start	end	text
5550	10970	...Tangent. He apparently is somewhere else. I happen to be walking by.
11770	21310	And the illustrious group of, you know, representing, I guess corporate America is what you guys represent. Is that correct?
22030	27830	Okay. CISO. They told me they wanted me to go ahead and step up here.
27830	33830	If Dark Tangent comes in, I'll be happy to hand over the process to him.
33830	39270	But in the meantime, this is kind of a... I mean, I literally just walked by.
39270	44250	I have no idea what the panel is about or anything.
44270	50370	Something along the lines of CISOs, and they're going to discuss a number of things.
50370	54110	There's a few sample questions in the book in there.
54850	63270	I think one of the sample questions was how do the panelists feel about security research,
63270	68530	its impact upon the economy, impact upon the community.
68530	77250	And I think that's especially timely when you consider what happened at Black Hat with Mike Lynn
77250	85070	and the now former ISS employee being sued by a myriad of people, apparently.
86310	89410	So why don't we have someone up here on the panel kind of jump in.
89410	92070	You guys be thinking of questions, too, to ask these people.
92070	93710	Actually, first off, let's just go down the line.
93710	97650	You guys go down the line, introduce yourselves, tell who you are, and then we'll get to the question.
97790	98630	Does that sound okay?
100570	105590	Just name, title, and IP address of your VPN.
105590	106990	Just to...
107930	109090	Qualifications.
109090	110770	Yeah, qualifications, too.
110770	112370	So I'm Justin Semeny.
123450	125530	Obviously, I have everything I can do.
127380	128120	Wow.
128740	130520	It's not working.
136400	139540	I'm Justin Semeny from VeriSign.
139540	141320	So I run information security.
142280	143300	That's it?
143300	144220	Wow.
144900	146180	Qualifications.
146260	147020	What's that?
147020	147340	Qualifications.
147340	149700	He's not qualified.
151740	156000	Pamela Fusco, Chief Information Security Officer, Merck Pharmaceutical.
156000	157580	I'm certifiable.
158060	159140	Who next?
159620	162260	This one?
162260	163220	Yeah.
163220	164420	I'm Scott Blake.
164420	167580	I'm a CISO of Liberty Mutual Insurance Companies.
168160	172720	My background is I was the VP of Information Security at Bindview Corporation.
172720	178840	A couple ex-Bindview people around, I see, founded the Razor Security Research Team.
178840	184420	And so I obviously have a bias for very much in favor of information security research,
184420	187160	particularly basic research around vulnerabilities.
187520	197520	I think it's essential to improving the technology that we have to work with as part of the businesses that we're trying to operate.
197520	198960	So I'm all in favor.
203580	204160	Hey.
204160	204460	Hey.
204460	205440	Sorry, I'm late.
205660	207980	I've been distracted by other business.
209640	211520	I've got these slides up here, but I...
212500	217170	Doesn't work.
217170	218030	Doesn't work?
218070	219470	Doesn't work.
220930	222850	So you got through the introductions?
223510	223930	No.
223930	224750	Still going?
225090	226410	Oh, okay.
227270	228490	Thanks, Pam.
229050	230370	Proud to serve.
232610	233750	Hi, I'm David Mortman.
233750	236170	I'm the Chief Information Security Officer for Siebel Systems.
236170	240930	Most of you have the pleasure of having your personal information in one of my systems at one of these people's companies.
240930	242890	So that's why I'm here.
244530	249410	I'm Ken Files, CSO, Capital IQ, a division of Standard & Poor's.
250810	254190	I'm Andre Gold, Director of Information Security for Kynan Airlines.
255630	262050	And I'm Paul Simmons, CISO of ICI, and I sit on the board of the Jericho Forum.
262050	264630	I think people were asking... you were asking about qualifications.
264810	268530	The only qualification I hold is I'm a qualified whitewater canoe instructor.
272210	273650	Okay, sorry I was late.
274110	276330	Typically when we... we've tried this in the past.
276330	281710	I had all these really nice questions and tried to get them off on certain topics.
281890	284150	And we didn't have a lot of time for questions and answers.
284190	287850	So this time I'm going to try something different, which is a lot more audience participation.
287850	290310	I have a couple of questions for them first.
290510	292650	And then we're going to let them talk about it for a while.
292650	293690	I only have two or three.
293690	295690	And then we're going to open it up to the general audience.
295810	300570	And then my job is just to make sure that if you ask like a 30 second question,
300570	303190	I'm going to distill it down into like a four second question.
303190	304810	So keep that in mind.
306250	308010	Okay, hey, so question.
308150	309470	Would you hire hackers?
309790	314030	How does the word hacker influence your hiring decision?
314030	318430	Or are you purely concerned about criminal backgrounds?
321130	323590	I mean, if somebody comes to you like a hobbit and says,
323590	326750	I'm a self-described gray-bearded Unix hacker,
328110	331210	whoever's got the most serious feelings about this?
331210	333510	Well, I've hired a lot of hackers in my time.
333510	337350	So I am very much in favor of using hackers.
337350	340790	And I use the term really in the old school sense.
340790	344890	I mean, we're talking about people who break things for the purpose of knowledge,
344890	350010	who generate new knowledge about systems and software and what have you.
350010	354090	And that's essential for doing security research.
354150	357370	However, I would also add to that,
357370	362710	that I would not ever recommend hiring a criminal.
363070	366450	Now where the line gets drawn is sometimes a little bit fuzzy,
366450	368270	but that may be a whole other discussion.
368270	370610	I mean, would you do a Google search on their hacking handle
370610	374110	and see if it pops up on some Chinese defacement team?
374530	380030	I would definitely look at published research that somebody has done,
380610	384330	and look at what participation in discussion lists,
384330	387710	whether they've contributed positively to the community or not,
387710	391860	and if there's somebody who has respect to their peers and so forth.
