Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now, here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 129 for the week of August 19th. Alex, kids are going back to school.

I know my kids are back to school this week. It's pretty crazy. Um, on Friday, my younger son, um, even though they only had 2 full days of school, came home. They had a thing after school, so it was like, uh, I don't know, 8 o'clock. And he came home, I found him upstairs laying on his bed, and I said, well, if you're tired, just go to bed.

He says, I am. And he got up at 9 o'clock this morning, slept for 12 hours. Pretty good. Good for him. Yep.

Uh, yeah, this is— so my, my older son started junior or middle school, I guess it's middle school now. Yep. First year, you know, going lockers and figuring all that out. It's a interesting new challenge for us. I'm sure.

Yeah. So I have one in high school. Yeah. Hard to believe. Gosh, it's unbelievable.

Yeah. Time flies. And, uh, yeah. Well, so we are excited to be, you know, kind of finishing up the last of summer and getting ready for the, the season to change and maybe not be quite so hot here pretty soon. I have a feeling we're gonna get some hot for a little while still, but, well, it started, it started late, so I guess it's only fair.

It's only fair. Yeah. All right. Well, why don't we go through some housekeeping? So Robb, did you know that we have a Slack channel?

It's the best. It really is the best. It's been— it was actually very busy this week. There was lots of chatter in the Slack channel. If you would like to join in on that chatter, go to colorado-security.com, click on the Slack button, join the Slack workspace, start conversating with all the Colorado Equal Security people.

And while you're at colorado-security.com, you can join our mailing list and get these show notes delivered directly into your inbox where we'd love to keep you guys in the loop on what's going on in the community. Of course, if you want to help us out, we would love it if you would rate us and subscribe to get the podcast delivered into your player all the time. And the rating helps people find us. The more people who rate us, the higher we show up in the results when people start searching. Another way to find us is if you tell a friend about how great Colorado Equals Security is.

Let them know that there's this wonderful podcast they can listen to, the website, all of the great things that are Colorado Equals Security. And while Alex said tell a friend, it's okay if you tell an enemy or anyone, really. Yeah, that's true. You can tell anyone, you know, you can just, you know, scream from the rooftops, however you'd like. We actually don't have a policy against you putting up a billboard for us.

You're welcome to do that. Uh, park benches. Park— oh, park benches. You're like bus stops, you know, where they have the ads on the bench. Yeah, if I saw one of those, that would be pretty cool.

And finally, if you're hoping another way to help us, we would love it if you'd support the show financially through our Patreon campaign. Uh, go out to colorado-security.com and you can find, uh, the way to do that. That money goes right back into the community. So, Robb, there was some big news this week on the national scene that affects Colorado. Yeah.

What was that? John Hickenlooper, our former governor, has decided to end his run for president after, after what was about 6 months or so of not making a lot of momentum toward, you know, getting the support needed. He's decided to call it quits. And while he hasn't officially decided that he's going to run for Senate, it looks like that might be a possibility. I think it's a pretty good indication that he will.

I happen to belong to the Facebook group that was Hickenlooper for President, and the day that they announced that he was not running anymore, that group changed to Hickenlooper for Senate. So I think that's a reasonable indication that he may run. It seems like a pretty decent chance of that. So hopefully, you know, congratulations to him for making the decision not to get beat around anymore on the national stage. Now he can be beat up on the local stage.

Next news we have is, speaking of big Colorado news, In-N-Out Burger has put in a request to the city of Lone Tree to have their first Denver area In-N-Out restaurant put in near Park Meadows Mall. That is pretty cool. Not too far from us. Of course, within the last year, In-N-Out bought some land down in Colorado Springs so they could set up a distribution center. You know, that is one of the hallmarks of In-N-Out is that they have everything fresh.

So they don't go into a market unless they have a way to get that, that fresh produce and and meat to their stores. So they've got that going in, in Colorado Springs. And it sounds like it'll be 2021-ish early if this goes through, that they'll have that In-N-Out at Park Meadows. And it would not be the first because there will be a park or an In-N-Out Burger in Colorado Springs before that. They've got the date figured or the space figured out for that.

But the one near Park Meadows is actually like basically at Chester and County Line. If you know where there's currently a car, a car wash there, there's Chick-fil-A near there and the Fidelity, if you know, like right on that corner. So anyway, good, good area. It's going to take the place of the car wash, about 6 months of construction. I have a feeling, Robb, that this will not be the first or the, the only In-N-Out announcement that we hear.

I think that there will probably be more coming. I suspect so. And of course, you know, my wondering is how long a wait will it be to get a, a slightly above average hamburger once they open? It does look like they're open till at least 1 a.m. every day of the week. So maybe if you show up at like 12:59, Maybe you might be able to sneak in without too big of a line.

