understand encryption and you don't understand your problem.

356
00:26:43,950 --> 00:26:45,310
It's a great quote.

357
00:26:45,870 --> 00:26:49,350
And I think if we look carefully, I have to disagree with Justin a little bit.

358
00:26:49,350 --> 00:26:59,330
But if we look carefully at some of the issues where we look at how things are needing to be encrypted or whether they should be encrypted, look at something like backup tapes.

359
00:26:59,570 --> 00:27:05,850
Backup tapes, it's a great idea to store them in an encrypted format until you need to actually restore from the tape.

360
00:27:06,550 --> 00:27:10,010
Then you have a problem because you need to decrypt that information.

361
00:27:10,570 --> 00:27:15,090
And now that, depending on where you are, I mean, if it was just a simple drive failure, then that's fine.

362
00:27:15,090 --> 00:27:21,250
But if your data center exploded and all your key material was there, you have a major problem.

363
00:27:21,330 --> 00:27:22,710
So where are you going to store the key material?

364
00:27:22,710 --> 00:27:24,690
Well, the safe place to store it is with the tape.

365
00:27:24,710 --> 00:27:26,070
So what's the point of that?

366
00:27:26,430 --> 00:27:29,010
You've got your key taped to the tape.

367
00:27:29,230 --> 00:27:32,490
And so you can be sure that you'll be able to get the data back off of it.

368
00:27:32,490 --> 00:27:36,110
And the guy who designed the key system is retired last year.

369
00:27:36,210 --> 00:27:36,870
Exactly.

370
00:27:37,030 --> 00:27:40,190
10, 20 years down the road, how are you going to do that?

371
00:27:40,190 --> 00:27:44,910
You look at some of the application things, especially encrypting data at rest in a database.

372
00:27:45,010 --> 00:27:50,870
Something on that application server or database server knows how to decrypt that data or it's completely useless.

373
00:27:50,990 --> 00:27:55,910
The problem then for the folks in the room becomes find that piece of software and control it.

374
00:27:55,950 --> 00:27:57,250
It's sitting in memory.

375
00:27:57,250 --> 00:27:58,670
The key is sitting in memory somewhere.

376
00:27:58,670 --> 00:27:58,890
Wherever it is.

377
00:27:58,890 --> 00:27:59,570
It could be anywhere.

378
00:27:59,570 --> 00:28:03,030
It could be sitting on a smart card that's plugged into the machine.

379
00:28:03,030 --> 00:28:05,310
But something knows how to get it.

380
00:28:05,390 --> 00:28:08,970
Some piece of code on that machine knows how to decrypt the information that's in that database.

381
00:28:08,970 --> 00:28:11,110
And somebody's going to be able to figure out how to get it off.

382
00:28:11,310 --> 00:28:17,310
Well, I guess the point of the encryption of the tapes is not necessarily for protection.

383
00:28:18,450 --> 00:28:21,290
It's not necessarily the encryption on the tapes.

384
00:28:21,290 --> 00:28:25,170
It's more so protecting it when that data is in someone else's hands.

385
00:28:26,590 --> 00:28:28,750
We don't put our keys on our tapes.

386
00:28:28,930 --> 00:28:30,350
And it is a problem.

387
00:28:30,350 --> 00:28:33,310
There's no question about it in regards to how you manage those keys.

388
00:28:35,110 --> 00:28:38,670
For us, we've had a little bit of experience in the keys.

389
00:28:38,670 --> 00:28:41,670
How we actually have a distributed model and how we actually put it out.

390
00:28:41,670 --> 00:28:45,010
But yeah, to your point, there are some fundamental flaws.

391
00:28:45,010 --> 00:28:47,990
But you really have to understand your use case for encryption.

392
00:28:48,190 --> 00:28:52,910
And if you think encryption is going to protect you from everything, I absolutely agree.

393
00:28:52,910 --> 00:28:54,530
You don't understand encryption.

394
00:28:55,210 --> 00:28:57,170
Okay, this is the last one on this topic.

395
00:28:57,170 --> 00:28:59,850
We can revisit it when we go to general questions and answers.

396
00:29:04,150 --> 00:29:07,750
How do you deal with...

397
00:29:08,310 --> 00:29:11,430
Right, so we talked about this briefly, but how do you deal with obsolescence?