392890	398780	I would not intentionally dig deep into other activities
400920	405520	beyond those positive contributions to the research community,
405520	408100	other than a criminal background check.
410280	412340	I've hired people who've gone bad.
412420	415700	So they were good when they came, and then they went to the other side.
415780	417640	And the other thing is, I would do a Google search...
417640	419460	Was it because they were reading 2600 or something?
419460	421020	Because I'm really tough, man.
422080	424340	No, and the other thing is, I would do a Google search,
424340	426380	but if they're good, I'm not going to find it anyway.
428020	431860	Yeah, I don't hire hackers. I hire intelligent people.
431860	435760	And if the two kind of correlate to each other, then so be it.
436020	439660	So you think this whole debate about hiring hackers is a non-issue, pretty much?
439660	446620	I've got a 13-year-old daughter, so I'm pretty much well-tuned with that.
448780	452300	There's a media misconception, I think that's out there,
452300	454100	that hacker correlates to criminal.
454640	457940	Which I think most of us would hopefully agree is wrong,
458340	462860	that there may be certainly examples of correlation,
462860	464760	but that doesn't necessarily prove the rule.
464760	466340	It's sort of like a plumber, right?
466340	468740	You can have a plumber, or you can have a criminal plumber,
468740	470460	but they're still basically a plumber.
470580	473130	So yeah, you can be a criminal hacker, or you can be a...
474620	479740	Yeah, over in the UK we have a thing called check certification.
479740	481980	I don't know if anyone here is check certified.
482780	485460	Basically what it means, it's the only certification, as far as I know,
485460	486880	in the world for hacking.
487560	490480	And it's actually sponsored by the UK government.
490780	494400	And it means that you're cleared to hack UK government systems.
494460	496260	And that means they've done a background check,
496260	499340	and they're happy with you working on government systems.
499600	501260	And personally that's good enough for me.
501260	503600	If you're check certified, I'll hire you anytime.
505640	507980	Anybody have any questions or comments on that?
508760	510600	Yeah, you in the red, please.
536610	542050	So the question was, there was a presenter at Black Hat who was fired for giving his talk.
542050	545350	And he quit two hours before his talk, apparently, but he wasn't fired.
545350	549370	But had he not quit, he would have been fired.
549370	554710	And the question was, would somebody like that have any hiring prospects
554710	557450	at companies represented by these types?
557730	559050	I'll answer that.
559930	561570	Yes, I would hire him.
563270	566670	Because I don't consider him to be a criminal.
567030	572050	I consider him to be someone who has brought something to someone's attention.
572410	574850	And he's gotten quite a bit of attention over it.
574850	577990	But I think that we all learn from what has happened in the past,
577990	579190	and I hope that we move forward.
579190	581850	So I think that he's a qualified individual.
582150	586470	And if I had a position and he passed the HR criminal blah, blah, blah,
586470	588630	he would be gainfully employed.
589970	591230	Anybody else?
592050	593670	I just second it.
594050	597950	Insofar as there was a call for security research.
597950	600050	I don't currently run a security research team.
600110	601870	But if I did, then sure.
602330	603730	With the same caveat.
604170	606210	I think there's another question over here.
606310	606870	Sir?
630270	631770	What are your peers up to?
631770	633110	Are they hiding from this issue?
633110	634290	Are they indifferent?
634690	637810	I think it's our responsibility to bring security to their attention.
637810	639070	That's what they pay me for.
639070	641610	And I'm lucky in that respect.
641610	644830	I get quite a bit of support from the executive staff.
645250	650250	And I think that they would trust the opinion of what I'm bringing to the table.
650250	653290	But I also trust, it's not just me, it's my team.
653430	658250	And I have about five people in this room that come with me to Black Hat and to DEF CON.
658250	659630	And I trust them.
659690	662170	And if they're, you know, they're going to be working with these people.
662350	664910	I just sign the paperwork and pay the bills, right?
664910	670370	So if they're in agreement that an individual such as that is welcome on the team, I'll be damned.
670370	673430	Then I'll take it to the highest level I need to to get the person hired.
675350	677890	One more question, we'll move on to a new one.
677890	678250	Sir?
681570	683770	I'm sorry, talk a bit louder, please.
694660	698480	Well, that's a broader question than whether or not they're going to hire hackers.
698480	699600	It's a privacy question.
700260	702880	We could ask them about the Patriot Act later, that's not a problem.
702880	705500	But is it a hiring a hacker related type question?
707520	708380	What's that?
709700	711760	That has violated the Patriot Act?
719930	722790	It's being done every five seconds.
722790	726430	I mean, plenty of people are hacking every day and they're not being busted on the Patriot Act.
729630	731550	Okay, so let's move on to the next...
731550	733070	Oh, do you have one more question, sir?
758490	759610	Right, right.
759610	761830	And I think there's a question on this earlier.
761830	765410	His question was, how do you rate private versus professional experience?
765450	767910	Versus maybe academic security experience?
767910	770570	And weigh that in a hiring type decision?
770610	773750	And it also kind of relates to what we talked about earlier, which is certification.
773990	781370	You know, would you hire somebody with a CISSP or a security MCSE over somebody with nothing?
781590	791590	So, from my perspective, actually, work experience...
792670	794170	Would you turn it off again?
794170	795150	No, you have to be really close to me.
795470	798590	So the work experience actually means a lot.
798610	805630	When we get specific down into the skill sets of actually hacking or breaking applications or breaking OSs or networks, etc.
805770	813630	I agree, there's not really a lot of corporate jobs that you can actually reference on a resume in order to prove those skill sets.
813630	816630	A lot of that actually just comes out in the interview process.
816750	820390	You break them down and be able to say, how would you do X, Y, and Z?
820390	824890	Or what is your mentality or thought process going through an actual attack?