I like it. All right. Next, Southwest Airlines has said that they could add more than 100 flights in Denver. So there is construction that is going on at the airport, not the construction that has been so contentious lately where they just fired the contractor for the Great Hall renovation, but they are adding more gates to the different concourses at DIA, including 16 in Terminal C, which is where Southwest is. And Southwest has said they, you know, they will generously only ask for all 16 of those gates.

And in exchange for getting all 16 of those gates, they would add 100 new flights leaving Denver on a daily basis. That's going up from their current about 200 flights a day. So a pretty significant increase they're looking to do. I think since Southwest has all of the gates in Concourse C already, not a big surprise that they're going to grab those other 16. I actually think Frontier is over there on C as well.

And you look at me like I'm wrong. I think they're all— I think they have all of C. I think Frontier's on A. I don't think they have all of the C gates. Okay. And I think there's actually some United on C as well. However, I don't have any way to fact check this, and we're not the kind of people who do fact checking.

So we just like to spread lies. All that said, interesting news. It is. Uh, they also said this as part of an annual retreat that they do somewhere. They happen to do it in Denver this year, their executives.

Um, that whenever they do that, it usually means there's some expansion coming into that area. Awesome. Uh, next story we have is from the Denver Business Journal talking— they call it Form D Friday, which is a list of all the forms that were filed in the last week for companies raising money. Um, and the top of the list was Techstars raising about $42.5 million. Alex, why are they raising this money?

You know, I was actually a little confused on why they were raising this money, Robb. You know, accelerators like that, they often, they'll raise the money in general to have, you know, sort of a fund to fund companies, plural, like that they are incubating. Right. But in the article, it seemed to indicate that this was for a specific company, but they did not mention that company. So I'm looking forward to figuring out what company was worth Techstars dropping $40+ million.

Yeah. They said that they've actually already raised $40 million of it, and they were looking to finish out the round, the fund of it. Another $2.5 million. So if somebody has $2.5 million sitting around, I'm sure Techstars would take your money. I'm not sure they would, honestly.

They'd probably turn down folks like us. But potentially, they don't want to be associated with the stink of some of us. Yeah. In other Colorado news, United Launch Alliance announced that they are contracting with SNC, Sierra Nevada Corporation, for the Dreamcatcher missions to Mars to refuel and re— restock the International Space Station. So ULA has created a brand new rocket, and this is now the rocket that helps folks get out of the atmosphere here.

And the first folks who are signing up to use it is another local company. So it's kind of cool that, you know, a local ULA is now signing up with local SNC to get spaceships up to the International Space Station. It looks like this is worth hundreds of millions of dollars to ULA. An individual launch is about a $100 million endeavor. So pretty big news here.

Yeah, the pictures in this were cool too. The shuttle that they have for the Dream Chaser of Sierra Nevada, it looks a little space shuttle-ish, but I think a little bit smaller, a little sleeker, newer. And it's also unmanned. It is not a manned— just women in there, huh? Dogs, only dogs.

So anyway, space. Yeah, space is fun. All right. So some news from Ping Identity. This week.

Uh, Ping has announced this week the hiring of a new Chief Marketing Officer. Kevin Sellers joins us. Um, previous to coming to being at Ping, he was at Avnet, and previous to that, he was over at Intel where he was the mastermind behind the Intel Inside, uh, marketing, which I'm sure you're familiar with. You know, anyone who has owned a Windows-based PC and has a little sticker on there that says Intel Inside, I'm sure is familiar with it. So So, you know, he's been with us maybe 2 weeks, and I had my one-on-one with him to get to know him about sometime last week.

Super nice guy, super engaged. Uh, he's kind of got this great combination of, uh, been in the industry a long time and, and wants to listen and learn and, and really be part of a team. So I'm excited about it. I'm looking forward to seeing, you know, how he helps Ping succeed. Sounds pretty cool.

Speaking of executive hires, Route 9B has announced that they are expanding their executive team. Uh, we haven't had a lot of Route 9B news lately, but Tim Lawson is being hired as Executive Vice President for Global Sales. Looks like he's going to lead the teams for sales, marketing, competitive strategy, channel management, inbound, outbound retention, call centers, and partner programs. So a lot, not just, you know, what you consider the normal small sales team. Yeah, I think, you know, Route 9B, I don't know the exact number of employees, but I don't think it's extremely huge.

So it doesn't surprise me that he's having multiple roles. A lot of times you would call this position like a chief revenue officer. Seems very chief revenue officer-ish. I'll tell you one thing that was interesting to me is the, like, the, on the Route 9B website, they didn't say Route 9B. They say RNB or excuse me, R9B.

So, so they're, uh, well, a little different brand. Yeah. I mean, maybe they're going away from the branding and, and they're trying to, you know, get the, the more TLA, right? That they're in the government. TLA is 3-letter acronyms.

Yeah, pretty, pretty common. But maybe also that, you know, there was that, um, kerfuffle, we will say, a few years back with the holding, the Route 9B holding company. So maybe they want to be moving themselves away from that name. Who knows? So Alex, uh, Optiv put out a blog this week with 22 ways to protect yourself against phishing attacks.

