WEBVTT 00:05.550 --> 00:06.450 ...Tangent. 00:06.450 --> 00:08.970 He apparently is somewhere else. 00:08.970 --> 00:10.970 I happen to be walking by. 00:11.770 --> 00:20.550 And the illustrious group of, you know, representing, I guess corporate America is what you guys represent. 00:20.550 --> 00:21.310 Is that correct? 00:22.030 --> 00:22.690 Okay. 00:24.110 --> 00:24.790 CISO. 00:24.790 --> 00:27.830 They told me they wanted me to go ahead and step up here. 00:27.830 --> 00:33.830 If Dark Tangent comes in, I'll be happy to hand over the process to him. 00:33.830 --> 00:39.270 But in the meantime, this is kind of a... I mean, I literally just walked by. 00:39.270 --> 00:44.250 I have no idea what the panel is about or anything. 00:44.270 --> 00:50.370 Something along the lines of CISOs, and they're going to discuss a number of things. 00:50.370 --> 00:54.110 There's a few sample questions in the book in there. 00:54.850 --> 01:08.530 I think one of the sample questions was how do the panelists feel about security research, its impact upon the economy, impact upon the community. 01:08.530 --> 01:25.070 And I think that's especially timely when you consider what happened at Black Hat with Mike Lynn and the now former ISS employee being sued by a myriad of people, apparently. 01:26.310 --> 01:29.410 So why don't we have someone up here on the panel kind of jump in. 01:29.410 --> 01:32.070 You guys be thinking of questions, too, to ask these people. 01:32.070 --> 01:33.710 Actually, first off, let's just go down the line. 01:33.710 --> 01:37.650 You guys go down the line, introduce yourselves, tell who you are, and then we'll get to the question. 01:37.790 --> 01:38.630 Does that sound okay? 01:40.570 --> 01:45.590 Just name, title, and IP address of your VPN. 01:45.590 --> 01:46.990 Just to... 01:47.930 --> 01:49.090 Qualifications. 01:49.090 --> 01:50.770 Yeah, qualifications, too. 01:50.770 --> 01:52.370 So I'm Justin Semeny. 02:03.450 --> 02:05.530 Obviously, I have everything I can do. 02:07.380 --> 02:08.120 Wow. 02:08.740 --> 02:10.520 It's not working. 02:16.400 --> 02:19.540 I'm Justin Semeny from VeriSign. 02:19.540 --> 02:21.320 So I run information security. 02:22.280 --> 02:23.300 That's it? 02:23.300 --> 02:24.220 Wow. 02:24.900 --> 02:26.180 Qualifications. 02:26.260 --> 02:27.020 What's that? 02:27.020 --> 02:27.340 Qualifications . 02:27.340 --> 02:29.700 He's not qualified. 02:31.740 --> 02:36.000 Pamela Fusco, Chief Information Security Officer, Merck Pharmaceutical. 02:36.000 --> 02:37.580 I'm certifiable. 02:38.060 --> 02:39.140 Who next? 02:39.620 --> 02:42.260 This one? 02:42.260 --> 02:43.220 Yeah. 02:43.220 --> 02:44.420 I'm Scott Blake. 02:44.420 --> 02:47.580 I'm a CISO of Liberty Mutual Insurance Companies. 02:48.160 --> 02:52.720 My background is I was the VP of Information Security at Bindview Corporation. 02:52.720 --> 02:58.840 A couple ex-Bindview people around, I see, founded the Razor Security Research Team. 02:58.840 --> 03:07.160 And so I obviously have a bias for very much in favor of information security research, particularly basic research around vulnerabilities. 03:07.520 --> 03:17.520 I think it's essential to improving the technology that we have to work with as part of the businesses that we're trying to operate. 03:17.520 --> 03:18.960 So I'm all in favor. 03:23.580 --> 03:24.160 Hey. 03:24.160 --> 03:24.460 Hey . 03:24.460 --> 03:25.440 Sorry, I'm late. 03:25.660 --> 03:27.980 I've been distracted by other business. 03:29.640 --> 03:31.520 I've got these slides up here, but I... 03:32.500 --> 03:32.820 Doesn't 03:36.590 --> 03:37.170 work. 03:37.170 --> 03:38.030 Doesn't work? 03:38.070 --> 03:39.470 Doesn't work. 03:40.930 --> 03:42.850 So you got through the introductions? 03:43.510 --> 03:43.930 No. 03:43.930 --> 03:44.750 Still going? 03:45.090 --> 03:46.410 Oh, okay. 03:47.270 --> 03:48.490 Thanks, Pam. 03:49.050 --> 03:50.370 Proud to serve. 03:52.610 --> 03:53.750 Hi, I'm David Mortman. 03:53.750 --> 03:56.170 I'm the Chief Information Security Officer for Siebel Systems. 03:56.170 --> 04:00.930 Most of you have the pleasure of having your personal information in one of my systems at one of these people's companies. 04:00.930 --> 04:02.890 So that's why I'm here. 04:04.530 --> 04:09.410 I'm Ken Files, CSO, Capital IQ, a division of Standard & Poor's. 04:10.810 --> 04:14.190 I'm Andre Gold, Director of Information Security for Kynan Airlines. 04:15.630 --> 04:22.050 And I'm Paul Simmons, CISO of ICI, and I sit on the board of the Jericho Forum. 04:22.050 --> 04:24.630 I think people were asking... you were asking about qualifications. 04:24.810 --> 04:28.530 The only qualification I hold is I'm a qualified whitewater canoe instructor. 04:32.210 --> 04:33.650 Okay, sorry I was late. 04:34.110 --> 04:36.330 Typically when we... we've tried this in the past. 04:36.330 --> 04:41.710 I had all these really nice questions and tried to get them off on certain topics. 04:41.890 --> 04:44.150 And we didn't have a lot of time for questions and answers. 04:44.190 --> 04:47.850 So this time I'm going to try something different, which is a lot more audience participation. 04:47.850 --> 04:50.310 I have a couple of questions for them first. 04:50.510 --> 04:52.650 And then we're going to let them talk about it for a while. 04:52.650 --> 04:53.690 I only have two or three. 04:53.690 --> 04:55.690 And then we're going to open it up to the general audience. 04:55.810 --> 05:03.190 And then my job is just to make sure that if you ask like a 30 second question, I'm going to distill it down into like a four second question. 05:03.190 --> 05:04.810 So keep that in mind. 05:06.250 --> 05:08.010 Okay, hey, so question. 05:08.150 --> 05:09.470 Would you hire hackers? 05:09.790 --> 05:14.030 How does the word hacker influence your hiring decision? 05:14.030 --> 05:18.430 Or are you purely concerned about criminal backgrounds? 05:21.130 --> 05:31.210 I mean, if somebody comes to you like a hobbit and says, I'm a self-described gray-bearded Unix hacker, whoever's got the most serious feelings about this? 05:31.210 --> 05:33.510 Well, I've hired a lot of hackers in my time. 05:33.510 --> 05:37.350 So I am very much in favor of using hackers. 05:37.350 --> 05:40.790 And I use the term really in the old school sense. 05:40.790 --> 05:50.010 I mean, we're talking about people who break things for the purpose of knowledge, who generate new knowledge about systems and software and what have you. 05:50.010 --> 05:54.090 And that's essential for doing security research. 05:54.150 --> 06:02.710 However, I would also add to that, that I would not ever recommend hiring a criminal. 06:03.070 --> 06:08.270 Now where the line gets drawn is sometimes a little bit fuzzy, but that may be a whole other discussion. 06:08.270 --> 06:14.110 I mean, would you do a Google search on their hacking handle and see if it pops up on some Chinese defacement team? 06:14.530 --> 06:31.860 I would definitely look at published research that somebody has done, and look at what participation in discussion lists, whether they've contributed positively to the community or not, and if there's somebody who has respect to their peers and so forth. 06:32.890 --> 06:48.100 I would not intentionally dig deep into other activities beyond those positive contributions to the research community, other than a criminal background check. 