824890	828090	And making sure that it's mature and it's done in a well-defined manner.
828090	831350	And it's not a script-kitty kind of attack.
831350	834870	It's actually very well thought out and very detailed.
836250	838750	I mean, so just to expand on that a little bit.
839870	847310	Degrees, certifications, they hold their place in a sense that you have concepts as well as degrees.
847310	852350	And our organization as well allows for mobility up that corporate ladder, so to speak, as well.
852350	861670	But when I'm out there like Pam said and everything else, looking to bring on people to augment my staff or respective duties and everything else, it's all about the experience.
861750	867530	I mean, the degrees and those type of things, they're okay, but they're kind of like the last thing that I look at.
867530	869550	It's like, okay, where has this guy or girl been?
869550	871790	What have they done and what can they bring to the organization?
873530	876850	Half the people in my team don't actually have degrees of any sort.
876850	878790	I think they have high school degrees probably.
880590	885870	Work experience is more of a metric for getting the resumes onto my desk than for actually as a hiring metric at that point.
886390	891450	More important than actually even experience for me and my team is just getting the ideas.
891650	893430	I can teach them the technical skills they need to have.
893430	895530	I can teach them the project management skills they need.
895530	899170	But if they just don't get it, they don't get the idea of security, they don't get the idea of risk management,
899170	903250	it doesn't matter if they've been doing this for 10 years or if they have a PhD in computer science.
903250	904150	I don't care.
908170	913590	Getting this back to reality, the bottom line is when you're faced with 600 or 800 CVs on your desk
913590	916950	or certainly going through a human resources department,
916950	921970	you go degree, no degree, degree, no degree, degree, no degree.
922490	928670	Ultimately, a relevant degree says that you are capable of a certain degree of learning.
929050	932050	And yeah, absolutely, you bring them into your business and you teach them
932050	934710	and you put them on training courses and everything else.
934710	939490	But the degree says at least they have the capability and the wherewithal to go out and learn new skills.
939490	944430	And it might not be perfect, but it is generally a fact of life in the corporate world.
944950	949270	The other qualification I tack onto that is publications.
949790	954890	For someone who's going to be doing research or red team kinds of activities,
954890	962390	I would want to see published new vulnerabilities or published papers on techniques, things like that,
962390	966550	as part of the qualification, seconding the other things that have been said.
966550	968250	Degrees do count, unfortunately.
971250	975250	I think one thing being left out of the equation is attitude also.
975850	979070	If you've got the worst attitude and you're the best hacker, I don't want you.
979070	981610	If you can't play well with others, I don't want you.
986650	990610	We'll have one last question and then we'll move on to a new topic.
1009990	1015690	I think you've got to let them devote a certain amount of their time.
1016070	1022070	I don't have my folks doing 100% of their focused time on one particular task.
1022070	1025470	I let them work in different areas of security.
1025470	1030690	We provide them with the training that they'd like to go to within reason.
1031530	1033290	Those are just a few of the things.
1033290	1039770	We also do peer training and sit-downs, lunches, outings, that sort of thing.
1040770	1042450	Send them to DEF CON.
1043110	1044070	Thanks, Pam.
1045970	1053870	Next topic is kind of near and dear to my heart, related to the whole Enron case, and that's data retention.
1053870	1058990	In the wake of Microsoft, how long do you keep data?
1058990	1066370	Do you do it as a defensive measure against lawsuit, or is it just sheer log bloat?
1066530	1071730	What's your overall thought on log retention, data retention?
1071730	1072450	Anybody?
1072870	1074870	I'll jump in here.
1075150	1083030	Log retention, or data retention more specifically, can actually be driven more by external legislation.
1083030	1087890	Be it credit card information, personal information, et cetera.
1087890	1094230	So there's a lot of limitations and requirements on how long we have to hold it and when we actually have to delete it.
1094370	1101430	Outside of that, the perspective is basically, on a yearly time frame, we go through most of the data.
1102870	1108570	The main reason for keeping the data is not only providing a service from the application side,
1108570	1113130	but it's also being able to go back in time for issues like litigation.
1114190	1117070	So would you say a year, six months, ten years?
1117070	1123450	I would say about a year. There are certain things that we have that definitely go beyond that, but about a year is pretty much the baseline.
1124130	1132690	Unfortunately, we delete data a lot sooner than that, unless there are regulatory requirements around that data.
1132690	1136490	Data has proven to be a liability to us as well within court.
1136490	1145770	And so our legal department actually comes down and mandates that data over the 60 days actually be removed and be expunged from the environment.
1146030	1156830	Our data retention policy is about 80 pages, and it's driven by a wide variety of state and federal legislation for different types of information.
1158130	1162850	And there are a lot of different things, and everything has its own rules for how it gets...
1162850	1164750	So it's a total nightmare mess.
1165350	1168430	I wouldn't call it a nightmare, but it's complex.
1169010	1177210	Yeah, I mean, we're driven by legislation, and we've got places, because we're a chemical company, where we have to keep data on people,
1177210	1182150	and particularly their state of health, for ten years after they die.
1182150	1189690	So potentially, that's up to 100 years, which is a real issue because, of course, media changes the whole time.
1189690	1191630	Media doesn't have a 100-year lifetime.
1191630	1193730	I was going to say, you've got a lot of money in MacStore and Hitachi, then.
1193850	1195210	We're going back to microfiche.
1195210	1197710	Microfiche is about the only thing that actually works properly.
1200410	1201730	Okay, sir.
1209120	1213620	The question is, how many of you have assigned policies dictating how long you'll keep the data?
1213700	1214380	Signed policy?
1214380	1215520	Yeah, signed policy.
1215680	1216380	Everybody.
1216860	1223720	We keep data 100 years in the pharmaceutical industry, which is crazy, because when you store data 100 years from now,
1223720	1229880	the technology that we used in, like, you know, 1801, it doesn't exist in 2005.