Uh, only 22, Robb? Only 22. Well, they started off with a list of 4 that the FTC provided, which is, which is nice. And then they said, well, That's not enough. Here's 18 more.

Clearly, 4 is not enough. You need more than 4 things if you're going to protect yourself from phishing. It is an interesting list. Some of the things I think are pretty obvious stuff that you would off the top of your head guess. One of the ones that I liked was install an anti-phishing toolbar or plugin in your browser.

It's so funny that you mentioned that one because I was going to give a little bit of flak about that one. Yeah. You know, I think it's interesting in one respect that You know, a lot of people don't like toolbars and extensions because, you know, there's potential for bad things to happen there. But for example, Google recently— I think it was Google released an anti-phishing toolbar that essentially rates every website that you go to. So you can just quickly look up in the corner and it'll have, you know, sort of a badness score of the website that you're on.

So if you go someplace and you're not sure if it's bad or not, you can at least go, oh, you know, this is, this is a, you know, 83 million. This must be really bad. So that's a big number. The challenge is when you put those extensions in, you know, you're trusting yet another third party. It's going to have access to all of your browsing information.

And while they maybe likely are doing the right thing initially, over time things atrophy, they go away, someone gets into their organization and start— now has access to your browsing data. That's where I start to get nervous about those third parties. Agreed. Yeah, um, you don't want to install any of the anti-phishing toolbars, say from Russia or China, Um, but if you are going to do that, make sure you get it from a reputable source. Or any other countries that like to go through their citizens' data.

But you can't think of any others of those. Google, they're, they're, you know, privacy forward. So yeah, that should be fine. Sure, we should be fine. We'll move along.

So, uh, Next Web Group had a blog talking about, uh, cybersecurity internships and how you can do well at them. I, I saw this one and I was really excited to join, to put this in the show notes specifically for our friends over at SecureSet and the other, you know, Regis and CU, the other places where they're— ACC. Yeah. Lots of, lots of students who listen to the podcast. This is a way for you to, number one, figure out like an internship is super important and this is a way for you to get the experience in the industry.

But number two, how do you do a great job while you're there? So good stuff. There were sort of 3 high-level topics that they had in there. You know, things you should do, be eager and ready to learn. I think that that's obvious, but still something good to say.

Um, you know, be up to date and know what you're talking about on cybersecurity things. And also, you know, when your internship ends, continue to grow and keep learning. And I would say when your internship ends, uh, get the feedback from your employer and ask, you know, how did this go? What could I do better? How can I get a position on the team long term?

Or can you help me find a position somewhere else long term? That person's probably got a good network in the area. Yeah, and probably can give you good feedback on what you did well and what you didn't do well while you were there. All right, our last story this week is a blog from Managed Methods, the local CASB here in town. It looks to me like Managed Methods is kind of pivoting a little bit away from the straight cloud CASB type stuff to more DLP, and this post is talking about like what is DLP more broadly.

Yeah, I think that's, you know, sort of one of the additional checkboxes that, that many of the CASBs have, right? So proxying your traffic anyway, we can look for things like sensitive data. So this is just talking about how data loss prevention works and what you need to know, talking about, you know, rules and policies, how they're, you know, you can do file matching, looking at images, how alerting happens, you know, a lot of decent information about DLP. So, so good stuff. If you're looking for DLP or you, or you want to know more about it, that's your opportunity to read.

That's it for news. We'll jump over to our Slack message of the week. Uh, this is once, once a week we try and recognize someone who's continuing to keep the conversation going in the Slack channel. Um, and, and really helps the community drive forward. Big thanks to Andre Gaeta.

Andre has been sponsoring the Slack message of the week for a couple of years now. Super appreciative of that. Yeah. Uh, this is all coming outta his pocket. Thank you, Andre, for doing that.

I would also like to thank Andre for filling in last week while I couldn't be here. He has been a, a very gracious guest host when, uh, when one of us is missing. I have to go back and listen to that episode to see if he was any good or not, but I thought I'd thank him. Of course he was. He was really—he was shockingly good.

What?

Excuse me. So we're not thanking Andre anyway. So this week's Slack message of the week is the winner is Janelle, and I'm gonna pronounce Janelle's last name wrong, but I'm gonna say Sia H S I A. Hassia. Anyway, she started a discussion this week on privacy policy and, you know, privacy in general. And it really snowballed there.

There was a, I don't know, basically a full day discussion that happened in that channel around privacy and privacy policies. Lots of good discussion and debate around that. Obviously something people are dealing with right now and have a lot of opinions about. So good stuff. And of course, you know, we're thankful that you did that and you will get to pick one item from the Colorado Equal Security store.

And wear your, wear your swag around town and help, help move the movement forward. Yeah. Congrats, Janelle. All right. Next, we'll move over to our events.

