The State of Cybersecurity: How Did We Get Here, What Does It Mean?

[MUSIC] >> You're listening to The Cyberwire Network, powered by N2K. [MUSIC] >> We can use tech to build a stronger democracy and a fair economy. Really, join me, Baraton Day Thurston on September 23rd and 24th for Unfinished Live, a convening of technologists, journalists, artists, and change makers. You'll hear from a Theorem co-founder Gavin Wood, Glitch CEO, a Neil Dash, journalist Casey Newton and Anne Helen Peterson, and more. Go to live.unfinished.com for tickets and use the promo code Live Audio. [MUSIC] >> At T-Mobile for Business, unconventional thinking means we see things differently, so you can focus on what matters most. That's why we've become the leader in 5G, number one in customer satisfaction, and a partner who includes 5G in every plan, so you get it all. Unconventional thinking is better for business. Open Signal Awards teamable as America's fastest 5G network USA 5G user experience with court July 2021 capable device acquired coverage not available in some areas. Some uses may require certain to enter feature ctmobile.com for JD Power 2020 award information visit JDpower.com/awards. [MUSIC] >> Welcome to afternoon cyber tea. I am your host Ann Johnson with Microsoft. On afternoon cyber tea, we speak with cyber security thought leaders and industry influencers about what is shaping the cyber landscape and what should be top of mind for the C-suite and other key decision makers. Today we are fortunate to be speaking with Mark Goodman. He is a global security strategist, futurist, and author. Mark's focused on the disruptive impact advanced technology is having on security, business, and international affairs, as well as the human implications. Today we will be talking about the status cyber security, tracking how we got to where we are, and thinking about what is next for the industry. Mark, thank you so much for joining me today. >> Thank you for having me and it's my pleasure to be here. >> So Mark, you've worked on next generation security threats such as cyber crime, cyber terrorism, information warfare, and I know you've collaborated with organizations such as Interpol, the UN, NATO, the Los Angeles Police Department, and the US federal government among others. You've also are the founder of the Future Crime Institute, and the author of a New York Times bestseller Future Crimes, inside the digital underground and the battle for our connected world, which was outstanding, by the way. Your experience with cyber security runs the gamut in terms of the scale you've had, the impact you've had globally. So talk to me first, what's like to be involved with organizations at this level. >> It's been an interesting ride. I can say that for sure. I've been at this game for probably 20 years or more, and it's been very interesting to watch the evolution from sort of computer crime when computers were connected by modem to obviously now the age of cloud computing. And along the way, there's always been lots of explanation. I think people who work in this field are constantly explaining the risks to leaders, both at political level, at the governmental level, at the enterprise level, even in small businesses. So that challenge has remained constant, but there are certainly even greater complications when you try to coordinate some of these efforts on an international level. So I found it to be fascinating, and frustrating, and awesome, all at the same time. >> That's really good perspective. Did you find that working at the local level was easier than the international coordination, or did they both have their own unique complexities? >> They both had their own complexities. For many years, when I was a young police officer, I tried to convince my department to launch what I was calling a computer crime unit. And in the old days, that was quite a revolutionary idea 20 years ago. And so I went to my lieutenant, and then my captain, and they didn't quite get computer crime. They asked me legitimately, computer crime, what is it? Like, if you pick up a monitor, hit somebody in the head and kill them with a computer, and I said, no, that is not indeed what I'm talking about. So the frustration that the local level is sort of a lack of understanding of the problem, and then beyond that, a lack of resources. Resources for equipment, resources in terms of understanding the problem, resources to purchase the tools that are required, and then resources from a human resources perspective, recruiting and keeping the highest quality personnel. If you are a city manager of a smaller, even very large city, and you're trying to hire a cybersecurity talent in this hyper competitive environment, you need to compete against Silicon Valley Titans for that talent, and normally small and local governments can't pay that. And then of course, at the international level, you have the intersection of politics, the national security, and nation states, and information warfare, and coordination, and mutual legal assistance treaties, and GDPR, and all these other regulations. So it is probably infinitely more complex. You know, I remember many years ago when the Los Angeles Sheriff's Department first put, you know, the MDT is the mobile digital terminals in their cars, and they, you know. I had one of those. Yeah, so you remember them, and I was talking to them about the need to do something more than, you know, a username or password, and they said, "Look, we can't require officers to carry anything else, and we can't interrupt or the flow of, you know, actually fighting crime." It was an interesting conversation. I can imagine, by the way, in my talks, I do a ton of training for law enforcement, and we've actually had police cars hacked through the MDT in their trunks. There was one town in the middle of the country that I won't disclose that had 20 police