398
00:29:11,430 --> 00:29:17,290
Are you constantly updating your backup technology and taking all your tapes from five years ago and updating today's technology?

399
00:29:17,290 --> 00:29:20,890
Do you go through this rev cycle every five years?

400
00:29:20,890 --> 00:29:22,910
Do you decide it's time to re-upgrade everything?

401
00:29:24,390 --> 00:29:25,110
Anybody?

402
00:29:25,470 --> 00:29:27,070
I'll say it again, microfiche.

403
00:29:27,270 --> 00:29:28,910
Microfiche is where it's at, guys.

404
00:29:29,370 --> 00:29:33,170
We have seriously looked at it because we've got this requirement for 100 years plus storage.

405
00:29:33,170 --> 00:29:34,850
We have seriously looked at the problem.

406
00:29:36,090 --> 00:29:37,890
Do you do it in machine code?

407
00:29:37,890 --> 00:29:39,070
I mean, how is it machine readable?

408
00:29:39,070 --> 00:29:41,190
Is it in 3D barcode?

409
00:29:41,190 --> 00:29:42,150
No, we print it.

410
00:29:43,390 --> 00:29:48,410
You print it onto A4 paper in our case, or letter paper in your case.

411
00:29:48,490 --> 00:29:51,110
And you photograph it and put it onto these...

412
00:29:51,110 --> 00:29:56,350
Right, and the printout is encoded in a printed format in what, a 3D barcode?

413
00:29:56,350 --> 00:29:57,910
A giant full page 3D barcode?

414
00:29:57,910 --> 00:29:59,890
Is it ones and zeros on the whole page?

415
00:30:00,030 --> 00:30:03,410
No, no, no, it's their data.

416
00:30:03,410 --> 00:30:07,430
If they filled in a form, we print the form and we microfiche it.

417
00:30:07,430 --> 00:30:08,470
Oh, I see, I see.

418
00:30:09,930 --> 00:30:11,070
Blow it up.

419
00:30:12,610 --> 00:30:15,590
Well, I'm just wondering what my Microsoft...

420
00:30:18,370 --> 00:30:21,110
So you're saying it's definitely not Unicode, right?

421
00:30:21,490 --> 00:30:22,830
No, definitely not, Jeff.

422
00:30:24,530 --> 00:30:25,830
So do you print it?

423
00:30:25,830 --> 00:30:28,510
Yeah, I'm just wondering, how do you print Microsoft Word binary?

424
00:30:30,070 --> 00:30:31,470
With great difficulty.

425
00:30:31,470 --> 00:30:32,250
Print it.

426
00:30:32,250 --> 00:30:32,810
Hit print.

427
00:30:32,810 --> 00:30:35,390
And it comes out squiggle question mark space space dash.

428
00:30:36,990 --> 00:30:40,610
No, we're talking the application Microsoft Word, the application.

429
00:30:41,210 --> 00:30:42,290
You don't care.

430
00:30:42,290 --> 00:30:43,270
Okay, okay.

431
00:30:43,270 --> 00:30:44,610
So it's in hex.

432
00:30:44,610 --> 00:30:45,550
It's in hex.

433
00:30:49,610 --> 00:31:00,850
Well, the only reason I'm wondering is because years ago some guy sold an application that would 3D encode your application, print it out on your Epson FX80 printer, and then all you have to do is re-scan it in, and you would have incredible data densities,

434
00:31:00,850 --> 00:31:04,710
because basically each dot on the data matrix printer was, you know, one or zero.

435
00:31:04,710 --> 00:31:07,050
And they were claiming this thousand-year thing.

436
00:31:07,050 --> 00:31:10,290
With a basic algorithm, you could reconstruct the data whenever you wanted.

437
00:31:10,290 --> 00:31:12,830
It has built-in CRC checking and redundancy.

438
00:31:12,830 --> 00:31:14,570
But they only had it on floppy.

439
00:31:14,970 --> 00:31:15,910
Yeah, okay.

440
00:31:15,910 --> 00:31:16,930
They only sold it on floppy disks.

441
00:31:16,930 --> 00:31:19,390
But the business doesn't care about storing the application.

442
00:31:19,390 --> 00:31:20,410
They only care about the data.

443
00:31:20,690 --> 00:31:27,470
So the data gets printed out in a report, and it's paper or microfiche or whatever, and it's the data that gets stored.