1236410	1239510	I'm sorry, who's speaking now? Stand up, please.
1239570	1240710	Oh, okay.
1243630	1246270	So the question is, how do you secure that data once it's archived?
1246270	1250450	Do you put it in a big hole in the wall, or do you... hole in the ground?
1250910	1251670	Salt mines.
1251670	1252390	Salt mines.
1252390	1254570	Salt mines are really good.
1256510	1257350	Sunglasses?
1267060	1271600	Right, right. So now that you're storing data for 100 years or whatever, does it ever come in handy?
1271600	1273580	Have you ever actually used it for anything?
1274340	1277100	Ten years, but we were founded in 95, so...
1279440	1283080	I think the furthest we've had to go back is in the order of about 30 years.
1283200	1285140	We were founded in 1928.
1285820	1287900	What was the circumstance for that?
1287900	1293360	It was a health claim against us for a disease that they developed, and they blamed it on us.
1293820	1294860	It wasn't me.
1296660	1298960	It didn't... they didn't win it.
1300300	1306040	I don't know what the exact number is for us, but the company was founded in 1912, and we sell life insurance and have since then.
1306040	1308600	So, probably that far back.
1316930	1318010	General counsel.
1318150	1318950	Legal.
1320150	1323090	Pretty much everybody raise your hand if it's driven by legal.
1323470	1324290	Yeah.
1325290	1327830	If you could have your way, would you get rid of it?
1329070	1329690	No.
1329690	1332350	So you think it is in the appropriate position.
1332350	1335450	So that's totally the correct location for that. Okay.
1342390	1343310	Absolutely.
1349640	1355860	Yeah, the data retention policies dictate not only how long to retain, but also when to destroy.
1355860	1362800	So a lot of our policies are written in terms of the maximum retention period, not only the minimum required retention period.
1362800	1364860	And when you reach those maximums, you just purge.
1364860	1365260	Yep.
1365260	1369300	And hopefully that Stone Mountain place doesn't have your hands on their tapes, right?
1369620	1371340	They probably lost it anyway.
1381080	1388360	Do you think that the burden or the overhead impaired by performing these retention policies is a burden on the business function?
1392130	1392750	Yeah.
1393650	1398970	At ICI Corporate Centre in London, we have a 15-month deletion policy on email.
1399270	1404810	And basically we force our employees, when it comes up to 15 months, to actually sort it, go through it.
1404810	1405730	This is automated.
1405730	1408450	It puts it into a bucket and says, you will sort this.
1409350	1418350	And you're forced to go through and either delete it or put it into the archiving system, at which point you have to give it a title, a date, what it's about,
1418350	1421650	and when it needs to be deleted automatically.
1421790	1422950	But yeah, absolutely.
1422990	1426530	You can work on projects for three years in some cases.
1426530	1427640	So yeah, it's a real problem.
1428150	1434090	There are certain issues where we have internal monitoring projects to monitor individual activity.
1434210	1437850	And we actually have a very short retention for that data.
1437850	1441090	Obviously, there's a lot of personal stuff going through the network.
1441090	1449390	And we do have investigations that we need to go back a year to really see what the full activity of a particular individual is.
1449390	1453890	So that would be one of the cases that we would have that it would impede what we do personally.
1453890	1467530	From a business standpoint, I mean, really the federal requirements or the industry requirements on data retention that are applicable to us really kind of really has changed the business and how they perform the service.
1467530	1469950	So not really from a service standpoint.
1471230	1473070	Okay, I've got one more question.
1473070	1474070	Oh, sir.
1482590	1485910	So the question is, are there data privacy laws surrounding how you retain the data?
1485910	1487250	Do you have to keep it encrypted?
1487410	1488210	Rot13?
1488330	1490310	You know, how do you keep it encrypted?
1490670	1492770	The paper files are really hard to encrypt.
1492770	1493670	Rot12, its successor.
1493830	1494230	Yeah.
1496310	1499430	So you say microfiche, and then you physically have control of it.
1499430	1501830	And then you put it somewhere and hope it doesn't burn down.
1501870	1506390	So when you look at things like PCI, or Visa's MasterCard certification program,
1506390	1509250	where they actually require the encryption of credit card data.
1509530	1511670	Well, for the companies that do it.
1513330	1514490	We all do.
1514490	1515210	Absolutely.
1516510	1524830	Basically, going back to the point, I think the encryption of the actual data on the tapes before they're shipped out is very important.
1524870	1531830	The encryption of the data within the database is, even though they're running in production, like the credit card data, social security numbers, et cetera.
1531830	1536910	I mean, it's absolutely imperative that we do that because application security is getting a lot more dangerous nowadays.
1537230	1541090	And without it, it's just a recipe for disaster.
1541370	1547810	So from a data encryption perspective, it also depends on what the data is and where the data is going.
1547810	1550190	So there's encryption regulations.
1550190	1552290	Data in transit needs to be encrypted.
1552290	1554750	But in some cases, data at rest does not.
1554750	1559410	There's also, because we're international, different encryption laws.
1559410	1562170	Paris is different than what we do in Germany.
1562690	1563950	Location of the data.
1563950	1566010	There's no off-site storage in Germany.
1566010	1566570	And I may be wrong.
1566570	1567230	It may have changed.
1567230	1568530	But last I checked, it wasn't.
1568530	1575870	So we have to be very careful when we're talking about what we're doing with what parts of the data and with what region specific as well.
1576510	1577950	And which algorithms.
1579910	1581530	So Jeff's a little busy.
1581950	1582530	Sorry.
1582530	1586130	Yeah, there's some action going around pool two right now I needed to know about.
1587850	1589830	I'll chime in on that if I could, actually.
1589830	1590530	Pool two action?