06:50.280 --> 06:52.340 I've hired people who've gone bad. 06:52.420 --> 06:55.700 So they were good when they came, and then they went to the other side. 06:55.780 --> 06:57.640 And the other thing is, I would do a Google search... 06:57.640 --> 06:59.460 Was it because they were reading 2600 or something? 06:59.460 --> 07:01.020 Because I'm really tough, man. 07:02.080 --> 07:06.380 No, and the other thing is, I would do a Google search, but if they're good, I'm not going to find it anyway. 07:08.020 --> 07:10.300 Yeah, I don't hire hackers. 07:10.300 --> 07:11.860 I hire intelligent people. 07:11.860 --> 07:15.760 And if the two kind of correlate to each other, then so be it. 07:16.020 --> 07:19.660 So you think this whole debate about hiring hackers is a non-issue, pretty much? 07:19.660 --> 07:26.620 I've got a 13-year-old daughter, so I'm pretty much well-tuned with that. 07:28.780 --> 07:34.100 There's a media misconception, I think that's out there, that hacker correlates to criminal. 07:34.640 --> 07:44.760 Which I think most of us would hopefully agree is wrong, that there may be certainly examples of correlation, but that doesn't necessarily prove the rule. 07:44.760 --> 07:46.340 It's sort of like a plumber, right? 07:46.340 --> 07:50.460 You can have a plumber, or you can have a criminal plumber, but they're still basically a plumber. 07:50.580 --> 07:53.130 So yeah, you can be a criminal hacker, or you can be a... 07:54.620 --> 07:59.740 Yeah, over in the UK we have a thing called check certification. 07:59.740 --> 08:01.980 I don't know if anyone here is check certified. 08:02.780 --> 08:06.880 Basically what it means, it's the only certification, as far as I know, in the world for hacking. 08:07.560 --> 08:10.480 And it's actually sponsored by the UK government. 08:10.780 --> 08:14.400 And it means that you're cleared to hack UK government systems. 08:14.460 --> 08:19.340 And that means they've done a background check, and they're happy with you working on government systems. 08:19.600 --> 08:21.260 And personally that's good enough for me. 08:21.260 --> 08:23.600 If you're check certified, I'll hire you anytime. 08:25.640 --> 08:27.980 Anybody have any questions or comments on that? 08:28.760 --> 08:30.600 Yeah, you in the red, please. 08:56.610 --> 09:02.050 So the question was, there was a presenter at Black Hat who was fired for giving his talk. 09:02.050 --> 09:05.350 And he quit two hours before his talk, apparently, but he wasn't fired. 09:05.350 --> 09:09.370 But had he not quit, he would have been fired. 09:09.370 --> 09:17.450 And the question was, would somebody like that have any hiring prospects at companies represented by these types? 09:17.730 --> 09:19.050 I'll answer that. 09:19.930 --> 09:21.570 Yes, I would hire him. 09:23.270 --> 09:26.670 Because I don't consider him to be a criminal. 09:27.030 --> 09:32.050 I consider him to be someone who has brought something to someone's attention. 09:32.410 --> 09:34.850 And he's gotten quite a bit of attention over it. 09:34.850 --> 09:39.190 But I think that we all learn from what has happened in the past, and I hope that we move forward. 09:39.190 --> 09:41.850 So I think that he's a qualified individual. 09:42.150 --> 09:48.630 And if I had a position and he passed the HR criminal blah, blah, blah, he would be gainfully employed. 09:49.970 --> 09:51.230 Anybody else? 09:52.050 --> 09:53.670 I just second it. 09:54.050 --> 09:57.950 Insofar as there was a call for security research. 09:57.950 --> 10:00.050 I don't currently run a security research team. 10:00.110 --> 10:01.870 But if I did, then sure. 10:02.330 --> 10:03.730 With the same caveat. 10:04.170 --> 10:06.210 I think there's another question over here. 10:06.310 --> 10:06.870 Sir? 10:30.270 --> 10:31.770 What are your peers up to? 10:31.770 --> 10:33.110 Are they hiding from this issue? 10:33.110 --> 10:34.290 Are they indifferent? 10:34.690 --> 10:37.810 I think it's our responsibility to bring security to their attention. 10:37.810 --> 10:39.070 That's what they pay me for. 10:39.070 --> 10:41.610 And I'm lucky in that respect. 10:41.610 --> 10:44.830 I get quite a bit of support from the executive staff. 10:45.250 --> 10:50.250 And I think that they would trust the opinion of what I'm bringing to the table. 10:50.250 --> 10:53.290 But I also trust, it's not just me, it's my team. 10:53.430 --> 10:58.250 And I have about five people in this room that come with me to Black Hat and to DEF CON. 10:58.250 --> 10:59.630 And I trust them. 10:59.690 --> 11:02.170 And if they're, you know, they're going to be working with these people. 11:02.350 --> 11:04.910 I just sign the paperwork and pay the bills, right? 11:04.910 --> 11:10.370 So if they're in agreement that an individual such as that is welcome on the team, I'll be damned. 11:10.370 --> 11:13.430 Then I'll take it to the highest level I need to to get the person hired. 11:15.350 --> 11:17.890 One more question, we'll move on to a new one. 11:17.890 --> 11:18.250 Sir ? 11:21.570 --> 11:23.770 I'm sorry, talk a bit louder, please. 11:34.660 --> 11:38.480 Well, that's a broader question than whether or not they're going to hire hackers. 11:38.480 --> 11:39.600 It's a privacy question. 11:40.260 --> 11:42.880 We could ask them about the Patriot Act later, that's not a problem. 11:42.880 --> 11:45.500 But is it a hiring a hacker related type question? 11:47.520 --> 11:48.380 What's that? 11:49.700 --> 11:51.760 That has violated the Patriot Act? 11:59.930 --> 12:02.790 It's being done every five seconds. 12:02.790 --> 12:06.430 I mean, plenty of people are hacking every day and they're not being busted on the Patriot Act. 12:09.630 --> 12:11.550 Okay, so let's move on to the next... 12:11.550 --> 12:13.070 Oh, do you have one more question, sir? 12:38.490 --> 12:39.610 Right, right. 12:39.610 --> 12:41.830 And I think there's a question on this earlier. 12:41.830 --> 12:45.410 His question was, how do you rate private versus professional experience? 12:45.450 --> 12:47.910 Versus maybe academic security experience? 12:47.910 --> 12:50.570 And weigh that in a hiring type decision? 12:50.610 --> 12:53.750 And it also kind of relates to what we talked about earlier, which is certification. 12:53.990 --> 13:01.370 You know, would you hire somebody with a CISSP or a security MCSE over somebody with nothing? 13:01.590 --> 13:04.030 So, from 13:07.790 --> 13:11.590 my perspective, actually, work experience... 13:12.670 --> 13:14.170 Would you turn it off again? 13:14.170 --> 13:15.150 No, you have to be really close to me. 13:15.470 --> 13:18.590 So the work experience actually means a lot. 13:18.610 --> 13:25.630 When we get specific down into the skill sets of actually hacking or breaking applications or breaking OSs or networks, etc. 13:25.770 --> 13:33.630 I agree, there's not really a lot of corporate jobs that you can actually reference on a resume in order to prove those skill sets. 13:33.630 --> 13:36.630 A lot of that actually just comes out in the interview process. 13:36.750 --> 13:40.390 You break them down and be able to say, how would you do X, Y, and Z? 13:40.390 --> 13:44.890 Or what is your mentality or thought process going through an actual attack? 