444
00:31:27,470 --> 00:31:28,450
So, okay.

445
00:31:28,450 --> 00:31:31,170
I'm just concerned that you have the data but nothing to interpret it.

446
00:31:31,410 --> 00:31:32,350
You have people.

447
00:31:32,370 --> 00:31:33,490
It's in English.

448
00:31:33,710 --> 00:31:34,330
Okay.

449
00:31:34,950 --> 00:31:35,670
Right?

450
00:31:38,730 --> 00:31:40,150
You want to back up the...

451
00:31:50,820 --> 00:31:52,680
I think we addressed this.

452
00:31:53,140 --> 00:31:54,960
You know, a hundred years of data.

453
00:31:55,080 --> 00:32:01,280
We've just gone through, you know, last year a recall on a product that we had, and we had to find all of the data.

454
00:32:01,280 --> 00:32:02,280
It's a problem.

455
00:32:02,480 --> 00:32:04,940
So we're not going to sit here and tell you that we have a cure.

456
00:32:04,940 --> 00:32:07,520
I mean, you know, we have drug cures, but it's a problem.

457
00:32:07,520 --> 00:32:20,800
You have to understand, again, this whole data at rest issue is huge because I don't think that folks realize how much data they were going to need, what purpose they would need to recover it for, and when they would need to recover it.

458
00:32:20,800 --> 00:32:21,660
So you're right.

459
00:32:21,660 --> 00:32:22,580
It's an issue.

460
00:32:22,580 --> 00:32:26,560
Right now, for Merck, we have a lot of data that's paper-driven because we have wet signatures.

461
00:32:26,560 --> 00:32:28,840
We have a lot of data that's not.

462
00:32:28,880 --> 00:32:30,160
So it is an issue.

463
00:32:30,160 --> 00:32:32,580
You have to figure out what it is you're going to do.

464
00:32:32,580 --> 00:32:36,620
And I think part of it is what data you need to make assumptions.

465
00:32:36,620 --> 00:32:36,780
Ms.

466
00:32:36,780 --> 00:32:38,760
Cleo's crystal ball, I say this all the time.

467
00:32:38,760 --> 00:32:45,920
What data may I need to go back and look at 100 years, 15, 25, two months today, tomorrow, whatever, and how do I get to that?

468
00:32:45,920 --> 00:32:48,040
And what technology is going to be there?

469
00:32:48,040 --> 00:32:56,480
And that's when you really have to have your peering partners with your vendors and hope that they're cutting-edge solutions because you work with them to migrate off of what's old and bring it to the new.

470
00:32:56,480 --> 00:32:58,860
We try to do that with Microsoft, but anyway.

471
00:32:59,400 --> 00:33:02,660
So you really need to have peering partners with your vendors.

472
00:33:02,820 --> 00:33:04,020
Okay, new topic.

473
00:33:04,340 --> 00:33:16,980
So if you had to rate the danger from hackers, evil outside influences that are like bored college students, versus organized criminals, versus internal employees, how would you prioritize those three?

474
00:33:16,980 --> 00:33:18,560
What keeps you up at night?

475
00:33:18,700 --> 00:33:20,920
The inside employee or the Russian mafia?

476
00:33:23,040 --> 00:33:23,940
Oracle?

477
00:33:23,940 --> 00:33:25,940
Oracle keeps you awake?

478
00:33:35,260 --> 00:33:36,140
Marianne's not here.

479
00:33:36,140 --> 00:33:36,500
It's okay.

480
00:33:36,500 --> 00:33:37,820
She won't kick my ass.

481
00:33:39,120 --> 00:33:40,440
Till later.

482
00:33:41,620 --> 00:33:47,600
No, seriously, internal employees, industrial espionage, and then outside influences.

483
00:33:48,300 --> 00:33:53,460
For us, it's the organized crime, the internal, and then the hacker.

484
00:33:54,260 --> 00:33:55,860
Any of you guys?

485
00:33:57,300 --> 00:34:02,680
Yeah, for us, it's the outside industrial espionage, number one.

486
00:34:02,680 --> 00:34:03,860
Is your number one?

487
00:34:04,860 --> 00:34:06,520
It'd be the internal employee.

488
00:34:07,100 --> 00:34:13,620
So it's internal employee and industrial espionage are your top two, and the outside hacker is pretty much in the grass.