cars being tracked in real time by organized crime, and in fact, they were even able to activate the internal microphones and cameras in the car, so they could record and listen to police officers. So I think they should have listened to you, and all of those years ago. Yeah, they've progressed a lot, as you know, since then. Yeah. So let's talk about where we are right now. According to RISPACE Security 2019 is the worst year on record. They're claiming that 41 billion records have already been exposed in 2019, and if you think about some of the large-scale breaches we've seen in the news, that's not surprising, but talk a little about, you know, your perspective, how did we get here? And what pragmatically could we do short-term to try to get ourselves out of this situation? And maybe we can talk a little bit about the future and longer term. Sure. I'll say, I think your question is really fascinating. How did we get here? I would say that most folks that work in the field of cybersecurity, most chief security officers are so busy trying to put out fires that they don't have the luxury of thinking about how we got here. So I think it's an excellent question. I'll answer it by saying it starts with data, right? You know, in the old days when a 10 megabyte hard drive took up four stories of a building, you didn't have to worry about how much data would leak because it would only be 10 megabytes at the end of the day. But the drastic reduction in cost of storage, you know, basically driving towards free and now with cloud computing, that's only been accelerated. That's really what the challenge is is that we can record almost an unlimited amount of data we've gone from measuring in, you know, megabytes to gigabytes to terabytes to gigabytes and zettabytes and exabytes and all these other things that are just so huge, the human mind can't even grasp it. So it starts with the exponential growth in technology. It starts with Moore's law. It starts with the fact that data storage is practically free. And then you add to that the risks which are really increasingly complex. So I think Moore's law unlimited storage is a big part of this. The world economic form has famously called data, the new oil. In other words, the concept is that the value today in any corporation is in their data. And you can see many companies in Silicon Valley that's clearly their business model. But extending beyond that, I don't care if you're an oil company or a hospital. Data is your oil data is where the money is. And of course criminals realize this. Non-state actors realize this in nation states realize that. So we're storing everything. And I think we may eventually, this may be slightly controversial. But I think we may come back and look at this age, a scance in the future. In other words, right now we can store everything. So we do store everything. But there's a concept out there called data pollution, which suggests that the more we store, the more that ultimately will leak. I'll say it now and I'll probably repeat it throughout our chat. There's never been a computer system that couldn't be hacked. And if all data is available, then eventually all data will leak. Yeah, that's a fascinating topic. So we've actually really refreshed how we think about risks and security. I was actually speaking at Microsoft's government leaders forum last week in the US where we had some top government officials. And I explicitly called out data as a risk. And it caught people off guard, which was surprising. And the one thing I said, and just a little bluntly, I said, "Look, folks don't break into your enterprise just to spend time there. They break in there because they're looking for specific data, whether it's IP or whether it's secrets, whatever it is, financial transactions, etc." So I think you're absolutely spot on that as data continues to exponentially increase, we're going to continue to see very large scale breaches and environments. Absolutely. And that's why the numbers are getting bigger. That's why the numbers are getting bigger. If we go back to the target hack, where over 100 million accounts were compromised, or the Sony hack, and one could go on and on and just name them, the Anthem Blue Cross hack, etc. Like the numbers are getting bigger and bigger. And for those of us who work in the field of cybersecurity, we always wonder, what will get the attention of leaders in government, of leaders in companies, and of the general public? And there's this concept of the Cyber 9/11, or the Cyber Pearl Harbor and sees those things. Well, maybe then they'll listen. Yahu initially announced that they had a breach of 500 million records and then they said, "Oh no, it's actually a billion." And then ultimately they admitted every record lead, every one of their accounts was compromised, which was more than 3 billion accounts just from one company. And did nobody react to this if it were Cyber Pearl Harbor or Cyber 9/11? So there's kind of a disconnect between those people who work in the field to think big numbers will impress the general public and the general public who hear so many ginormous numbers that they can't process, that they've almost developed a defense mechanism by tuning all of this out. It doesn't surprise me. You know, you hear about these breaches and the news. And I'm always reticent to blame our customers because they're dealing with a lot of technical debt, a lot of competing priorities. They have a finite budget, and they're also responding to a vast amount of threats. So when you think about all of that, you have to think about how it gets prioritized and how the companies invest actually protect themselves. And I don't think that any company today would ever say, you know, we're perfect at this, right? But I guess, you know, you see a lot of things globally also and have a little different perspective. So I just be really