13:44.890 --> 13:48.090 And making sure that it's mature and it's done in a well-defined manner. 13:48.090 --> 13:51.350 And it's not a script-kitty kind of attack. 13:51.350 --> 13:54.870 It's actually very well thought out and very detailed. 13:56.250 --> 13:58.750 I mean, so just to expand on that a little bit. 13:59.870 --> 14:07.310 Degrees, certifications, they hold their place in a sense that you have concepts as well as degrees. 14:07.310 --> 14:12.350 And our organization as well allows for mobility up that corporate ladder, so to speak, as well. 14:12.350 --> 14:21.670 But when I'm out there like Pam said and everything else, looking to bring on people to augment my staff or respective duties and everything else, it's all about the experience. 14:21.750 --> 14:27.530 I mean, the degrees and those type of things, they're okay, but they're kind of like the last thing that I look at. 14:27.530 --> 14:29.550 It's like, okay, where has this guy or girl been? 14:29.550 --> 14:31.790 What have they done and what can they bring to the organization? 14:33.530 --> 14:36.850 Half the people in my team don't actually have degrees of any sort. 14:36.850 --> 14:38.790 I think they have high school degrees probably. 14:40.590 --> 14:45.870 Work experience is more of a metric for getting the resumes onto my desk than for actually as a hiring metric at that point. 14:46.390 --> 14:51.450 More important than actually even experience for me and my team is just getting the ideas. 14:51.650 --> 14:53.430 I can teach them the technical skills they need to have. 14:53.430 --> 14:55.530 I can teach them the project management skills they need. 14:55.530 --> 15:03.250 But if they just don't get it, they don't get the idea of security, they don't get the idea of risk management, it doesn't matter if they've been doing this for 10 years or if they have a PhD in computer science. 15:03.250 --> 15:04.150 I don't care. 15:08.170 --> 15:21.970 Getting this back to reality, the bottom line is when you're faced with 600 or 800 CVs on your desk or certainly going through a human resources department, you go degree, no degree, degree, no degree, degree, no degree. 15:22.490 --> 15:28.670 Ultimately, a relevant degree says that you are capable of a certain degree of learning. 15:29.050 --> 15:34.710 And yeah, absolutely, you bring them into your business and you teach them and you put them on training courses and everything else. 15:34.710 --> 15:39.490 But the degree says at least they have the capability and the wherewithal to go out and learn new skills. 15:39.490 --> 15:44.430 And it might not be perfect, but it is generally a fact of life in the corporate world. 15:44.950 --> 15:49.270 The other qualification I tack onto that is publications. 15:49.790 --> 16:06.550 For someone who's going to be doing research or red team kinds of activities, I would want to see published new vulnerabilities or published papers on techniques, things like that, as part of the qualification, seconding the other things that have been said. 16:06.550 --> 16:08.250 Degrees do count, unfortunately. 16:11.250 --> 16:15.250 I think one thing being left out of the equation is attitude also. 16:15.850 --> 16:19.070 If you've got the worst attitude and you're the best hacker, I don't want you. 16:19.070 --> 16:21.610 If you can't play well with others, I don't want you. 16:26.650 --> 16:30.610 We'll have one last question and then we'll move on to a new topic. 16:49.990 --> 16:55.690 I think you've got to let them devote a certain amount of their time. 16:56.070 --> 17:02.070 I don't have my folks doing 100% of their focused time on one particular task. 17:02.070 --> 17:05.470 I let them work in different areas of security. 17:05.470 --> 17:10.690 We provide them with the training that they'd like to go to within reason. 17:11.530 --> 17:13.290 Those are just a few of the things. 17:13.290 --> 17:19.770 We also do peer training and sit-downs, lunches, outings, that sort of thing. 17:20.770 --> 17:22.450 Send them to DEF CON. 17:23.110 --> 17:24.070 Thanks, Pam. 17:25.970 --> 17:33.870 Next topic is kind of near and dear to my heart, related to the whole Enron case, and that's data retention. 17:33.870 --> 17:38.990 In the wake of Microsoft, how long do you keep data? 17:38.990 --> 17:46.370 Do you do it as a defensive measure against lawsuit, or is it just sheer log bloat? 17:46.530 --> 17:51.730 What's your overall thought on log retention, data retention? 17:51.730 --> 17:52.450 Anybody? 17:52.870 --> 17:54.870 I'll jump in here. 17:55.150 --> 18:03.030 Log retention, or data retention more specifically, can actually be driven more by external legislation. 18:03.030 --> 18:07.890 Be it credit card information, personal information, et cetera. 18:07.890 --> 18:14.230 So there's a lot of limitations and requirements on how long we have to hold it and when we actually have to delete it. 18:14.370 --> 18:21.430 Outside of that, the perspective is basically, on a yearly time frame, we go through most of the data. 18:22.870 --> 18:33.130 The main reason for keeping the data is not only providing a service from the application side, but it's also being able to go back in time for issues like litigation. 18:34.190 --> 18:37.070 So would you say a year, six months, ten years? 18:37.070 --> 18:38.330 I would say about a year. 18:38.330 --> 18:43.450 There are certain things that we have that definitely go beyond that, but about a year is pretty much the baseline. 18:44.130 --> 18:52.690 Unfortunately, we delete data a lot sooner than that, unless there are regulatory requirements around that data. 18:52.690 --> 18:56.490 Data has proven to be a liability to us as well within court. 18:56.490 --> 19:05.770 And so our legal department actually comes down and mandates that data over the 60 days actually be removed and be expunged from the environment. 19:06.030 --> 19:16.830 Our data retention policy is about 80 pages, and it's driven by a wide variety of state and federal legislation for different types of information. 19:18.130 --> 19:22.850 And there are a lot of different things, and everything has its own rules for how it gets... 19:22.850 --> 19:24.750 So it's a total nightmare mess. 19:25.350 --> 19:28.430 I wouldn't call it a nightmare, but it's complex. 19:29.010 --> 19:42.150 Yeah, I mean, we're driven by legislation, and we've got places, because we're a chemical company, where we have to keep data on people, and particularly their state of health, for ten years after they die. 19:42.150 --> 19:49.690 So potentially, that's up to 100 years, which is a real issue because, of course, media changes the whole time. 19:49.690 --> 19:51.630 Media doesn't have a 100-year lifetime. 19:51.630 --> 19:53.730 I was going to say, you've got a lot of money in MacStore and Hitachi, then. 19:53.850 --> 19:55.210 We're going back to microfiche. 19:55.210 --> 19:57.710 Microfiche is about the only thing that actually works properly. 20:00.410 --> 20:01.730 Okay, sir. 20:09.120 --> 20:13.620 The question is, how many of you have assigned policies dictating how long you'll keep the data? 20:13.700 --> 20:14.380 Signed policy? 20:14.380 --> 20:15.520 Yeah, signed policy. 20:15.680 --> 20:16.380 Everybody. 