489
00:34:13,740 --> 00:34:15,840
Not to disrespect anyone.

490
00:34:17,900 --> 00:34:33,200
Yeah, I mean, I made the comment at Black Academy, and one of the reasons why it's the internal employee, because we don't necessarily have a culture that's conducive to actually permeating security within our fabric, our employee base and everything else like that.

491
00:34:33,800 --> 00:34:37,100
We've traditionally built applications predicated on three things, right?

492
00:34:37,100 --> 00:34:38,300
Cheap, fast.

493
00:34:38,360 --> 00:34:40,160
You can build them cheap, fast, or secure.

494
00:34:40,320 --> 00:34:45,820
You can have any two of those, but it's real hard to have all three of those attainable in any project or application that you work on.

495
00:34:45,820 --> 00:34:54,140
And so we've traditionally done the cheap and the fast as a way to convince our business units that, hey, technology can add value.

496
00:34:54,300 --> 00:35:06,380
Now in this day and age and everything else, going back and trying to get security development integrated into the SDLCs and then just the methodology and mindset within the employees is somewhat of a challenge for us.

497
00:35:06,720 --> 00:35:15,100
So when security vendors are selling all the new blinky-blinky products that are all focused to protect you from hackers, that's not terribly relevant to what you want to buy.

498
00:35:15,100 --> 00:35:16,320
No, you just call bullshit.

499
00:35:16,380 --> 00:35:17,280
Go with it.

500
00:35:18,120 --> 00:35:19,640
Well, you know what, though?

501
00:35:20,440 --> 00:35:27,060
I think that an internal individual that crosses the line is the external individual.

502
00:35:27,120 --> 00:35:32,600
And who's also to say, not to say that the internal employee, the trusted employee, I'm not pegging on you here, Dave.

503
00:35:32,600 --> 00:35:33,600
Sit in for him.

504
00:35:33,860 --> 00:35:37,940
doesn't share that information with an external person on a chat board, right?

505
00:35:37,940 --> 00:35:38,940
How else are they going to get it?

506
00:35:38,940 --> 00:35:41,180
So I think, for me, it's one and the same.

507
00:35:41,180 --> 00:35:43,560
But I just go to bed at night now because I'll be there in the morning.

508
00:36:19,410 --> 00:36:21,690
Okay, well, I mean, I'll kick off with that.

509
00:36:21,690 --> 00:36:23,130
I mean, we're a chemical company.

510
00:36:23,210 --> 00:36:32,810
At the end of the day, you can go out and buy our product, our brand new product, and you put it into a gas chromatograph and you can get a spectral analysis and you can go out and copy it.

511
00:36:32,810 --> 00:36:33,870
It's very easy.

512
00:36:34,610 --> 00:36:43,010
What is going to keep paying my salary and my bonus going forwards is what we've got in the heads of our scientists and what's in our computers, what's coming next.

513
00:36:43,010 --> 00:36:46,010
It's how we steal a march on the competition.

514
00:36:46,690 --> 00:36:50,890
It's an intellectual property, absolutely, and it is key to our business.

515
00:36:51,250 --> 00:37:01,450
So it might be totally trivial things like paint that you paint on and starts pink and dries white, which is one of our latest tricks.

516
00:37:01,750 --> 00:37:06,790
It might seem daft, but it's actually stealing a march for those people who want to overpaint their ceilings.

517
00:37:08,310 --> 00:37:11,750
And it's selling very well at the moment.

518
00:37:11,750 --> 00:37:15,910
And the competition will bring something out in the near future, absolutely.

519
00:37:15,910 --> 00:37:18,730
So it's how you can get that edge on the competition.

520
00:37:18,810 --> 00:37:22,670
And that's all tied up in an intellectual property, and ultimately that's what I'm there to protect.

521
00:37:23,250 --> 00:37:35,010
How you do it, of course, is the whole range, because you've got Trojans out there, you've got hackers out there, you do have industrial espionage, and we know we have a lot of that out there trying to steal those secrets.

522
00:37:35,110 --> 00:37:39,750
And, of course, you've got the mafia and the organized crime coming on.

523
00:37:39,750 --> 00:37:44,670
But they're sort of carpet bombing you, rather than trying to do anything targeted at the moment.