As a reminder, on the website, there is a calendar of events. You can go see all the stuff going on. We're about to go through like, I don't know, like 100 different events over the next 2 weeks. It is super busy. There are a lot of things happening.

I can't believe how many opportunities there are, uh, as we, as we look forward. Starting off with, uh, on the 20th and 21st, the Colorado Springs ISSA chapter are doing their August meetings. That's a dinner on the Tuesday night and a lunch on Wednesday afternoon. Once you're done with that, you can head over to the CTA on the 21st. They are doing DevOps at Scale.

That should be interesting. On the 22nd, the— there is a group, uh, being put together by InteliSecure, the IT Security Professionals Happy Hour. That's a way to just drink and have some fun with some security folks in town. Also on the 22nd, CTA is doing a Women in Government with CWCC. I don't know what that, um, that acronym is for.

I'm thinking CW Colorado Women something something. Anyway, Young Professionals Board and Public Affairs Committee. Sounds exciting. Pretty good stuff. Next, also on the 22nd, we have an Elastic Denver User Group.

This is an open source networking security monitoring using Zeek and Elastic. And finally, on the 22nd, Down in the Springs, the Air Force is doing their CyberWorx Small Business Innovation and Research Seminar. If you made it all the way to the 23rd, there's a couple of events here too. Secureset is doing a beginner's introduction to capture the flag. Also on the 23rd, CTA is doing Secrets to Success in the New World of Innovation, a conversation with Gary Shapiro.

So that is not the Gary Shapiro, Shapiro, who's, who's the local news. I said Shapiro because of local news. It may be Shapiro because he is not that person. Yeah, this is the head of the Consumer Technology Association. Association.

It's, it's a different CTA coming to talk to the Colorado Technology Association about, you know, national trends in consumer tech. Pretty cool. On the 24th, the ISSA Denver is doing their CISSP seminar, Domain 3 Security Engineering. Also on the 24th, the Elastic Denver User Group is doing a hands-on workshop, Threat Hunting and Incident Response Using Zeek and Elastic. So if you came on the 22nd, you might want to come back on the 24th for the more hands-on part.

And finally, on the 24th, Colorado Springs ISSA is doing a mini seminar. So if you made it through the 24th, just take a big deep breath, relax for a minute, take a nap on the 25th and the 26th. Because next week is big. And then come back on the 27th for a GDPR meetup with ping pong and food. Cool.

Also on the 27th, Emerging Tech Fan is doing an AI is a Team Sport, talking about AI. On the 28th, ISC2 Pikes Peak is doing their August chapter meeting. The 29th, CSA is doing their August meeting, which is a Rockies game. They're going to go see the Rockies play. What?

Get signed up before all the tickets are gone. That is pretty cool. And then I believe this is our final event for the next 2 weeks. On the 3rd through the 5th of September, ISSA Colorado Springs is doing their Peak Cyber event, which is one of their big events of the year. Yeah, it's a 3-day event that's actually looking a little bit further out than 2 weeks.

But since it is such a big commitment of time, makes sense for us to talk about it here. Call me out, Robb. Oh, I was, I was just making sure everyone's aware. We know the calendar. Oh, I don't know the calendar.

Why don't we go and talk about jobs? We don't need to know about calendars for jobs. Um, we, I have a job at Ping. We're hiring a GRC analyst, someone who is looking to get their foot in the door for GRC. You want to start helping set policy, help do compliance for the company.

Uh, we'd love, we'd love to talk to you. Reach out to me on Slack if you have any questions. Awesome. Untangle is looking for a director of software engineering in cybersecurity.

Platform SH is hiring an IT security operations manager. Arrow Electronics is looking for a cloud security senior risk analyst. Bank of America has a couple open positions here, or they actually have a lot more than a couple. By a couple, I think we're talking, you know, like 30 maybe or something like that. Yeah, so we got a note from one of the recruiters.

They're asking us to put some positions on the, on the list, and we got 2 on the list this week. We'll keep, we'll keep adding some each week, I think. This week they're hiring a malware Threat Senior Specialist and a Data Security Analytics Associate. Direct Defense is hiring a Security Analyst. This is for their SOC.

And finally, Zavaro is hiring a Cybersecurity Director. And this is someone who's helping put— helping Zavaro put together their security offerings. Oh, that's pretty cool. Cool. Well, that is it for news.

We have an interview this week, which is actually an RMISC keynote. Yeah. So this is the final installment of our RMISC keynote series. Mikko Hypponen, who is the CEO of F-Secure. He came in great.

He's the Chief Research Officer at F-Secure. He is a badass at F-Secure. He's Finnish. He flew out from Finland just to give this talk and then flew back. And it was awesome.

Yeah, it's maybe the best feedback we've had. We've had a lot of good keynotes, but generally, I'll say generally when we do keynotes, we either look for a big name to draw people or good content. And you don't always expect to get both from the same person. Right. And really, Mikko delivered both of those.