20:16.860 --> 20:29.880 We keep data 100 years in the pharmaceutical industry, which is crazy, because when you store data 100 years from now, the technology that we used in, like, you know, 1801, it doesn't exist in 2005. 20:36.410 --> 20:38.110 I'm sorry, who's speaking now? 20:38.270 --> 20:39.510 Stand up, please. 20:39.570 --> 20:40.710 Oh, okay. 20:43.630 --> 20:46.270 So the question is, how do you secure that data once it's archived? 20:46.270 --> 20:50.450 Do you put it in a big hole in the wall, or do you... hole in the ground? 20:50.910 --> 20:51.670 Salt mines. 20:51.670 --> 20:52.390 Salt mines. 20:52.390 --> 20:54.570 Salt mines are really good. 20:56.510 --> 20:57.350 Sunglasses? 21:07.060 --> 21:07.640 Right, right. 21:07.640 --> 21:11.600 So now that you're storing data for 100 years or whatever, does it ever come in handy? 21:11.600 --> 21:13.580 Have you ever actually used it for anything? 21:14.340 --> 21:17.100 Ten years, but we were founded in 95, so... 21:19.440 --> 21:23.080 I think the furthest we've had to go back is in the order of about 30 years. 21:23.200 --> 21:25.140 We were founded in 1928. 21:25.820 --> 21:27.900 What was the circumstance for that? 21:27.900 --> 21:33.360 It was a health claim against us for a disease that they developed, and they blamed it on us. 21:33.820 --> 21:34.860 It wasn't me. 21:36.660 --> 21:38.960 It didn't... they didn't win it. 21:40.300 --> 21:46.040 I don't know what the exact number is for us, but the company was founded in 1912, and we sell life insurance and have since then. 21:46.040 --> 21:48.600 So, probably that far back. 21:56.930 --> 21:58.010 General counsel. 21:58.150 --> 21:58.950 Legal. 22:00.150 --> 22:03.090 Pretty much everybody raise your hand if it's driven by legal. 22:03.470 --> 22:04.290 Yeah. 22:05.290 --> 22:07.830 If you could have your way, would you get rid of it? 22:09.070 --> 22:09.690 No. 22:09.690 --> 22:12.350 So you think it is in the appropriate position. 22:12.350 --> 22:14.830 So that's totally the correct location for that. 22:14.830 --> 22:15.450 Okay. 22:22.390 --> 22:23.310 Absolutely. 22:29.640 --> 22:35.860 Yeah, the data retention policies dictate not only how long to retain, but also when to destroy. 22:35.860 --> 22:42.800 So a lot of our policies are written in terms of the maximum retention period, not only the minimum required retention period. 22:42.800 --> 22:44.860 And when you reach those maximums, you just purge. 22:44.860 --> 22:45.260 Yep. 22:45.260 --> 22:49.300 And hopefully that Stone Mountain place doesn't have your hands on their tapes, right? 22:49.620 --> 22:51.340 They probably lost it anyway. 23:01.080 --> 23:08.360 Do you think that the burden or the overhead impaired by performing these retention policies is a burden on the business function? 23:12.130 --> 23:12.750 Yeah. 23:13.650 --> 23:18.970 At ICI Corporate Centre in London, we have a 15-month deletion policy on email. 23:19.270 --> 23:24.810 And basically we force our employees, when it comes up to 15 months, to actually sort it, go through it. 23:24.810 --> 23:25.730 This is automated. 23:25.730 --> 23:28.450 It puts it into a bucket and says, you will sort this. 23:29.350 --> 23:41.650 And you're forced to go through and either delete it or put it into the archiving system, at which point you have to give it a title, a date, what it's about, and when it needs to be deleted automatically. 23:41.790 --> 23:42.950 But yeah, absolutely. 23:42.990 --> 23:46.530 You can work on projects for three years in some cases. 23:46.530 --> 23:47.640 So yeah, it's a real problem. 23:48.150 --> 23:54.090 There are certain issues where we have internal monitoring projects to monitor individual activity. 23:54.210 --> 23:57.850 And we actually have a very short retention for that data. 23:57.850 --> 24:01.090 Obviously, there's a lot of personal stuff going through the network. 24:01.090 --> 24:09.390 And we do have investigations that we need to go back a year to really see what the full activity of a particular individual is. 24:09.390 --> 24:13.890 So that would be one of the cases that we would have that it would impede what we do personally. 24:13.890 --> 24:27.530 From a business standpoint, I mean, really the federal requirements or the industry requirements on data retention that are applicable to us really kind of really has changed the business and how they perform the service. 24:27.530 --> 24:29.950 So not really from a service standpoint. 24:31.230 --> 24:33.070 Okay, I've got one more question. 24:33.070 --> 24:34.070 Oh, sir. 24:42.590 --> 24:45.910 So the question is, are there data privacy laws surrounding how you retain the data? 24:45.910 --> 24:47.250 Do you have to keep it encrypted? 24:47.410 --> 24:48.210 Rot13? 24:48.330 --> 24:50.310 You know, how do you keep it encrypted? 24:50.670 --> 24:52.770 The paper files are really hard to encrypt. 24:52.770 --> 24:53.670 Rot12 , its successor. 24:53.830 --> 24:54.230 Yeah . 24:56.310 --> 24:59.430 So you say microfiche, and then you physically have control of it. 24:59.430 --> 25:01.830 And then you put it somewhere and hope it doesn't burn down. 25:01.870 --> 25:09.250 So when you look at things like PCI, or Visa's MasterCard certification program, where they actually require the encryption of credit card data. 25:09.530 --> 25:11.670 Well, for the companies that do it. 25:13.330 --> 25:14.490 We all do. 25:14.490 --> 25:15.210 Absolutely. 25:16.510 --> 25:24.830 Basically, going back to the point, I think the encryption of the actual data on the tapes before they're shipped out is very important. 25:24.870 --> 25:31.830 The encryption of the data within the database is, even though they're running in production, like the credit card data, social security numbers, et cetera. 25:31.830 --> 25:36.910 I mean, it's absolutely imperative that we do that because application security is getting a lot more dangerous nowadays. 25:37.230 --> 25:41.090 And without it, it's just a recipe for disaster. 25:41.370 --> 25:47.810 So from a data encryption perspective, it also depends on what the data is and where the data is going. 25:47.810 --> 25:50.190 So there's encryption regulations. 25:50.190 --> 25:52.290 Data in transit needs to be encrypted. 25:52.290 --> 25:54.750 But in some cases, data at rest does not. 25:54.750 --> 25:59.410 There's also, because we're international, different encryption laws. 25:59.410 --> 26:02.170 Paris is different than what we do in Germany. 26:02.690 --> 26:03.950 Location of the data. 26:03.950 --> 26:06.010 There's no off-site storage in Germany. 26:06.010 --> 26:06.570 And I may be wrong. 26:06.570 --> 26:07.230 It may have changed. 26:07.230 --> 26:08.530 But last I checked, it wasn't. 26:08.530 --> 26:15.870 So we have to be very careful when we're talking about what we're doing with what parts of the data and with what region specific as well. 26:16.510 --> 26:17.950 And which algorithms. 26:19.910 --> 26:21.530 So Jeff's a little busy. 26:21.950 --> 26:22.530 Sorry. 26:22.530 --> 26:26.130 Yeah, there's some action going around pool two right now I needed to know about. 26:27.850 --> 26:29.830 I'll chime in on that if I could, actually. 26:29.830 --> 26:30.530 Pool two action? 26:31.090 --> 26:32.930 No, not that. 26:33.670 --> 26:36.370 I mean, I don't know if anyone remembers the quote. 