524
00:37:45,070 --> 00:37:50,730
When they get bored beating up the banks and the gambling sites, maybe they'll turn their attention to us, who knows.

525
00:37:52,330 --> 00:37:58,810
For me, my main priority is protecting our customers' data, whether that's on our site or other customers' sites.

526
00:37:58,810 --> 00:38:04,250
So I'm spending most of my time these days beating up on product marketing and engineering, trying to get new features into the product.

527
00:38:06,410 --> 00:38:08,850
So I spend most of my time dealing with audit.

528
00:38:09,650 --> 00:38:14,290
Which is... yeah, it's a bit of a problem, actually, with a lot of companies.

529
00:38:14,890 --> 00:38:25,810
Where we actually find a lot of our attention being focused in areas that probably, maybe, in our opinion, aren't necessarily where they should be focused on.

530
00:38:25,810 --> 00:38:32,750
I mean, I'm a very big believer in audit, but some of the rules and requirements coming out of SOX are a little bit misguided.

531
00:38:32,750 --> 00:38:34,570
Audit for audit's sake is not...

532
00:38:34,570 --> 00:38:35,510
Exactly.

533
00:38:35,510 --> 00:38:37,050
I mean, there needs to be a purpose to it.

534
00:38:37,050 --> 00:38:41,970
I mean, so when we go through and we do an audit, I mean, I would expect that we hit the source code.

535
00:38:41,970 --> 00:38:43,490
We go through the entire application.

536
00:38:43,490 --> 00:38:49,910
We actually review it for true load testing, not just, does everybody have a password?

537
00:38:50,470 --> 00:38:54,430
Which is important, too, but there's a lot bigger issues out there.

538
00:38:54,430 --> 00:39:01,090
But as far as the culture within the company, I think awareness campaigns kind of get a little bit of a slack internally.

539
00:39:01,090 --> 00:39:06,350
But it's very important to really consistently beat that drum of what's important.

540
00:39:06,350 --> 00:39:07,270
Do your job.

541
00:39:07,270 --> 00:39:10,010
These are the things not to do, etc., etc.

542
00:39:10,770 --> 00:39:16,150
My job is actually not to protect the company from information security threats.

543
00:39:16,150 --> 00:39:27,210
My job is to understand the information security risks that the company faces, which is risk in combination with threats, vulnerabilities, and assets, right?

544
00:39:27,210 --> 00:39:43,910
Putting those all together and educating our business leaders as to what those risks are, how seriously they should take them, and to facilitate them making a decision about what is the level of risk that they want to accept.

545
00:39:43,990 --> 00:39:46,330
Because ultimately, at the end of the day, it's a business decision.

546
00:39:46,330 --> 00:39:46,850
Exactly.

547
00:39:46,850 --> 00:39:47,970
And we're insurance, right?

548
00:39:47,970 --> 00:39:49,550
We're in the risk management business.

549
00:39:49,550 --> 00:39:51,050
We understand this stuff.

550
00:39:51,270 --> 00:39:54,510
At least we understand risk management in other areas anyway.

551
00:39:54,510 --> 00:39:59,030
We would love to have better data, which would enable us to do more management on that front.

552
00:39:59,030 --> 00:40:02,750
But in the meantime, it's more art than science.

553
00:40:02,770 --> 00:40:11,830
And that's what my job is, is to try to present a picture of what the situation is to our business people so that they can make a decision about what to do.

554
00:40:11,970 --> 00:40:13,710
Okay, I'm going to go to this gentleman over here.

555
00:40:18,430 --> 00:40:19,230
Yay.

556
00:40:20,210 --> 00:40:21,710
Yeah, we're leaving now.

557
00:40:21,990 --> 00:40:23,870
I work for a private company.

558
00:40:23,870 --> 00:40:25,610
He's going.

559
00:40:29,930 --> 00:40:31,130
Yes.

560
00:40:31,670 --> 00:40:32,710
Hey, I'm in the middle.

561
00:40:32,710 --> 00:40:37,970
No, I mean, identity management, for some sakes, is pretty important.

562
00:40:37,970 --> 00:40:42,690
I don't like to have people tell me what I should do when they don't understand our business.

563
00:40:42,690 --> 00:40:45,270
Or they don't understand our infrastructure.

564
00:40:45,310 --> 00:40:49,210
Or they don't understand a basic operating system.