Yeah. So if you were there, you'll get to hear it again. If you weren't there, you'll get to hear it the first time. There you go. All right.

Well, that is it for this week. We'll look forward to seeing you guys hopefully at one of the many, many events in town. Or if not, we'll talk to you in a week. Awesome. Thanks, Robb.

This is David McGuire, Director of IT Security at QEP Resources. This is Colorado Equals Security for Colorado security professionals.

Thank you very much and good morning to all of you. My name is Mikko and indeed I want to give congratulations to ISACA for 50 years as well. 1969 was a great year. Sure, ISACA was founded. Yes, we went to the moon.

We had Woodstock. Also, I was born. I especially like the last one. Yeah, thank you. I wasn't alive when we went to the moon.

I wish I was, but I was born a little bit after that. So I've been spending basically all my life working with InfoSec. Like Don mentioned, I joined DevSecOps in 1991, and when I joined a small startup which was working on computer security back then, it would have been hard to see just how much the world is going to change. When I started working with computer security, we were still fighting viruses which were spreading on floppy disks, if you remember these, right? Younger members in the audience have no idea what these are.

They are the USB thumb drives of the 1990s. That's what they are. And today it would be hard to imagine that a virus spreading on floppy disks would go around the world, but that's exactly what they did. They were traveling at the speed of travel. As people were traveling the world and taking floppies with them, they were spreading infections around the world, and eventually viruses like Stoned and Form would go around the world.

Now, of course, today we live in a different world. Yesterday you heard the keynote from Jim Zetter speaking about Stuxnet, And Stuxnet is actually a great example of how sometimes the old phenomenons come and repeat over and over again. Old floppy-based viruses were spreading around the world at the speed of human travel as people were traveling with those infected devices. Well, Stuxnet did exactly the same thing. Whenever we speak about network warfare or network-based attacks done by governments, Stuxnet is very often used as an example.

But Stuxnet wasn't spreading over networks at all. It was only spreading on USB thumb drives. It was only spreading around the world at the speed of human travel, as people were traveling the world with infected thumb drives in their pockets. Exactly the same speed as old floppy-based viruses.

So during these years, as we've been building network security The biggest change clearly in our lives has been internet. Internet changed the world. Internet brought us great benefits and great new risks. It's quite clear to me that the benefits are much bigger than the risks, but I do believe we are now living the first time in mankind's history where it's now more likely that you will become a victim of a crime in the online world instead of the real world. Now, this might not be true in all parts of the world, but for most of us who are living in fairly safe environments and societies, the likelihood that we are losing our password or credit card number or someone hacks into one of our devices is now becoming more likely than somebody stealing our car or picking our pockets or something like that.

And this is a pretty big shift. Because it means that we've always only worried about local crime, the people around us. If someone's going to steal your car, they're not from very far away. They're from your state or the next state, and that's it. But now when we have to worry about criminals who can be anywhere on the planet, that's a huge shift.

And it's happening right now. So internet took away geography. It took away distance. It took away borders. And that is a big deal.

Even though borders are disappearing, we are still seeing geographical areas where we see more activity than from elsewhere. I'm based in Helsinki in Finland. Finland has a 1,000-mile border with Russia. Where I live, it's 3 hours away from St. Petersburg, Russia, which is one of the hotspots for Russian cybercrime activity. And we spend a lot of time looking at what Russian crime gangs are doing and what the Russian government is doing.

Finland and Russia have always had a special relationship. Both my grandfathers fought the Russians in the Second World War. Both my grandfathers, who are now long gone, they hated the Russians, of course, because they fought them in the war. My father, he's still around, he's 75. He doesn't hate the Russians, but he doesn't like the Russians.

Me, the 3rd generation after the war, I don't hate the Russians. In fact, I hire Russians all the time. Russia is a country filled with great developers and coders and mathematicians and researchers and physicists. It's a great country with great skills, but it's also a problematic country. I trust I trust many people from Russia, but I don't trust Russian leadership.

That makes it complicated.

I'll speak a little bit later about what's happening in the geopolitics and about what's happening between China and Russia and other countries as well. But let me just make a note, a general note about how the field where we work is unique. Because when we succeed, nothing happens. You never read headlines from newspapers about how some company was not hacked yesterday. That's not news.

It's only news when companies do get hacked. So we do a lot of work. We do a lot of preparation for, for the things that we do day in, day out. And if we are successful, then nothing happens. I run into this regularly because I regularly visit our clients and customers and prospects around the world.

And typically when I'm in a meeting with a client leadership team, typically it's the CFO who looks at the budgets and looks at the numbers and asks me that, hey, it says here that we spent €50,000 last year in services from your company. Why are we spending all this money with you guys? We have no security problems.

And typically I answer by saying that, you know what, this boardroom where we are right now, it's awfully clean. Like, you can just fire all your cleaners and janitors. You don't need them anymore. It's exactly the same thing when we do our job right. Nothing happens.