26:36.470 --> 26:37.610 I don't know if Bruce is here. 26:37.610 --> 26:43.870 But it was, if you think encryption will solve your problem, you don't understand encryption and you don't understand your problem. 26:43.950 --> 26:45.310 It's a great quote. 26:45.870 --> 26:49.350 And I think if we look carefully, I have to disagree with Justin a little bit. 26:49.350 --> 26:59.330 But if we look carefully at some of the issues where we look at how things are needing to be encrypted or whether they should be encrypted, look at something like backup tapes. 26:59.570 --> 27:05.850 Backup tapes, it's a great idea to store them in an encrypted format until you need to actually restore from the tape. 27:06.550 --> 27:10.010 Then you have a problem because you need to decrypt that information. 27:10.570 --> 27:15.090 And now that, depending on where you are, I mean, if it was just a simple drive failure, then that's fine. 27:15.090 --> 27:21.250 But if your data center exploded and all your key material was there, you have a major problem. 27:21.330 --> 27:22.710 So where are you going to store the key material? 27:22.710 --> 27:24.690 Well, the safe place to store it is with the tape. 27:24.710 --> 27:26.070 So what's the point of that? 27:26.430 --> 27:29.010 You've got your key taped to the tape. 27:29.230 --> 27:32.490 And so you can be sure that you'll be able to get the data back off of it. 27:32.490 --> 27:36.110 And the guy who designed the key system is retired last year. 27:36.210 --> 27:36.870 Exactly. 27:37.030 --> 27:40.190 10, 20 years down the road, how are you going to do that? 27:40.190 --> 27:44.910 You look at some of the application things, especially encrypting data at rest in a database. 27:45.010 --> 27:50.870 Something on that application server or database server knows how to decrypt that data or it's completely useless. 27:50.990 --> 27:55.910 The problem then for the folks in the room becomes find that piece of software and control it. 27:55.950 --> 27:57.250 It's sitting in memory. 27:57.250 --> 27:58.670 The key is sitting in memory somewhere. 27:58.670 --> 27:58.890 Wherever it is. 27:58.890 --> 27:59.570 It could be anywhere. 27:59.570 --> 28:03.030 It could be sitting on a smart card that's plugged into the machine. 28:03.030 --> 28:05.310 But something knows how to get it. 28:05.390 --> 28:08.970 Some piece of code on that machine knows how to decrypt the information that's in that database. 28:08.970 --> 28:11.110 And somebody's going to be able to figure out how to get it off. 28:11.310 --> 28:17.310 Well, I guess the point of the encryption of the tapes is not necessarily for protection. 28:18.450 --> 28:21.290 It's not necessarily the encryption on the tapes. 28:21.290 --> 28:25.170 It's more so protecting it when that data is in someone else's hands. 28:26.590 --> 28:28.750 We don't put our keys on our tapes. 28:28.930 --> 28:30.350 And it is a problem. 28:30.350 --> 28:33.310 There's no question about it in regards to how you manage those keys. 28:35.110 --> 28:38.670 For us, we've had a little bit of experience in the keys. 28:38.670 --> 28:41.670 How we actually have a distributed model and how we actually put it out. 28:41.670 --> 28:45.010 But yeah, to your point, there are some fundamental flaws. 28:45.010 --> 28:47.990 But you really have to understand your use case for encryption. 28:48.190 --> 28:52.910 And if you think encryption is going to protect you from everything, I absolutely agree. 28:52.910 --> 28:54.530 You don't understand encryption. 28:55.210 --> 28:57.170 Okay, this is the last one on this topic. 28:57.170 --> 28:59.850 We can revisit it when we go to general questions and answers. 29:04.150 --> 29:07.750 How do you deal with... 29:08.310 --> 29:11.430 Right, so we talked about this briefly, but how do you deal with obsolescence? 29:11.430 --> 29:17.290 Are you constantly updating your backup technology and taking all your tapes from five years ago and updating today's technology? 29:17.290 --> 29:20.890 Do you go through this rev cycle every five years? 29:20.890 --> 29:22.910 Do you decide it's time to re-upgrade everything? 29:24.390 --> 29:25.110 Anybody? 29:25.470 --> 29:27.070 I'll say it again, microfiche. 29:27.270 --> 29:28.910 Microfiche is where it's at, guys. 29:29.370 --> 29:33.170 We have seriously looked at it because we've got this requirement for 100 years plus storage. 29:33.170 --> 29:34.850 We have seriously looked at the problem. 29:36.090 --> 29:37.890 Do you do it in machine code? 29:37.890 --> 29:39.070 I mean, how is it machine readable? 29:39.070 --> 29:41.190 Is it in 3D barcode? 29:41.190 --> 29:42.150 No, we print it. 29:43.390 --> 29:48.410 You print it onto A4 paper in our case, or letter paper in your case. 29:48.490 --> 29:51.110 And you photograph it and put it onto these... 29:51.110 --> 29:56.350 Right, and the printout is encoded in a printed format in what, a 3D barcode? 29:56.350 --> 29:57.910 A giant full page 3D barcode? 29:57.910 --> 29:59.890 Is it ones and zeros on the whole page? 30:00.030 --> 30:03.410 No, no, no, it's their data. 30:03.410 --> 30:07.430 If they filled in a form, we print the form and we microfiche it. 30:07.430 --> 30:08.470 Oh, I see, I see. 30:09.930 --> 30:11.070 Blow it up. 30:12.610 --> 30:15.590 Well, I'm just wondering what my Microsoft... 30:18.370 --> 30:21.110 So you're saying it's definitely not Unicode, right? 30:21.490 --> 30:22.830 No, definitely not, Jeff. 30:24.530 --> 30:25.830 So do you print it? 30:25.830 --> 30:28.510 Yeah, I'm just wondering, how do you print Microsoft Word binary? 30:30.070 --> 30:31.470 With great difficulty. 30:31.470 --> 30:32.250 Print it. 30:32.250 --> 30:32.810 Hit print. 30:32.810 --> 30:35.390 And it comes out squiggle question mark space space dash. 30:36.990 --> 30:40.610 No, we're talking the application Microsoft Word, the application. 30:41.210 --> 30:42.290 You don't care. 30:42.290 --> 30:43.270 Okay, okay. 30:43.270 --> 30:44.610 So it's in hex. 30:44.610 --> 30:45.550 It's in hex. 30:49.610 --> 31:00.850 Well, the only reason I'm wondering is because years ago some guy sold an application that would 3D encode your application, print it out on your Epson FX80 printer, and then all you have to do is re-scan it in, and you would have incredible data densities, 31:00.850 --> 31:04.710 because basically each dot on the data matrix printer was, you know, one or zero. 31:04.710 --> 31:07.050 And they were claiming this thousand-year thing. 31:07.050 --> 31:10.290 With a basic algorithm, you could reconstruct the data whenever you wanted. 31:10.290 --> 31:12.830 It has built-in CRC checking and redundancy. 31:12.830 --> 31:14.570 But they only had it on floppy. 31:14.970 --> 31:15.910 Yeah, okay. 31:15.910 --> 31:16.930 They only sold it on floppy disks. 31:16.930 --> 31:19.390 But the business doesn't care about storing the application. 31:19.390 --> 31:20.410 They only care about the data. 31:20.690 --> 31:27.470 So the data gets printed out in a report, and it's paper or microfiche or whatever, and it's the data that gets stored. 31:27.470 --> 31:28.450 So, okay. 31:28.450 --> 31:31.170 I'm just concerned that you have the data but nothing to interpret it. 31:31.410 --> 31:32.350 You have people. 31:32.370 --> 31:33.490 It's in English. 31:33.710 --> 31:34.330 Okay. 31:34.950 --> 31:35.670 Right? 