565
00:40:49,210 --> 00:40:59,410
I mean, a lot of the audit organizations aren't necessarily very technical in nature, and therefore can't really understand what the actual risk is on your particular environment.

566
00:40:59,410 --> 00:41:10,050
Or actually how to do some of the artwork in regards to the multiple layers of mitigation that were implemented to protect, you know, your application or your OS or your network or whatever.

567
00:41:10,050 --> 00:41:22,210
The identity management issue is, I mean, we need to be able to very clearly and concisely identify who has access to what and who they are and what they did.

568
00:41:22,210 --> 00:41:27,490
And centrally, it's important, but it needs to be driven in the right way.

569
00:41:27,590 --> 00:41:34,290
Right, and just to expand on that, too, you know, identity management is another one of those, you know, vogue topics within, you know, information security and everything else.

570
00:41:34,290 --> 00:41:45,810
So the problem with identity management is that if you don't have role clarity within your organization, meaning that I, as Andre Gold, an employee of Cutland Airlines, gets access to X, our inner resource and everything else, it doesn't matter, you know,

571
00:41:45,810 --> 00:41:48,690
what identity management technology solution that you have.

572
00:41:48,690 --> 00:41:57,630
I mean, there's business process and definitions that need to be defined at the role level before you can even think about, you know, any sort of federated identity management or anything like that.

573
00:42:04,450 --> 00:42:13,750
Understanding the process, understanding the roles, understanding the application, understanding, you know, what a maintenance worker needs access to versus a pilot, you know, for my particular organization.

574
00:42:14,370 --> 00:42:16,370
Understanding those type of things.

575
00:42:16,930 --> 00:42:19,770
Can I take a question from the guy in the back?

576
00:42:32,360 --> 00:42:34,240
What do you think the benefit is?

577
00:42:34,240 --> 00:42:37,240
Is there a benefit to your business or your company by being here?

578
00:42:37,500 --> 00:42:40,340
For me, it's a benefit to my profession.

579
00:42:40,340 --> 00:42:42,500
What I do during the day is my day job.

580
00:42:42,500 --> 00:42:43,660
That's why I earn my living.

581
00:42:43,700 --> 00:42:45,400
This is my profession.

582
00:42:46,860 --> 00:42:49,460
My company doesn't sell security products.

583
00:42:49,640 --> 00:42:52,340
You guys help me protect my drugs.

584
00:42:52,520 --> 00:42:53,420
That's why I'm here.

585
00:42:53,420 --> 00:42:55,060
That's why I send my staff here.

586
00:42:56,220 --> 00:42:57,640
No, yes, I'm a pusher.

587
00:42:57,640 --> 00:42:58,420
No, but it's true.

588
00:42:58,420 --> 00:43:01,600
I mean, this is, you know, either way it's going to happen whether we're here or not.

589
00:43:01,600 --> 00:43:03,020
So why not be a part of it?

590
00:43:03,780 --> 00:43:11,160
I mean, we're sitting up here because we all understand and have bought into the fact security through obscurity does not work.

591
00:43:11,440 --> 00:43:15,460
The problem is there's a whole lot of businesses out there who haven't tweaked to that yet.

592
00:43:15,460 --> 00:43:19,780
And there's a large router company I suspect is in that category.

593
00:43:22,320 --> 00:43:26,280
To add to that a little bit, I think, you know, hanging out with you guys for a few days.

594
00:43:26,280 --> 00:43:30,740
I get just as much out of it, you know, if not more, you know, than you guys do.

595
00:43:33,880 --> 00:43:35,200
Gentleman in the glasses.

596
00:43:53,790 --> 00:43:55,950
Okay, so rephrase the question basically.

597
00:43:57,190 --> 00:44:00,630
We hear about cyber espionage or espionage in general.

598
00:44:00,630 --> 00:44:01,990
How realistic is it?

599
00:44:01,990 --> 00:44:03,310
Does it actually occur in your industry?

600
00:44:03,310 --> 00:44:05,810
Is it something that's sort of just made up in the papers?

601
00:44:05,830 --> 00:44:11,230
And have you seen them progress in sophistication over the years from maybe old techniques to new computerized techniques?

602
00:44:12,250 --> 00:44:15,270
I'm guessing that maybe Pamela's industry is pretty competitive.