When we do our jobs right, we don't even get noticed. But when something goes wrong, we do get noticed. Now companies do not go bankrupt just because they get hacked. This almost never happens. I actually did a study on this a couple of years ago.

I tried finding examples of companies which would have folded just because they got hacked. Yes, there are a couple of examples, but very few. I was able to find a handful of companies from different parts of the world which folded just because they were hacked. But this is really, really rare. Most companies survive.

Most companies are able to recover from a hack, even if it's really, really bad. The companies that did not survive are always special in one way or another. For example, DigiNotar, which was a technology company based in the Netherlands linked to the Dutch government issuing certificates. They were hacked by Iranians who were using their certificate generation systems to create fraudulent certificates, which they then used to spy on their own people. That particular company did go bankrupt because of that hack.

But not because they got hacked. They, they went under because they got hacked and they didn't tell anyone. They tried to hide it. And if you are in the business of selling certificates, well, what you're really selling is trust. Certificates themselves are just text files.

They're worth nothing. What you're selling is trust. And if you get hacked and you try to hide it, you lose trust, and then you deserve to go bankrupt. And that's what happened. So companies survive.

How much does it cost for a large company to recover from a really big hack? That sounds like a rhetorical question, but no, let's put a figure on it. It costs $300 million. That's what it costs for a really large company to recover from a really large hack. And this figure keeps repeating itself when we look at some of the largest breaches in history, like Sony Pictures or Maersk or Yahoo breach.

More or less somewhere in that region. But companies do survive. Even the stock values do recover. You look at Global Payments, one of the largest credit card breaches in history. Their stock value plummeted and then 2 years later it was back.

Even higher than where it used to be. Companies survive. CEOs don't. When there's a really bad hack, CEOs, CIOs, CISOs get fired.

Members of the board want to find someone to blame. Companies survive. Top management doesn't. This is the part where I motivate you to care about security.

So in our line of work, when we do everything right, it's invisible. And that's just a fact of life. That's what we have to accept. And it is a game of cat and mouse. Whenever we come up with new safeguards, new innovations, it doesn't take very long for the attackers to follow suit.

So then we have to upgrade our defenses. And this is going to go on forever. It's not going to disappear. I guess the good news is that there is job security in security. We are not going to run out of jobs anytime soon.

There's a massive skills gap right now. We need more people in our field. So when we move to new kinds of systems like, you know, cloud computing, it takes a while and then attackers will follow. We implement new security safeguards like biometrics or 2-factor authentication. It takes a while and then the attackers will follow.

And we can take every single security breach we've ever seen and we can divide them into 2 different groups. They're either technical problems or people problems. And technical problems can be really hard and slow and expensive to fix, but they can be fixed. Because in the end, every single vulnerability is a bug. It's a bug in the code.

We have bugs in our programs because our programs are written by human beings. Human beings will always make mistakes. We will always have bugs, which means we will always have vulnerabilities. And the way we fix these is that we find the bug, we fix the bug, we update all the systems, we deploy the patch, and we're done. Might be slow, might be expensive, But it can be done.

But then when we fight people problems, then it's hard because there is no patch for stupidity.

And users do stupid stuff. You know this. Users do stupid stuff. No matter how many times you tell them, they will always open every attachment. They will always follow every link.

They will always give their password to every single web page that asks for it. No wonder, because the attacks are good. They get an email, hey, here's the document you asked for, and there's a link to OneDrive. All right, they follow the link. OneDrive, please sign in to continue.

And now they get suspicious. Hold on, let me double-check this. Is this the right OneDrive? Well, the URL has the lock. Okay, there's the lock.

I've been told look for the lock. Let's have a look at the URL, office.com. Well, that's right. That is the right Microsoft office.com domain. Cool.

All right. Ask for username, ask for password.

How would the end user know that forms.office.com is a website where anybody can post forms, including forms which say, OneDrive sign-in to continue and ask for username and password. There's no way that we could teach things like these to every single end user. No wonder they fall for this. And then when they give out the password and the username on the form, it will generate a 2-factor authentication prompt on their device. Why?

Because the website on forms.office.com will automatically take the username and password, use those to authenticate on real Microsoft Office authentication, which will then trigger 2-factor authentication on the real user's device, who will then punch in the one-time code on the phishing page. And now the attackers are in. It's a game of cat and mouse. 2-factor authentication absolutely makes sense. But it's not going to fix everything.

Attackers will figure out ways around them. Now, we do a lot of incident response work, which means that team gets the phone calls from companies which have just been hacked. And that's always the message, like, we've just been hacked, can you come over and help us right away? Please. So we go over right away and we investigate what has happened.

And then we tell the client that, yes, you're right, you are hacked. But you were hacked last year. You just found out today, but you were really hacked last year. There's no rush here. We come back next week.