31:38.730 --> 31:40.150 You want to back up the... 31:50.820 --> 31:52.680 I think we addressed this. 31:53.140 --> 31:54.960 You know, a hundred years of data. 31:55.080 --> 32:01.280 We've just gone through, you know, last year a recall on a product that we had, and we had to find all of the data. 32:01.280 --> 32:02.280 It's a problem. 32:02.480 --> 32:04.940 So we're not going to sit here and tell you that we have a cure. 32:04.940 --> 32:07.520 I mean, you know, we have drug cures, but it's a problem. 32:07.520 --> 32:20.800 You have to understand, again, this whole data at rest issue is huge because I don't think that folks realize how much data they were going to need, what purpose they would need to recover it for, and when they would need to recover it. 32:20.800 --> 32:21.660 So you're right. 32:21.660 --> 32:22.580 It's an issue. 32:22.580 --> 32:26.560 Right now, for Merck, we have a lot of data that's paper-driven because we have wet signatures. 32:26.560 --> 32:28.840 We have a lot of data that's not. 32:28.880 --> 32:30.160 So it is an issue. 32:30.160 --> 32:32.580 You have to figure out what it is you're going to do. 32:32.580 --> 32:36.620 And I think part of it is what data you need to make assumptions. 32:36.620 --> 32:36.780 Ms. 32:36.780 --> 32:38.760 Cleo's crystal ball, I say this all the time. 32:38.760 --> 32:45.920 What data may I need to go back and look at 100 years, 15, 25, two months today, tomorrow, whatever, and how do I get to that? 32:45.920 --> 32:48.040 And what technology is going to be there? 32:48.040 --> 32:56.480 And that's when you really have to have your peering partners with your vendors and hope that they're cutting-edge solutions because you work with them to migrate off of what's old and bring it to the new. 32:56.480 --> 32:58.860 We try to do that with Microsoft, but anyway. 32:59.400 --> 33:02.660 So you really need to have peering partners with your vendors. 33:02.820 --> 33:04.020 Okay, new topic. 33:04.340 --> 33:16.980 So if you had to rate the danger from hackers, evil outside influences that are like bored college students, versus organized criminals, versus internal employees, how would you prioritize those three? 33:16.980 --> 33:18.560 What keeps you up at night? 33:18.700 --> 33:20.920 The inside employee or the Russian mafia? 33:23.040 --> 33:23.940 Oracle? 33:23.940 --> 33:25.940 Oracle keeps you awake? 33:35.260 --> 33:36.140 Marianne's not here. 33:36.140 --> 33:36.500 It's okay. 33:36.500 --> 33:37.820 She won't kick my ass. 33:39.120 --> 33:40.440 Till later. 33:41.620 --> 33:47.600 No, seriously, internal employees, industrial espionage, and then outside influences. 33:48.300 --> 33:53.460 For us, it's the organized crime, the internal, and then the hacker. 33:54.260 --> 33:55.860 Any of you guys? 33:57.300 --> 34:02.680 Yeah, for us, it's the outside industrial espionage, number one. 34:02.680 --> 34:03.860 Is your number one? 34:04.860 --> 34:06.520 It'd be the internal employee. 34:07.100 --> 34:13.620 So it's internal employee and industrial espionage are your top two, and the outside hacker is pretty much in the grass. 34:13.740 --> 34:15.840 Not to disrespect anyone. 34:17.900 --> 34:33.200 Yeah, I mean, I made the comment at Black Academy, and one of the reasons why it's the internal employee, because we don't necessarily have a culture that's conducive to actually permeating security within our fabric, our employee base and everything else like that. 34:33.800 --> 34:37.100 We've traditionally built applications predicated on three things, right? 34:37.100 --> 34:38.300 Cheap, fast. 34:38.360 --> 34:40.160 You can build them cheap, fast, or secure. 34:40.320 --> 34:45.820 You can have any two of those, but it's real hard to have all three of those attainable in any project or application that you work on. 34:45.820 --> 34:54.140 And so we've traditionally done the cheap and the fast as a way to convince our business units that, hey, technology can add value. 34:54.300 --> 35:06.380 Now in this day and age and everything else, going back and trying to get security development integrated into the SDLCs and then just the methodology and mindset within the employees is somewhat of a challenge for us. 35:06.720 --> 35:15.100 So when security vendors are selling all the new blinky-blinky products that are all focused to protect you from hackers, that's not terribly relevant to what you want to buy. 35:15.100 --> 35:16.320 No, you just call bullshit. 35:16.380 --> 35:17.280 Go with it. 35:18.120 --> 35:19.640 Well, you know what, though? 35:20.440 --> 35:27.060 I think that an internal individual that crosses the line is the external individual. 35:27.120 --> 35:32.600 And who's also to say, not to say that the internal employee, the trusted employee, I'm not pegging on you here, Dave. 35:32.600 --> 35:33.600 Sit in for him. 35:33.860 --> 35:37.940 doesn't share that information with an external person on a chat board, right? 35:37.940 --> 35:38.940 How else are they going to get it? 35:38.940 --> 35:41.180 So I think, for me, it's one and the same. 35:41.180 --> 35:43.560 But I just go to bed at night now because I'll be there in the morning. 36:19.410 --> 36:21.690 Okay, well, I mean, I'll kick off with that. 36:21.690 --> 36:23.130 I mean, we're a chemical company. 36:23.210 --> 36:32.810 At the end of the day, you can go out and buy our product, our brand new product, and you put it into a gas chromatograph and you can get a spectral analysis and you can go out and copy it. 36:32.810 --> 36:33.870 It's very easy. 36:34.610 --> 36:43.010 What is going to keep paying my salary and my bonus going forwards is what we've got in the heads of our scientists and what's in our computers, what's coming next. 36:43.010 --> 36:46.010 It's how we steal a march on the competition. 36:46.690 --> 36:50.890 It's an intellectual property, absolutely, and it is key to our business. 36:51.250 --> 37:01.450 So it might be totally trivial things like paint that you paint on and starts pink and dries white, which is one of our latest tricks. 37:01.750 --> 37:06.790 It might seem daft, but it's actually stealing a march for those people who want to overpaint their ceilings. 37:08.310 --> 37:11.750 And it's selling very well at the moment. 37:11.750 --> 37:15.910 And the competition will bring something out in the near future, absolutely. 37:15.910 --> 37:18.730 So it's how you can get that edge on the competition. 37:18.810 --> 37:22.670 And that's all tied up in an intellectual property, and ultimately that's what I'm there to protect. 37:23.250 --> 37:35.010 How you do it, of course, is the whole range, because you've got Trojans out there, you've got hackers out there, you do have industrial espionage, and we know we have a lot of that out there trying to steal those secrets. 37:35.110 --> 37:39.750 And, of course, you've got the mafia and the organized crime coming on. 37:39.750 --> 37:44.670 But they're sort of carpet bombing you, rather than trying to do anything targeted at the moment. 37:45.070 --> 37:50.730 When they get bored beating up the banks and the gambling sites, maybe they'll turn their attention to us, who knows. 37:52.330 --> 37:58.810 For me, my main priority is protecting our customers' data, whether that's on our site or other customers' sites. 