603
00:44:16,370 --> 00:44:18,150
And so maybe we'll ask her.

604
00:44:18,150 --> 00:44:19,430
Well , in clinical trials.

605
00:44:19,430 --> 00:44:20,410
In clinical trials.

606
00:44:20,410 --> 00:44:24,090
Well, I ask her because she's in charge of a 24-hour response team.

607
00:44:24,310 --> 00:44:27,690
So I'm not real clear with what you're asking.

608
00:44:27,690 --> 00:44:31,190
The question is, does it happen in your industry?

609
00:44:31,970 --> 00:44:34,450
And if it does, has it gotten better over the years?

610
00:44:34,890 --> 00:44:36,270
Industrial espionage?

611
00:44:36,270 --> 00:44:36,770
Yeah.

612
00:44:37,550 --> 00:44:42,110
In the pharmaceutical industry, we are exceedingly competitive.

613
00:44:42,110 --> 00:44:45,670
I don't want to say espionage doesn't happen.

614
00:44:45,670 --> 00:44:47,550
And I'm certainly not going to say that it does.

615
00:44:47,550 --> 00:44:49,550
Because it's a very thin line.

616
00:44:49,610 --> 00:44:54,450
So, for instance, when you're producing a drug, it's exceedingly competitive.

617
00:44:54,450 --> 00:44:56,410
It's very expensive.

618
00:44:56,490 --> 00:45:00,830
It takes about seven to eight years to bring a drug to market.

619
00:45:00,830 --> 00:45:03,310
That costs approximately $8 million.

620
00:45:03,330 --> 00:45:08,770
However, the bang for the buck is, year one, you recoup about $9 million.

621
00:45:08,770 --> 00:45:10,290
After that, it's profit.

622
00:45:10,290 --> 00:45:12,870
So getting to market is the issue.

623
00:45:12,970 --> 00:45:20,770
And there have been studies done where competitors have gotten to market with a very similar drug 30 days before us.

624
00:45:20,770 --> 00:45:22,690
And we never reached the power curve.

625
00:45:22,690 --> 00:45:24,530
We made great money on it.

626
00:45:24,610 --> 00:45:27,830
Excellent, you know, it helped humanity, the community, whatever.

627
00:45:27,830 --> 00:45:29,890
But it's the dollar value.

628
00:45:29,890 --> 00:45:31,070
They just never made it there.

629
00:45:31,070 --> 00:45:32,750
So it's time to market.

630
00:45:32,890 --> 00:45:34,170
Was it espionage?

631
00:45:34,170 --> 00:45:36,350
You know, hard to say.

632
00:45:36,350 --> 00:45:37,610
A lot of speculation.

633
00:45:40,050 --> 00:45:41,130
$800 million?

634
00:45:44,770 --> 00:45:46,010
$800 million to develop.

635
00:45:46,110 --> 00:45:47,610
$800 million return.

636
00:45:47,890 --> 00:45:50,370
But you've got to, like, not every drug you make is a winner.

637
00:45:50,670 --> 00:45:51,990
No, well, that's a thing.

638
00:45:51,990 --> 00:45:54,070
I mean, that's why it costs so much money.

639
00:45:54,110 --> 00:46:02,950
But the other part of it is, too, we're not getting on a drug talk here, but the other part of it is, for instance, when you're developing a drug, for instance, you know what Propecia is, right?

640
00:46:02,950 --> 00:46:05,330
It's for all those guys that want to grow hair.

641
00:46:05,330 --> 00:46:08,250
Originally, it wasn't meant to be Propecia.

642
00:46:08,250 --> 00:46:10,490
It was a drug for colon cancer.

643
00:46:10,790 --> 00:46:22,570
During clinical trials, which is why we have to spend $800 million to develop a drug, it came out that this particular drug that we were developing for colon cancer helped men grow hair on their head.

644
00:46:22,570 --> 00:46:24,330
Hence, therefore, we got two drugs.

645
00:46:24,330 --> 00:46:26,230
So, you know, a double whammy.

646
00:46:26,230 --> 00:46:27,790
Yeah, kind of like Vegas, two for one.

647
00:46:27,790 --> 00:46:38,730
The insurance industry is actually a little bit strange in that respect, in that we're required to file publicly much of our business information, rates, some degree of underwriting, and so forth.