And this is where most companies fail the hardest. They have no visibility into their internal network. When they get hacked, it takes weeks, months, yes, years. We've seen cases where it's taken years for companies to realize that they've been hacked. And this is bad enough when it's a company which loses their own capability to continue working until things have been cleaned up.

But today, more and more companies are providing services to their own clients over all kinds of cloud services. And this means that when your company goes down, then the clients won't be able to work either. And today, the fact that someone opened up a bad spreadsheet is no longer a good enough excuse to be that none of your clients could work. But this is what we see happening over and over again. Companies providing invoice services or tax filing services or security as a service services going down and then unable to provide any of the services for their clients either.

All because someone opened up a bad file, a bad attachment. Over the last 5 years, the biggest single trend in malware obviously is ransomware. And ransomware actually works on a very old idea. One of the first ways of making money with malware was to steal valuable information and then sell that information to the highest bidder. The logic in ransomware is very simple.

They just realized that in many cases the highest bidder is the owner of the information themselves. You steal information and then you sell the information to the original owner of the information. You lock them out from their own files. So we've been making a roadmap of ransomware. And the roadmap of the last 5 years of ransomware families has become so large I can't even fit it on a single PowerPoint slide anymore.

We're tracking hundreds of gangs. Making all of their money from ransomware.

And ransomware attacks used to be fairly straightforward. This is done or used to be done with malware like CryptoWall or CryptoLocker being distributed in email spam to random targets. So random companies in different parts of the world got hit. And if they didn't have good enough backups, they had to resort into paying bitcoins as a ransom to get their files back. What we are seeing happening now is much more targeted ransomware attacks.

Russian crime gangs like LockerGoga and Megacortex are now doing much more targeted ransomware attacks. So it's not just spamming attachments with malicious files in them into random addresses. They do their homework. They pick a target. Let's try to break into that company.

That company looks like a good target. The way in typically for them is not email. They scan the IP ranges owned by the company looking for VPN endpoints or RDP sessions or something they could use to gain foothold in the company. Once they're in, then they might spend weeks Using lateral movement to gain access from one server to another, from one data center to another, until they believe they have access to everything. And then when they have access to everything, then they launch their attack, encrypting as much data in as many servers as possible at the same time, typically doing it in the middle of the night, hoping they would be able to encrypt everything before the IT team realizes what's going on.

And this is a completely different problem to fight, especially because computing is changing, because everything is becoming a computer. Everything becomes a computer. You know this. You've already seen this happening in your own living rooms. Everything is going to be connected to the internet.

And I'm not worried about smart devices going to the internet. I'm worried about stupid devices going to the internet. Right now it's the smart ones going, but eventually even the stupid ones will go to the internet. Because today when you go and buy, I don't know, a security camera, well, that's obviously going to be a Linux server online streaming 4K video out of the device itself. Obviously it's going to be on the internet.

When you buy it, you know it's going to be on the internet. When you buy a smart TV, you know that it's going to be on the— I mean, that's the reason why you buy it. You buy a smart TV so you can watch Netflix from it. That's the revolution of smart devices. And there the user, the consumer knows that this thing is online.

But in the near future, even the stupid things like, I don't know, toasters will go on the internet. And they will go on the internet for a different reason. Because clearly the consumer does not need a toaster which is on the internet. Like, we don't need a notification to our phone that the toast is done.

But what I'm saying is that it's going to be on the internet anyway. Not for us. It's going to be on the internet for the manufacturers, for the vendors which build these devices. Why? Because they've heard that data is the new oil.

Data is the new oil. How do we collect some of that data? Well, we'll just put all of our toasters on the internet. And they would already do it today if they could, but they can't. Why?

Because a toaster costs $20. The cost of adding IoT chipset is $10. They can't do it. It's too expensive. Today, but it won't be too expensive in 10 years.

And then they will do it. And then they will get the data like, where are our customers? How many toasters do we have in Denver? Do we have more toaster customers on the east side or on the west side of Denver? Should we advertise more on the west side because there's less customers?

You know, this is valuable data and they will collect it. And I, and I know what you're thinking. You're thinking that, okay, if that's going to happen and if all the devices I'm going to buy are going to be on the internet, I'll just block them at the gateway. No, you won't. Because they won't be using your Wi-Fi or any connectivity that you control to go online.

They will be going online using 5G or Sigfox or any of these new technologies that we're developing right now. Devices in your home will be on the internet and you won't even know it. And this revolution started a long, long time ago. In fact, it started from factories. If you look at any modern plant or factory or power plant, it's all being controlled by computers, by PLCs, the kinds of things that Kim was describing yesterday when she was speaking about Siemens S7-400 PLCs being infected by malware.

Every single plant around us is running on these things made by Schneider or Honeywell or Siemens or any of these manufacturers. The lights are on in this room thanks to PLCs like these programmable logic controllers which run our world. This particular picture is from a company based in Norway, the second largest company in Norway, one of the largest aluminum manufacturers manufacturers in the world, Norsk Hydro, which, as some of you know, was hit with a ransomware attack 7 weeks ago. And this is particularly bad because this company operates aluminum factories around the world. That's the factory they operate in Brazil.