37:58.810 --> 38:04.250 So I'm spending most of my time these days beating up on product marketing and engineering, trying to get new features into the product. 38:06.410 --> 38:08.850 So I spend most of my time dealing with audit. 38:09.650 --> 38:14.290 Which is... yeah, it's a bit of a problem, actually, with a lot of companies. 38:14.890 --> 38:25.810 Where we actually find a lot of our attention being focused in areas that probably, maybe, in our opinion, aren't necessarily where they should be focused on. 38:25.810 --> 38:32.750 I mean, I'm a very big believer in audit, but some of the rules and requirements coming out of SOX are a little bit misguided. 38:32.750 --> 38:34.570 Audit for audit's sake is not... 38:34.570 --> 38:35.510 Exactly. 38:35.510 --> 38:37.050 I mean, there needs to be a purpose to it. 38:37.050 --> 38:41.970 I mean, so when we go through and we do an audit, I mean, I would expect that we hit the source code. 38:41.970 --> 38:43.490 We go through the entire application. 38:43.490 --> 38:49.910 We actually review it for true load testing, not just, does everybody have a password? 38:50.470 --> 38:54.430 Which is important, too, but there's a lot bigger issues out there. 38:54.430 --> 39:01.090 But as far as the culture within the company, I think awareness campaigns kind of get a little bit of a slack internally. 39:01.090 --> 39:06.350 But it's very important to really consistently beat that drum of what's important. 39:06.350 --> 39:07.270 Do your job. 39:07.270 --> 39:10.010 These are the things not to do, etc., etc. 39:10.770 --> 39:16.150 My job is actually not to protect the company from information security threats. 39:16.150 --> 39:27.210 My job is to understand the information security risks that the company faces, which is risk in combination with threats, vulnerabilities, and assets, right? 39:27.210 --> 39:43.910 Putting those all together and educating our business leaders as to what those risks are, how seriously they should take them, and to facilitate them making a decision about what is the level of risk that they want to accept. 39:43.990 --> 39:46.330 Because ultimately, at the end of the day, it's a business decision. 39:46.330 --> 39:46.850 Exactly. 39:46.850 --> 39:47.970 And we're insurance, right? 39:47.970 --> 39:49.550 We're in the risk management business. 39:49.550 --> 39:51.050 We understand this stuff. 39:51.270 --> 39:54.510 At least we understand risk management in other areas anyway. 39:54.510 --> 39:59.030 We would love to have better data, which would enable us to do more management on that front. 39:59.030 --> 40:02.750 But in the meantime, it's more art than science. 40:02.770 --> 40:11.830 And that's what my job is, is to try to present a picture of what the situation is to our business people so that they can make a decision about what to do. 40:11.970 --> 40:13.710 Okay, I'm going to go to this gentleman over here. 40:18.430 --> 40:19.230 Yay. 40:20.210 --> 40:21.710 Yeah, we're leaving now. 40:21.990 --> 40:23.870 I work for a private company. 40:23.870 --> 40:25.610 He's going. 40:29.930 --> 40:31.130 Yes. 40:31.670 --> 40:32.710 Hey, I'm in the middle. 40:32.710 --> 40:37.970 No, I mean, identity management, for some sakes, is pretty important. 40:37.970 --> 40:42.690 I don't like to have people tell me what I should do when they don't understand our business. 40:42.690 --> 40:45.270 Or they don't understand our infrastructure. 40:45.310 --> 40:49.210 Or they don't understand a basic operating system. 40:49.210 --> 40:59.410 I mean, a lot of the audit organizations aren't necessarily very technical in nature, and therefore can't really understand what the actual risk is on your particular environment. 40:59.410 --> 41:10.050 Or actually how to do some of the artwork in regards to the multiple layers of mitigation that were implemented to protect, you know, your application or your OS or your network or whatever. 41:10.050 --> 41:22.210 The identity management issue is, I mean, we need to be able to very clearly and concisely identify who has access to what and who they are and what they did. 41:22.210 --> 41:27.490 And centrally, it's important, but it needs to be driven in the right way. 41:27.590 --> 41:34.290 Right, and just to expand on that, too, you know, identity management is another one of those, you know, vogue topics within, you know, information security and everything else. 41:34.290 --> 41:45.810 So the problem with identity management is that if you don't have role clarity within your organization, meaning that I, as Andre Gold, an employee of Cutland Airlines, gets access to X, our inner resource and everything else, it doesn't matter, you know, 41:45.810 --> 41:48.690 what identity management technology solution that you have. 41:48.690 --> 41:57.630 I mean, there's business process and definitions that need to be defined at the role level before you can even think about, you know, any sort of federated identity management or anything like that. 42:04.450 --> 42:13.750 Understanding the process, understanding the roles, understanding the application, understanding, you know, what a maintenance worker needs access to versus a pilot, you know, for my particular organization. 42:14.370 --> 42:16.370 Understanding those type of things. 42:16.930 --> 42:19.770 Can I take a question from the guy in the back? 42:32.360 --> 42:34.240 What do you think the benefit is? 42:34.240 --> 42:37.240 Is there a benefit to your business or your company by being here? 42:37.500 --> 42:40.340 For me, it's a benefit to my profession. 42:40.340 --> 42:42.500 What I do during the day is my day job. 42:42.500 --> 42:43.660 That's why I earn my living. 42:43.700 --> 42:45.400 This is my profession. 42:46.860 --> 42:49.460 My company doesn't sell security products. 42:49.640 --> 42:52.340 You guys help me protect my drugs. 42:52.520 --> 42:53.420 That's why I'm here. 42:53.420 --> 42:55.060 That's why I send my staff here. 42:56.220 --> 42:57.640 No, yes, I'm a pusher. 42:57.640 --> 42:58.420 No, but it's true. 42:58.420 --> 43:01.600 I mean, this is, you know, either way it's going to happen whether we're here or not. 43:01.600 --> 43:03.020 So why not be a part of it? 43:03.780 --> 43:11.160 I mean, we're sitting up here because we all understand and have bought into the fact security through obscurity does not work. 43:11.440 --> 43:15.460 The problem is there's a whole lot of businesses out there who haven't tweaked to that yet. 43:15.460 --> 43:19.780 And there's a large router company I suspect is in that category. 43:22.320 --> 43:26.280 To add to that a little bit, I think, you know, hanging out with you guys for a few days. 43:26.280 --> 43:30.740 I get just as much out of it, you know, if not more, you know, than you guys do. 43:33.880 --> 43:35.200 Gentleman in the glasses. 43:53.790 --> 43:55.950 Okay, so rephrase the question basically. 43:57.190 --> 44:00.630 We hear about cyber espionage or espionage in general. 44:00.630 --> 44:01.990 How realistic is it? 44:01.990 --> 44:03.310 Does it actually occur in your industry? 44:03.310 --> 44:05.810 Is it something that's sort of just made up in the papers? 44:05.830 --> 44:11.230 And have you seen them progress in sophistication over the years from maybe old techniques to new computerized techniques? 44:12.250 --> 44:15.270 I'm guessing that maybe Pamela's industry is pretty competitive. 