1591090	1592930	No, not that.
1593670	1596370	I mean, I don't know if anyone remembers the quote.
1596470	1597610	I don't know if Bruce is here.
1597610	1603870	But it was, if you think encryption will solve your problem, you don't understand encryption and you don't understand your problem.
1603950	1605310	It's a great quote.
1605870	1609350	And I think if we look carefully, I have to disagree with Justin a little bit.
1609350	1619330	But if we look carefully at some of the issues where we look at how things are needing to be encrypted or whether they should be encrypted, look at something like backup tapes.
1619570	1625850	Backup tapes, it's a great idea to store them in an encrypted format until you need to actually restore from the tape.
1626550	1630010	Then you have a problem because you need to decrypt that information.
1630570	1635090	And now that, depending on where you are, I mean, if it was just a simple drive failure, then that's fine.
1635090	1641250	But if your data center exploded and all your key material was there, you have a major problem.
1641330	1642710	So where are you going to store the key material?
1642710	1644690	Well, the safe place to store it is with the tape.
1644710	1646070	So what's the point of that?
1646430	1649010	You've got your key taped to the tape.
1649230	1652490	And so you can be sure that you'll be able to get the data back off of it.
1652490	1656110	And the guy who designed the key system is retired last year.
1656210	1656870	Exactly.
1657030	1660190	10, 20 years down the road, how are you going to do that?
1660190	1664910	You look at some of the application things, especially encrypting data at rest in a database.
1665010	1670870	Something on that application server or database server knows how to decrypt that data or it's completely useless.
1670990	1675910	The problem then for the folks in the room becomes find that piece of software and control it.
1675950	1678670	It's sitting in memory. The key is sitting in memory somewhere.
1678670	1679570	Wherever it is. It could be anywhere.
1679570	1683030	It could be sitting on a smart card that's plugged into the machine.
1683030	1685310	But something knows how to get it.
1685390	1688970	Some piece of code on that machine knows how to decrypt the information that's in that database.
1688970	1691110	And somebody's going to be able to figure out how to get it off.
1691310	1697310	Well, I guess the point of the encryption of the tapes is not necessarily for protection.
1698450	1701290	It's not necessarily the encryption on the tapes.
1701290	1705170	It's more so protecting it when that data is in someone else's hands.
1706590	1708750	We don't put our keys on our tapes.
1708930	1710350	And it is a problem.
1710350	1713310	There's no question about it in regards to how you manage those keys.
1715110	1718670	For us, we've had a little bit of experience in the keys.
1718670	1721670	How we actually have a distributed model and how we actually put it out.
1721670	1725010	But yeah, to your point, there are some fundamental flaws.
1725010	1727990	But you really have to understand your use case for encryption.
1728190	1732910	And if you think encryption is going to protect you from everything, I absolutely agree.
1732910	1734530	You don't understand encryption.
1735210	1737170	Okay, this is the last one on this topic.
1737170	1739850	We can revisit it when we go to general questions and answers.
1744150	1747750	How do you deal with...
1748310	1751430	Right, so we talked about this briefly, but how do you deal with obsolescence?
1751430	1757290	Are you constantly updating your backup technology and taking all your tapes from five years ago and updating today's technology?
1757290	1760890	Do you go through this rev cycle every five years?
1760890	1762910	Do you decide it's time to re-upgrade everything?
1764390	1765110	Anybody?
1765470	1767070	I'll say it again, microfiche.
1767270	1768910	Microfiche is where it's at, guys.
1769370	1773170	We have seriously looked at it because we've got this requirement for 100 years plus storage.
1773170	1774850	We have seriously looked at the problem.
1776090	1779070	Do you do it in machine code? I mean, how is it machine readable?
1779070	1781190	Is it in 3D barcode?
1781190	1782150	No, we print it.
1783390	1788410	You print it onto A4 paper in our case, or letter paper in your case.
1788490	1791110	And you photograph it and put it onto these...
1791110	1796350	Right, and the printout is encoded in a printed format in what, a 3D barcode?
1796350	1797910	A giant full page 3D barcode?
1797910	1799890	Is it ones and zeros on the whole page?
1800030	1803410	No, no, no, it's their data.
1803410	1807430	If they filled in a form, we print the form and we microfiche it.
1807430	1808470	Oh, I see, I see.
1809930	1811070	Blow it up.
1812610	1815590	Well, I'm just wondering what my Microsoft...
1818370	1821110	So you're saying it's definitely not Unicode, right?
1821490	1822830	No, definitely not, Jeff.
1824530	1825830	So do you print it?
1825830	1828510	Yeah, I'm just wondering, how do you print Microsoft Word binary?
1830070	1832810	With great difficulty. Print it. Hit print.
1832810	1835390	And it comes out squiggle question mark space space dash.
1836990	1840610	No, we're talking the application Microsoft Word, the application.
1841210	1842290	You don't care.
1842290	1845550	Okay, okay. So it's in hex. It's in hex.
1849610	1854910	Well, the only reason I'm wondering is because years ago some guy sold an application that would 3D encode your application,
1854910	1859210	print it out on your Epson FX80 printer, and then all you have to do is re-scan it in,
1859210	1864710	and you would have incredible data densities, because basically each dot on the data matrix printer was, you know, one or zero.
1864710	1867050	And they were claiming this thousand-year thing.
1867050	1870290	With a basic algorithm, you could reconstruct the data whenever you wanted.
1870290	1872830	It has built-in CRC checking and redundancy.
1872830	1874570	But they only had it on floppy.
1874970	1875910	Yeah, okay.
1875910	1876930	They only sold it on floppy disks.
1876930	1880410	But the business doesn't care about storing the application. They only care about the data.
1880690	1887470	So the data gets printed out in a report, and it's paper or microfiche or whatever, and it's the data that gets stored.