curious about how you think the industry strength overall globally. And do you think we've reached that place? You know, you think about not petty or want to crypto some of these large events. Do you think that that woke people up? And do you think we've reached that place where there is a serious security investment and we're seeing more maturity with our with the companies and organizations and government entities globally? I would say yes that most people are getting it. I work with a lot of boards of directors and see suites. And so at that level, they are certainly getting it. We're seeing more and more boards of directors appointing specific members of their board, not just to be responsible for risk, but also to be responsible for cybersecurity or digital transformation and cybersecurity, things like that. So I think there's certainly an awareness and polls of executives both in and out of government shows that security is of high concern. I guess the question I would then pose is what do we do about it? You know, you mentioned a moment ago that you are reticent to blame your customers and I certainly understand that and I completely understand the number of priorities out there where you have thousands and thousands of systems and all using different software and hardware and you have offices in 160 countries around the world in different legal regimes that, you know, 50,000 vendors interacting with your enterprise at the global level, right? Obviously small mom and pop shops look very different, but in any case, if you're the major enterprise, it's just really hard to handle this. And if you're the mom and pop shop, you're just trying to pay your employees and make your profits to keep the lights on. So all the way around, this is very difficult. I guess I would say that the complexity really can't be our excuse anymore because in my own view, this game, so to speak, is about to be very real. And for me, that's most clarified through the Internet of Things that we're approaching or what I call the Internet of Things to Be Hacked. Joe King makes. Because we're just connecting more and more stuff to the Internet. You know, Cisco said we'll connect 50 billion new devices by the end of next year by 2020. So 50 billion new devices. So we have wired the world. We have connected the world, but we have not secured the world. And I think that poses a really serious problem in the following way. All of those IOT devices, according to a study by McKinsey, are going to generate $11 trillion of economic output in the coming years. Don't you think organized crime might want the slice of that $11 trillion? Don't you think organized crime might want their taste and take of that $11 trillion? Of course, they will. And so the challenge is, as I see the threat, is that it's growing exponentially. And importantly, it's becoming automated. The attacks are being automated. And thirdly, we are now entering the third dimension of cybercrime, which is a relatively new concept that I've come up with, but I think is quite relevant and on point. And by that, I'll explain. It's great to be discussing this with you, and particularly with Microsoft is the inventor. So many of these technologies, and you were there, corporately, as a company in the very earliest days. And thus, it had a really long time to think about security going back to the 1980s and beyond. You guys have been in this game for a very, very long time. But the thing that's changed from those original computers, you know, running DOS or Windows 95 or XP, whatever it may have been, is that all of those devices basically existed, those big gray boxes on our desk or under our desk in a work environment or in our homes. And even if something went bad with the hardware or software, the worst thing that would happen is you might lose some money, you might lose some data. Computers didn't get up and walk around, and they certainly weren't connected in a significant way to an internet of things. But the thing that's changing now through the IoT is that every physical device ultimately will become a computer. And we see this certainly in our homes, you know, overwhelming majority of Americans and it's true around the world have smart televisions that connect to the internet. We've got smart thermostats, smart appliances, smart security systems, smart video cameras, baby monitors, and the light. And on average today, a home has 15 IoT related devices in it. Really? You don't see me, I'm over here nodding my head, but 50 devices that are insecure in just a average consumer's home. Yeah, IoT devices, particularly if you've got children, each one of them who has a tablet and Xbox, a Game Boy, something like that. So the number is really climb and it's predicted to grow to 50 very, very quickly. I mean, things that we never thought would be online like our ovens and our refrigerators, I recently had to buy some new appliances and every place I went was like the salesman or woman was bragging about this oven connects to the internet. I'm like, great, I don't want gas and fire online in my house. That sounds like a really terrible idea to me. So all of these devices are being connected and there was a famous study by HP that showed that 70% of IoT devices were eminently hackable with on average 25 or 26 security flaws. So again, we've wired the world, but we haven't secured it. And when I say that that threat can come back and bite us in a three dimensional way, this is what I mean. Up until this point, as I said, our computer hacks or attacks or data breaches have been about the leaking of personal information or have led to monetary losses. But we have seen at Defcon and Black Hat and elsewhere automobiles hacked, right? We have a Jeep Chrysler Cherokee hacked. So that means that somebody remotely can turn off the brakes to your car. They can turn off the engine and that can clearly