648
00:46:38,730 --> 00:46:42,050
So a lot of our stuff is in the public domain already.

649
00:46:42,510 --> 00:46:48,810
And the competitiveness has a lot to do more with brand and reputation than anything else.

650
00:46:48,810 --> 00:46:54,350
It seems to me as though the business people at our company always seem to know what everybody else is doing in the industry.

651
00:46:54,350 --> 00:46:56,570
I don't understand exactly how they do that.

652
00:46:56,570 --> 00:47:00,690
But it seems to be universal, even at other companies in the industry.

653
00:47:00,690 --> 00:47:10,470
So I don't know if they all get together on the weekends or what, but I don't think there's a lot of industrial espionage taking place because of the sort of semi-public nature of some of the services that we provide.

654
00:47:10,730 --> 00:47:22,870
So from a general perspective or an industry perspective, the amount of that particular crime going on has really stayed the same.

655
00:47:22,870 --> 00:47:26,230
It's actually the methods that they're using in order to get the data out.

656
00:47:26,230 --> 00:47:31,110
Very typically, it's the same old methods, conversations, walking out with knowledge.

657
00:47:31,110 --> 00:47:41,970
However, when you start seeing things like data being embedded in images, technography, it gets very complicated in order to truly identify it while it's leaving your company.

658
00:47:42,170 --> 00:47:46,990
But typically, it's just walking out the door within somebody's head.

659
00:47:47,990 --> 00:47:53,350
Guy in the Sense Post shirt, I recognize your fine fashion sense there.

660
00:48:01,810 --> 00:48:04,990
Does audit response belong in your organization?

661
00:48:04,990 --> 00:48:07,650
And if it doesn't, where does it belong in the hierarchy?

662
00:48:07,710 --> 00:48:09,190
For us, it does.

663
00:48:09,190 --> 00:48:11,310
One of the things I own is IT audit.

664
00:48:11,670 --> 00:48:22,470
The reason that we actually put that there specifically is because we wanted the skill sets and the control belief system to really be embedded within the person who's doing it.

665
00:48:22,470 --> 00:48:33,470
We didn't want it filtering out into kind of a business unit or application kind of mentality when looking at the controls within IT.

666
00:48:33,590 --> 00:48:36,450
So, yes, it's within our group now.

667
00:48:36,450 --> 00:48:38,090
I've seen it a lot of different ways.

668
00:48:40,490 --> 00:48:42,650
Yeah, they focus on finance.

669
00:49:11,790 --> 00:49:15,790
At what point do you kill a bad app that was developed internally?

670
00:49:18,750 --> 00:49:22,770
Well, I think as a whole, our mission is security.

671
00:49:22,770 --> 00:49:25,350
So, I mean, that's kind of one in the same.

672
00:49:26,350 --> 00:49:35,130
And as far as getting security embedded into the application in the first place, I think that's probably one of the hardest challenges that companies are facing today.

673
00:49:35,130 --> 00:49:36,770
And getting that mindset established.

674
00:49:36,930 --> 00:49:43,870
You've got developers coming into the organization fresh out of school, didn't really teach them proper coding techniques, that sort of thing.

675
00:49:43,870 --> 00:49:45,190
How do you get education into here?

676
00:49:45,190 --> 00:49:48,750
How do you get that integrated into the whole development life cycle?

677
00:49:48,750 --> 00:49:50,850
And how do you make that process repeatable?

678
00:49:51,650 --> 00:49:53,250
Okay, well, we're actually out of time.

679
00:49:53,250 --> 00:49:58,010
So, I think I'll take one more question and then these gentlemen and ladies will be around.

680
00:50:01,910 --> 00:50:05,430
And they'll be happy to answer your questions, hang out, buy them a beer, you know.

681
00:50:05,870 --> 00:50:08,530
Okay, gentleman right here in the corner, yes.

682
00:50:28,640 --> 00:50:34,680
And at the end of the day, your job is to inform the business decision makers so they can make an informed decision, right?

683
00:50:35,640 --> 00:50:38,300
And you can't do that if you don't understand the business.

684
00:50:38,340 --> 00:50:45,240
You have to know, I spend more time in my job learning about how insurance works than probably anything else.

685
00:50:45,920 --> 00:50:47,720
Okay, let's give him a round of applause.

686
00:50:47,720 --> 00:50:48,720
Thank him for coming up here.