1887470	1891170	So, okay. I'm just concerned that you have the data but nothing to interpret it.
1891410	1893490	You have people. It's in English.
1893710	1894330	Okay.
1894950	1900150	Right? You want to back up the...
1910820	1912680	I think we addressed this.
1913140	1914960	You know, a hundred years of data.
1915080	1921280	We've just gone through, you know, last year a recall on a product that we had, and we had to find all of the data.
1921280	1922280	It's a problem.
1922480	1924940	So we're not going to sit here and tell you that we have a cure.
1924940	1927520	I mean, you know, we have drug cures, but it's a problem.
1927520	1937180	You have to understand, again, this whole data at rest issue is huge because I don't think that folks realize how much data they were going to need,
1937180	1940800	what purpose they would need to recover it for, and when they would need to recover it.
1940800	1942580	So you're right. It's an issue.
1942580	1946560	Right now, for Merck, we have a lot of data that's paper-driven because we have wet signatures.
1946560	1948840	We have a lot of data that's not.
1948880	1950160	So it is an issue.
1950160	1952580	You have to figure out what it is you're going to do.
1952580	1956620	And I think part of it is what data you need to make assumptions.
1956620	1958760	Ms. Cleo's crystal ball, I say this all the time.
1958760	1965920	What data may I need to go back and look at 100 years, 15, 25, two months today, tomorrow, whatever, and how do I get to that?
1965920	1968040	And what technology is going to be there?
1968040	1972260	And that's when you really have to have your peering partners with your vendors and hope that they're cutting-edge solutions
1972260	1976480	because you work with them to migrate off of what's old and bring it to the new.
1976480	1978860	We try to do that with Microsoft, but anyway.
1979400	1982660	So you really need to have peering partners with your vendors.
1982820	1984020	Okay, new topic.
1984340	1991600	So if you had to rate the danger from hackers, evil outside influences that are like bored college students,
1991600	1996980	versus organized criminals, versus internal employees, how would you prioritize those three?
1996980	1998560	What keeps you up at night?
1998700	2000920	The inside employee or the Russian mafia?
2003040	2003940	Oracle?
2003940	2005940	Oracle keeps you awake?
2015260	2017820	Marianne's not here. It's okay. She won't kick my ass.
2019120	2020440	Till later.
2021620	2027600	No, seriously, internal employees, industrial espionage, and then outside influences.
2028300	2033460	For us, it's the organized crime, the internal, and then the hacker.
2034260	2035860	Any of you guys?
2037300	2042680	Yeah, for us, it's the outside industrial espionage, number one.
2042680	2043860	Is your number one?
2044860	2046520	It'd be the internal employee.
2047100	2053620	So it's internal employee and industrial espionage are your top two, and the outside hacker is pretty much in the grass.
2053740	2055840	Not to disrespect anyone.
2057900	2063600	Yeah, I mean, I made the comment at Black Academy, and one of the reasons why it's the internal employee,
2063600	2071200	because we don't necessarily have a culture that's conducive to actually permeating security within our fabric,
2071200	2073200	our employee base and everything else like that.
2073800	2077100	We've traditionally built applications predicated on three things, right?
2077100	2080160	Cheap, fast. You can build them cheap, fast, or secure.
2080320	2085820	You can have any two of those, but it's real hard to have all three of those attainable in any project or application that you work on.
2085820	2094140	And so we've traditionally done the cheap and the fast as a way to convince our business units that, hey, technology can add value.
2094300	2101140	Now in this day and age and everything else, going back and trying to get security development integrated into the SDLCs
2101140	2106380	and then just the methodology and mindset within the employees is somewhat of a challenge for us.
2106720	2113000	So when security vendors are selling all the new blinky-blinky products that are all focused to protect you from hackers,
2113000	2115100	that's not terribly relevant to what you want to buy.
2115100	2117280	No, you just call bullshit. Go with it.
2118120	2119640	Well, you know what, though?
2120440	2127060	I think that an internal individual that crosses the line is the external individual.
2127120	2131320	And who's also to say, not to say that the internal employee, the trusted employee,
2131320	2133600	I'm not pegging on you here, Dave. Sit in for him.
2133860	2137940	doesn't share that information with an external person on a chat board, right?
2137940	2138940	How else are they going to get it?
2138940	2141180	So I think, for me, it's one and the same.
2141180	2143560	But I just go to bed at night now because I'll be there in the morning.
2179410	2181690	Okay, well, I mean, I'll kick off with that.
2181690	2183130	I mean, we're a chemical company.
2183210	2187650	At the end of the day, you can go out and buy our product, our brand new product,
2187650	2192810	and you put it into a gas chromatograph and you can get a spectral analysis and you can go out and copy it.
2192810	2193870	It's very easy.
2194610	2200410	What is going to keep paying my salary and my bonus going forwards is what we've got in the heads of our scientists
2200410	2203010	and what's in our computers, what's coming next.
2203010	2206010	It's how we steal a march on the competition.
2206690	2210890	It's an intellectual property, absolutely, and it is key to our business.
2211250	2218510	So it might be totally trivial things like paint that you paint on and starts pink and dries white,
2218990	2221450	which is one of our latest tricks.
2221750	2226790	It might seem daft, but it's actually stealing a march for those people who want to overpaint their ceilings.
2228310	2231750	And it's selling very well at the moment.
2231750	2235910	And the competition will bring something out in the near future, absolutely.
2235910	2238730	So it's how you can get that edge on the competition.
2238810	2242670	And that's all tied up in an intellectual property, and ultimately that's what I'm there to protect.
2243250	2248670	How you do it, of course, is the whole range, because you've got Trojans out there, you've got hackers out there,
2248670	2255010	you do have industrial espionage, and we know we have a lot of that out there trying to steal those secrets.
2255110	2259750	And, of course, you've got the mafia and the organized crime coming on.