44:16.370 --> 44:18.150 And so maybe we'll ask her. 44:18.150 --> 44:19.430 Well , in clinical trials. 44:19.430 --> 44:20.410 In clinical trials. 44:20.410 --> 44:24.090 Well, I ask her because she's in charge of a 24-hour response team. 44:24.310 --> 44:27.690 So I'm not real clear with what you're asking. 44:27.690 --> 44:31.190 The question is, does it happen in your industry? 44:31.970 --> 44:34.450 And if it does, has it gotten better over the years? 44:34.890 --> 44:36.270 Industrial espionage? 44:36.270 --> 44:36.770 Yeah. 44:37.550 --> 44:42.110 In the pharmaceutical industry, we are exceedingly competitive. 44:42.110 --> 44:45.670 I don't want to say espionage doesn't happen. 44:45.670 --> 44:47.550 And I'm certainly not going to say that it does. 44:47.550 --> 44:49.550 Because it's a very thin line. 44:49.610 --> 44:54.450 So, for instance, when you're producing a drug, it's exceedingly competitive. 44:54.450 --> 44:56.410 It's very expensive. 44:56.490 --> 45:00.830 It takes about seven to eight years to bring a drug to market. 45:00.830 --> 45:03.310 That costs approximately $8 million. 45:03.330 --> 45:08.770 However, the bang for the buck is, year one, you recoup about $9 million. 45:08.770 --> 45:10.290 After that, it's profit. 45:10.290 --> 45:12.870 So getting to market is the issue. 45:12.970 --> 45:20.770 And there have been studies done where competitors have gotten to market with a very similar drug 30 days before us. 45:20.770 --> 45:22.690 And we never reached the power curve. 45:22.690 --> 45:24.530 We made great money on it. 45:24.610 --> 45:27.830 Excellent, you know, it helped humanity, the community, whatever. 45:27.830 --> 45:29.890 But it's the dollar value. 45:29.890 --> 45:31.070 They just never made it there. 45:31.070 --> 45:32.750 So it's time to market. 45:32.890 --> 45:34.170 Was it espionage? 45:34.170 --> 45:36.350 You know, hard to say. 45:36.350 --> 45:37.610 A lot of speculation. 45:40.050 --> 45:41.130 $800 million? 45:44.770 --> 45:46.010 $800 million to develop. 45:46.110 --> 45:47.610 $800 million return. 45:47.890 --> 45:50.370 But you've got to, like, not every drug you make is a winner. 45:50.670 --> 45:51.990 No, well, that's a thing. 45:51.990 --> 45:54.070 I mean, that's why it costs so much money. 45:54.110 --> 46:02.950 But the other part of it is, too, we're not getting on a drug talk here, but the other part of it is, for instance, when you're developing a drug, for instance, you know what Propecia is, right? 46:02.950 --> 46:05.330 It's for all those guys that want to grow hair. 46:05.330 --> 46:08.250 Originally, it wasn't meant to be Propecia. 46:08.250 --> 46:10.490 It was a drug for colon cancer. 46:10.790 --> 46:22.570 During clinical trials, which is why we have to spend $800 million to develop a drug, it came out that this particular drug that we were developing for colon cancer helped men grow hair on their head. 46:22.570 --> 46:24.330 Hence, therefore, we got two drugs. 46:24.330 --> 46:26.230 So, you know, a double whammy. 46:26.230 --> 46:27.790 Yeah, kind of like Vegas, two for one. 46:27.790 --> 46:38.730 The insurance industry is actually a little bit strange in that respect, in that we're required to file publicly much of our business information, rates, some degree of underwriting, and so forth. 46:38.730 --> 46:42.050 So a lot of our stuff is in the public domain already. 46:42.510 --> 46:48.810 And the competitiveness has a lot to do more with brand and reputation than anything else. 46:48.810 --> 46:54.350 It seems to me as though the business people at our company always seem to know what everybody else is doing in the industry. 46:54.350 --> 46:56.570 I don't understand exactly how they do that. 46:56.570 --> 47:00.690 But it seems to be universal, even at other companies in the industry. 47:00.690 --> 47:10.470 So I don't know if they all get together on the weekends or what, but I don't think there's a lot of industrial espionage taking place because of the sort of semi-public nature of some of the services that we provide. 47:10.730 --> 47:22.870 So from a general perspective or an industry perspective, the amount of that particular crime going on has really stayed the same. 47:22.870 --> 47:26.230 It's actually the methods that they're using in order to get the data out. 47:26.230 --> 47:31.110 Very typically, it's the same old methods, conversations, walking out with knowledge. 47:31.110 --> 47:41.970 However, when you start seeing things like data being embedded in images, technography, it gets very complicated in order to truly identify it while it's leaving your company. 47:42.170 --> 47:46.990 But typically, it's just walking out the door within somebody's head. 47:47.990 --> 47:53.350 Guy in the Sense Post shirt, I recognize your fine fashion sense there. 48:01.810 --> 48:04.990 Does audit response belong in your organization? 48:04.990 --> 48:07.650 And if it doesn't, where does it belong in the hierarchy? 48:07.710 --> 48:09.190 For us, it does. 48:09.190 --> 48:11.310 One of the things I own is IT audit. 48:11.670 --> 48:22.470 The reason that we actually put that there specifically is because we wanted the skill sets and the control belief system to really be embedded within the person who's doing it. 48:22.470 --> 48:33.470 We didn't want it filtering out into kind of a business unit or application kind of mentality when looking at the controls within IT. 48:33.590 --> 48:36.450 So, yes, it's within our group now. 48:36.450 --> 48:38.090 I've seen it a lot of different ways. 48:40.490 --> 48:42.650 Yeah, they focus on finance. 49:11.790 --> 49:15.790 At what point do you kill a bad app that was developed internally? 49:18.750 --> 49:22.770 Well, I think as a whole, our mission is security. 49:22.770 --> 49:25.350 So, I mean, that's kind of one in the same. 49:26.350 --> 49:35.130 And as far as getting security embedded into the application in the first place, I think that's probably one of the hardest challenges that companies are facing today. 49:35.130 --> 49:36.770 And getting that mindset established. 49:36.930 --> 49:43.870 You've got developers coming into the organization fresh out of school, didn't really teach them proper coding techniques, that sort of thing. 49:43.870 --> 49:45.190 How do you get education into here? 49:45.190 --> 49:48.750 How do you get that integrated into the whole development life cycle? 49:48.750 --> 49:50.850 And how do you make that process repeatable? 49:51.650 --> 49:53.250 Okay, well, we're actually out of time. 49:53.250 --> 49:58.010 So, I think I'll take one more question and then these gentlemen and ladies will be around. 50:01.910 --> 50:05.430 And they'll be happy to answer your questions, hang out, buy them a beer, you know. 50:05.870 --> 50:08.530 Okay, gentleman right here in the corner, yes. 50:28.640 --> 50:34.680 And at the end of the day, your job is to inform the business decision makers so they can make an informed decision, right? 50:35.640 --> 50:38.300 And you can't do that if you don't understand the business. 50:38.340 --> 50:45.240 You have to know, I spend more time in my job learning about how insurance works than probably anything else. 50:45.920 --> 50:47.720 Okay, let's give him a round of applause. 50:47.720 --> 50:48.720 Thank him for coming up here.