lead to death. We've had consumer medical devices, implantable medical devices, everything from diabetic pumps to cochlear implants, to heart monitors and the like automatic defibrillators all hacked. And so now as we implant more and more of this technology into our bodies, this is a massive epic change that most people don't realize. For the first time in our collective history, the human body itself is subject to cyber attacks and that's only going to accelerate. So I know that's a bit of a futuristic perspective, but what I would say is for all of the companies that are out there, they need to understand not just the threats of today and putting out the fires, but have a clear understanding of where we're going. Particularly, if, for example, you're in manufacturing, you mentioned not pet you and want to cry and all of those. A lot of the companies that were impacted by those were manufacturing companies. Oh no. And France was knocked off line because the robots that put together their cars were impacted with ransomware. So this is what I mean about the threat entering the third dimension. We can use tech to build a stronger democracy and a fair economy. Really? Join me, Baraton Day Thurston on September 23rd and 24th for Unfinished Live, a convening of technologists, journalist, artist and change makers. You'll hear from a Theorem co-founder Gavin Wood, Glitch CEO, a Neil Dash, journalist, Casey Newton, and Anne Helen Peterson, and more. At T-Mobile for Business, unconventional thinking means we see things differently, so you can focus on what matters most. That's why we've become the leader in 5G, number one in customer satisfaction, and a partner who includes 5G in every plan. So you get it all. Open Signal Awards teamable as America's fastest 5G network USA 5G user experience of cord July 2021 capable device acquired coverage not available in some areas. Some uses may require certain plan to feature CtMobile.com. For JD Power 2020 award information visit JDPower.com/awards. Welcome back to afternoon cyber tea. I'm talking with Mark Goodman about the early days of computer crime, the complexities of fighting threats on a local, national, and global scale, and the magnitude of the security risk posed by billions of IoT connected devices. Before we talk more in depth about the human factor, and I do want to talk a lot about that, can we talk for just a moment about something that's in the news every day right now? And it has to do with ransomware, but particularly US state and local government. And we talked a little earlier about the maturity of those type of programs in US state and local government, and the challenges they face. But do you have perspective and maybe even a couple pieces of advice for folks of how they can protect themselves from a ransomware fact, whether it's using multi-factor authentication or their backup strategy or going full password lists or what are your thoughts? Well oddly enough, I've actually just written an article on this topic for the world economic form and have another one coming out in a publication, other magazine shortly. So it's a topic I'm quite interested in, so I thought that you bring it up. I feel for state and local government. I have worked in state and local governments. Their challenges are so numerous, as I mentioned earlier, financially being able to update their equipment. If you've worked, anybody who works in state and local government, it's sort of like visiting the computer history museum. You're like, wow, mainframes, there's 400, that's really cool, lotus notes. I didn't know that was still a wrap, when you know, so you get to see a little bit of what the technology of yesterday or were. So that's an issue. One of the other challenges I mentioned earlier is recruiting the right people into your organizations. And the other thing is there are so many bureaucratic rules and regulations. For example, let's say you're a police department that is hyper-aware of cybersecurity issues that you want to lock down your system. You may not be able to because it's actually the CIO for the city that makes the purchasing decisions and decides how things get secured and what the backup strategies are. So a CIO in the police department or fire department or human services department or library department might not have much say at all in terms of what things are done. So I think that is particularly a risk. And again, this is interesting a way that comes back to the human factor and the three-dimensional aspect of it because when cities get hacked and of course we've seen this in Baltimore and we've seen this in Atlanta and we've seen this in hundreds of cities around the world. Police departments have been hacked, hospitals, fire departments, libraries, and the like. But the challenge now when government gets hacked, some of those government services are more than just checking out books at the library or paying your parking tickets. When the NHS was attacked by a Wana cry, the NHS meeting of the National Health Service in the UK, over 80 hospitals and hospitals were knocked offline. So it's not just that, oh, data was unavailable, but physicians didn't know whether to operate on the right leg or the left leg. They didn't know if patients blood type was opositive or AB negative. Hospitals had to close, patients had to be moved, heart surgeries were canceled. We've had 911 dispatch centers that have been attacked via ransomware. So calls couldn't be dispatch, people had to go to manual backup systems. So again, I want your listeners and I know you understand this perfectly well and but I want your listeners to understand. When the general public thinks about cybercrime, they think about, oh my credit card got hacked and I'll get a new one in the mail in 48 hours or my identity was stolen, you know, I'll just clean up my credit history. But here I really want to