2259750	2264670	But they're sort of carpet bombing you, rather than trying to do anything targeted at the moment.
2265070	2270730	When they get bored beating up the banks and the gambling sites, maybe they'll turn their attention to us, who knows.
2272330	2278810	For me, my main priority is protecting our customers' data, whether that's on our site or other customers' sites.
2278810	2284250	So I'm spending most of my time these days beating up on product marketing and engineering, trying to get new features into the product.
2286410	2288850	So I spend most of my time dealing with audit.
2289650	2294290	Which is... yeah, it's a bit of a problem, actually, with a lot of companies.
2294890	2305810	Where we actually find a lot of our attention being focused in areas that probably, maybe, in our opinion, aren't necessarily where they should be focused on.
2305810	2312750	I mean, I'm a very big believer in audit, but some of the rules and requirements coming out of SOX are a little bit misguided.
2312750	2314570	Audit for audit's sake is not...
2314570	2317050	Exactly. I mean, there needs to be a purpose to it.
2317050	2321970	I mean, so when we go through and we do an audit, I mean, I would expect that we hit the source code.
2321970	2329910	We go through the entire application. We actually review it for true load testing, not just, does everybody have a password?
2330470	2334430	Which is important, too, but there's a lot bigger issues out there.
2334430	2341090	But as far as the culture within the company, I think awareness campaigns kind of get a little bit of a slack internally.
2341090	2346350	But it's very important to really consistently beat that drum of what's important.
2346350	2350010	Do your job. These are the things not to do, etc., etc.
2350770	2356150	My job is actually not to protect the company from information security threats.
2356150	2367210	My job is to understand the information security risks that the company faces, which is risk in combination with threats, vulnerabilities, and assets, right?
2367210	2376870	Putting those all together and educating our business leaders as to what those risks are, how seriously they should take them,
2376870	2383910	and to facilitate them making a decision about what is the level of risk that they want to accept.
2383990	2386330	Because ultimately, at the end of the day, it's a business decision.
2386330	2389550	Exactly. And we're insurance, right? We're in the risk management business.
2389550	2394510	We understand this stuff. At least we understand risk management in other areas anyway.
2394510	2399030	We would love to have better data, which would enable us to do more management on that front.
2399030	2402750	But in the meantime, it's more art than science.
2402770	2411830	And that's what my job is, is to try to present a picture of what the situation is to our business people so that they can make a decision about what to do.
2411970	2413710	Okay, I'm going to go to this gentleman over here.
2418430	2419230	Yay.
2420210	2421710	Yeah, we're leaving now.
2421990	2423870	I work for a private company.
2423870	2425610	He's going.
2429930	2431130	Yes.
2431670	2432710	Hey, I'm in the middle.
2432710	2437970	No, I mean, identity management, for some sakes, is pretty important.
2437970	2442690	I don't like to have people tell me what I should do when they don't understand our business.
2442690	2445270	Or they don't understand our infrastructure.
2445310	2449210	Or they don't understand a basic operating system.
2449210	2459410	I mean, a lot of the audit organizations aren't necessarily very technical in nature, and therefore can't really understand what the actual risk is on your particular environment.
2459410	2470050	Or actually how to do some of the artwork in regards to the multiple layers of mitigation that were implemented to protect, you know, your application or your OS or your network or whatever.
2470050	2482210	The identity management issue is, I mean, we need to be able to very clearly and concisely identify who has access to what and who they are and what they did.
2482210	2487490	And centrally, it's important, but it needs to be driven in the right way.
2487590	2494290	Right, and just to expand on that, too, you know, identity management is another one of those, you know, vogue topics within, you know, information security and everything else.
2494290	2508690	So the problem with identity management is that if you don't have role clarity within your organization, meaning that I, as Andre Gold, an employee of Cutland Airlines, gets access to X, our inner resource and everything else, it doesn't matter, you know, what identity management technology solution that you have.
2508690	2517630	I mean, there's business process and definitions that need to be defined at the role level before you can even think about, you know, any sort of federated identity management or anything like that.
2524450	2533750	Understanding the process, understanding the roles, understanding the application, understanding, you know, what a maintenance worker needs access to versus a pilot, you know, for my particular organization.
2534370	2536370	Understanding those type of things.
2536930	2539770	Can I take a question from the guy in the back?
2552360	2557240	What do you think the benefit is? Is there a benefit to your business or your company by being here?
2557500	2560340	For me, it's a benefit to my profession.
2560340	2562500	What I do during the day is my day job.
2562500	2563660	That's why I earn my living.
2563700	2565400	This is my profession.
2566860	2569460	My company doesn't sell security products.
2569640	2572340	You guys help me protect my drugs.
2572520	2573420	That's why I'm here.
2573420	2575060	That's why I send my staff here.
2576220	2577640	No, yes, I'm a pusher.
2577640	2578420	No, but it's true.
2578420	2581600	I mean, this is, you know, either way it's going to happen whether we're here or not.
2581600	2583020	So why not be a part of it?
2583780	2591160	I mean, we're sitting up here because we all understand and have bought into the fact security through obscurity does not work.
2591440	2595460	The problem is there's a whole lot of businesses out there who haven't tweaked to that yet.
2595460	2599780	And there's a large router company I suspect is in that category.
2602320	2606280	To add to that a little bit, I think, you know, hanging out with you guys for a few days.
2606280	2610740	I get just as much out of it, you know, if not more, you know, than you guys do.
2613880	2615200	Gentleman in the glasses.
2633790	2635950	Okay, so rephrase the question basically.
2637190	2640630	We hear about cyber espionage or espionage in general.
2640630	2641990	How realistic is it?
2641990	2643310	Does it actually occur in your industry?
2643310	2645810	Is it something that's sort of just made up in the papers?
2645830	2651230	And have you seen them progress in sophistication over the years from maybe old techniques to new computerized techniques?
2652250	2655270	I'm guessing that maybe Pamela's industry is pretty competitive.
2656370	2658150	And so maybe we'll ask her.
2658150	2659430	Well, in clinical trials.
2659430	2660410	In clinical trials.
2660410	2664090	Well, I ask her because she's in charge of a 24-hour response team.
2664310	2667690	So I'm not real clear with what you're asking.
2667690	2671190	The question is, does it happen in your industry?
2671970	2674450	And if it does, has it gotten better over the years?
2674890	2676270	Industrial espionage?
2676270	2676770	Yeah.
2677550	2682110	In the pharmaceutical industry, we are exceedingly competitive.
2682110	2685670	I don't want to say espionage doesn't happen.
2685670	2687550	And I'm certainly not going to say that it does.
2687550	2689550	Because it's a very thin line.
2689610	2694450	So, for instance, when you're producing a drug, it's exceedingly competitive.
2694450	2696410	It's very expensive.
2696490	2700830	It takes about seven to eight years to bring a drug to market.
2700830	2703310	That costs approximately $8 million.
2703330	2708770	However, the bang for the buck is, year one, you recoup about $9 million.
2708770	2710290	After that, it's profit.
2710290	2712870	So getting to market is the issue.
2712970	2720770	And there have been studies done where competitors have gotten to market with a very similar drug 30 days before us.
2720770	2722690	And we never reached the power curve.
2722690	2724530	We made great money on it.
2724610	2727830	Excellent, you know, it helped humanity, the community, whatever.
2727830	2729890	But it's the dollar value.
2729890	2731070	They just never made it there.
2731070	2732750	So it's time to market.
2732890	2734170	Was it espionage?
2734170	2736350	You know, hard to say.
2736350	2737610	A lot of speculation.
2740050	2741130	$800 million?
2744770	2746010	$800 million to develop.
2746110	2747610	$800 million return.
2747890	2750370	But you've got to, like, not every drug you make is a winner.
2750670	2751990	No, well, that's a thing.
2751990	2754070	I mean, that's why it costs so much money.
2754110	2762950	But the other part of it is, too, we're not getting on a drug talk here, but the other part of it is, for instance, when you're developing a drug, for instance, you know what Propecia is, right?
2762950	2765330	It's for all those guys that want to grow hair.
2765330	2768250	Originally, it wasn't meant to be Propecia.
2768250	2770490	It was a drug for colon cancer.
2770790	2782570	During clinical trials, which is why we have to spend $800 million to develop a drug, it came out that this particular drug that we were developing for colon cancer helped men grow hair on their head.
2782570	2784330	Hence, therefore, we got two drugs.
2784330	2786230	So, you know, a double whammy.
2786230	2787790	Yeah, kind of like Vegas, two for one.
2787790	2798730	The insurance industry is actually a little bit strange in that respect, in that we're required to file publicly much of our business information, rates, some degree of underwriting, and so forth.
2798730	2802050	So a lot of our stuff is in the public domain already.
2802510	2808810	And the competitiveness has a lot to do more with brand and reputation than anything else.
2808810	2814350	It seems to me as though the business people at our company always seem to know what everybody else is doing in the industry.
2814350	2816570	I don't understand exactly how they do that.
2816570	2820690	But it seems to be universal, even at other companies in the industry.
2820690	2830470	So I don't know if they all get together on the weekends or what, but I don't think there's a lot of industrial espionage taking place because of the sort of semi-public nature of some of the services that we provide.
2830730	2842870	So from a general perspective or an industry perspective, the amount of that particular crime going on has really stayed the same.
2842870	2846230	It's actually the methods that they're using in order to get the data out.
2846230	2851110	Very typically, it's the same old methods, conversations, walking out with knowledge.
2851110	2861970	However, when you start seeing things like data being embedded in images, technography, it gets very complicated in order to truly identify it while it's leaving your company.
2862170	2866990	But typically, it's just walking out the door within somebody's head.
2867990	2873350	Guy in the Sense Post shirt, I recognize your fine fashion sense there.
2881810	2887650	Does audit response belong in your organization? And if it doesn't, where does it belong in the hierarchy?
2887710	2891310	For us, it does. One of the things I own is IT audit.
2891670	2902470	The reason that we actually put that there specifically is because we wanted the skill sets and the control belief system to really be embedded within the person who's doing it.
2902470	2913470	We didn't want it filtering out into kind of a business unit or application kind of mentality when looking at the controls within IT.
2913590	2918090	So, yes, it's within our group now. I've seen it a lot of different ways.
2920490	2922650	Yeah, they focus on finance.
2951790	2955790	At what point do you kill a bad app that was developed internally?
2958750	2965350	Well, I think as a whole, our mission is security. So, I mean, that's kind of one in the same.
2966350	2975130	And as far as getting security embedded into the application in the first place, I think that's probably one of the hardest challenges that companies are facing today.
2975130	2983870	And getting that mindset established. You've got developers coming into the organization fresh out of school, didn't really teach them proper coding techniques, that sort of thing.
2983870	2990850	How do you get education into here? How do you get that integrated into the whole development life cycle? And how do you make that process repeatable?
2991650	2998010	Okay, well, we're actually out of time. So, I think I'll take one more question and then these gentlemen and ladies will be around.
3001910	3005430	And they'll be happy to answer your questions, hang out, buy them a beer, you know.
3005870	3008530	Okay, gentleman right here in the corner, yes.
3028640	3034680	And at the end of the day, your job is to inform the business decision makers so they can make an informed decision, right?
3035640	3045240	And you can't do that if you don't understand the business. You have to know, I spend more time in my job learning about how insurance works than probably anything else.
3045920	3048720	Okay, let's give him a round of applause. Thank him for coming up here.