focus on the cost of human life. So going back to cities, it's critical that we be able to have cities that are secure and run and we need best practices. But for the cities, it's really hard because if you go back to some of the attacks that took place in Baltimore and Atlanta and elsewhere, some of that code was actually written, unfortunately, by the US government and leaked out. So you have nation states developing information warfare tools that can be repurposed by criminal organizations and other nation states to be deployed against cities and states in our country. So it's really difficult challenge to be able to fight that. I mean, these tools were, you know, we spent hundreds of millions of dollars developing them and the difference between a traditional bomb and ordinance that you might drop on the battlefield somewhere in the world is once the bomb blows up, it can't be used again. You can't glue the pieces back together. The challenge with a lot of the core software and code stack in these ransomware tools is that many of it was developed by government. And once you lob that cyber weapon across the fence, it doesn't dissolve. It doesn't go away. It can be repurposed and recoded and used again cities. So I just want to acknowledge that cities, states, federal government, any government face the significant challenges, particularly given the limitation of resources. But I will say the one place where I think they can really fight back is via some of the strategies that you mentioned. So backups become absolutely critical, right, in situations like that, having a really sophisticated storage strategy online off-lights, on-site, off-site, and the light becomes critical. The patching becomes critical. And I really believe that the human factor is absolutely critical in this fight. So thank you. And we, of course, at Microsoft always also start with, you know, make sure you're using multi-factor authentication and a password list strategy. So folks can't, you know, steal your credentials. It just makes it harder, right? Anything that raises the cost of attack to the attacker is a good thing. And you've really humanized the problem. And I think the one thing, as you said at the early on, to get the attention of folks and to make security a priority, they actually need to understand that there is a strong human element. So this has been an incredibly fascinating conversation. And I'm hoping I can get you back on the podcast sometime in the future. But in the interim, what final thoughts do you have for the audience? What, what do you want them to take away? Well, I would say, first of all, I completely agree with you on two-factor, multi-factor authentication. In your short sentence, you brought a very sophisticated economic approach to the problem, right? Any building, any system can be broken into. You want to drive up the cost for your attacker. And 2FA and MFA does that. So I'm a big fan of that. I guess what I would say for your listeners is, if you visit any of the large security conferences, you know, some that bring 50,000 people together and walk the floors of these events, you will see technology vendor after technology vendor selling what I call magical boxes. Buy my magical box and it will solve all of your cyber security problems. You know, there was a time when that was antivirus and then it was firewalls and then it was intrusion detection systems. And now it's anything that has machine learning and AI in the title. But ultimately, we need to remember that these attacks today are scripted and carried out by people. Now they're automated. I get that. But there are people today, you know, in 2019 that are still creating these attacks down the road. It could be AI's God forbid. But right now, it's still human beings. So I think the human factor is critical. And I think it's the one that most seesows and most people in the security industry mostly ignore. But I strongly believe that you can't solve technology problems with technology alone, right? These are created by humans so you need to bring in the human factor. And seesows don't like it because it's messy and it's hard and it's difficult and people are unreliable. But I have a whole system of thinking that I really think could make a difference here. IBM security did a very famous study a few years ago and they showed that 95% of all data breaches can be tracked back to human beings. So most organizations have human beings working here. So I believe that that would be a great place to start. Thank you so much. It's been a fascinating conversation. I really appreciate you joining. Awesome guys. All the best. Bye bye. Thank you to our audience for listening in. Join us again next time on afternoon cyber tea on your host and Johnson. Please subscribe to afternoon cyber tea on Apple podcasts and podcast one. So you don't miss an episode. Make sure you rate and review the show on Apple podcasts and tell your friends. Thank you for listening and join us next time for a new episode of afternoon cyber tea with and Johnson of Microsoft. Really join me. Barretton Day Thurston on September 23rd and 24th for unfinished live. A convening of technologists, journalists, artists and change makers. You'll hear from a thearium co-founder Gavin Wood glitch CEO and Neil Dash journalist Casey Newton and Anne Helen Peterson and more. At T-Mobile for Business, unconventional thinking means we see things differently so you can focus on what matters most. That's why we've become the leader in 5G, number one in customer satisfaction and a partner who includes 5G in every plan so you get it all. Open signal awards teamable as America's fastest 5G network USA 5G user experience report July 2021 capable device acquired coverage not available in some areas. Some uses may require certain plan to feature CtMobile.com for JD Power 2020 award information visit JDPower.com/awards.