And when the attack started, it was LockerGoga, this gang I described, who had gained access to their network and used lateral movement to get access to all of their servers. Or a big part of their servers and then launched the attack, encrypting files in all of their data centers, in all of their factories. And when they were done, the attackers did not ask for bitcoins. No, they simply left their email address. Please get in touch.

Let's negotiate. That's what they do. Norsk Hydro never paid a cent. They had backup systems. They also had cyber insurance.

Good for them. This is probably going to be one of the biggest or maybe the biggest cyber insurance payment in history. And they were able to recover their operations. But it did take a while. So 7 weeks ago on Tuesday morning, when people got to the headquarters of this company, there was a sign on the door which basically said that, you know, don't turn on your computer.

And if you ever get to your offices in the morning and there's a sign like this at the door, this is a bad sign.

So why was it especially bad that a company which is in aluminum business gets hit by a ransomware Trojan? Well, I didn't know this myself before this happened, but Aluminum manufacturing process is very brittle. It's very fragile. When you build an aluminum plant and you start operating it, you will never stop. It will run 24/7 forever.

You can't stop it. If you ever have to pause it for some reason, you typically lose the whole plant. This actually happened for real in Venezuela in February, not because of a cyberattack, but because of extended power cuts which they've been experiencing in Venezuela. The whole country of Venezuela lost all of their aluminum manufacturing capability permanently. It takes them at least a year to rebuild their factories from scratch because they had to stop in the middle of the process.

However, with North Hydro, this didn't happen. They had to take all of their computing systems offline, including the computers controlling their plants. Still, they didn't lose a single plant. How is this possible? How on earth were they able to continue operations?

What's the explanation? Well, the explanation is that this company still had a bunch of old farts.

Guys who had been working with aluminum process manufacturing all their lives, guys who still remembered how it was done before computers, guys who still had paper binders full of calculations and, and numbers and figures, could still do the math on how to operate and what's the right temperature and how much material do we need to to put in, who were able to keep every single plant operating, not at the real full capacity, but nevertheless to keep them operating. They didn't lose a single plant. We can still do this. They could still do this in 2019. Now the question is, how much longer are we able to do this?

5 years? 10 years? 15? Not much longer. We are reliant— our societies are becoming so reliant on computers, we have no other options.

And ransomware has become such a commonplace problem that there are now even companies, consulting companies specializing, that they will offer you a way out. ProPublica did a great story about these companies. Just 2 weeks ago. Companies which will advertise that, you know, you have ransomware problems, we have cutting-edge technology and we will help you recover 100%. You hire these companies and they will come over and they will recover your files 100%.

How do they do it? They pay the ransom. They go and pay the Bitcoin and they never tell you. They charge you twice the money and they give the money to the criminals, which of course only makes the problem worse. And this is not the right way to fight this problem, obviously.

I mean, we have a technical term for companies or technologies like this. This is called a dick move.

And if everything is becoming a computer, then we have to start worrying about devices which have much, much longer timelines or time cycles or lifetimes than computers. When you buy a laptop, you're not going to use it for more than 5 years, maximum 10. When you buy a mobile phone, you use it for a couple of years and that's it. But if everything becomes a computer, things change. Because when you go and buy, I don't know, when you go and buy a car, you expect to drive that car for years and years.

And when you sell the car, someone else is going to drive the car for decades. A new car bought today is still going to be on the roads in 20, 30 years, 40 years, even longer. So the question then becomes, how long should the car manufacturer be providing security patches for their cars? I actually asked this question from my followers on Twitter, and the consensus was that car manufacturers should provide security patches for 25 years. 25 years.

Today, nobody provides security patches for anything for 25 years.

The operating systems that we run get security patches for a couple of years, with one exception, which is XP, which is— was apparently the thing that won't die, and Microsoft will keep releasing patches for it over and over again. And I hate that. As you all, or those of you who work with patching know, 2 weeks ago we got a patch, RDP patch for XP. XP which is out of support for 6 years now. XP which was originally released in August 2001.

XP which by default did not have a firewall enabled. That's how old it was. Like when you bought XP, when it was brand new in August 2001, and you installed it on a computer and you put the computer on the internet, it was exposing every single port it had open on the public internet. That's how bad this operating system is. So clearly it should die.

And it won't die as long as Microsoft keeps shipping updates for it. So what are car manufacturers and other similar manufacturers supposed to do? When clients will need security patches for decades and it's very expensive for them to continue shipping them? Well, I think it's actually going to be fairly, fairly easy problem to solve. The car manufacturers themselves will ship security updates for 5 years.

Then they start selling security updates after that. And I think clients would be happy to pay for I mean, when you buy a car, you sort of expect that you have to start paying for new brake pads after a couple of years. You're willing to pay for security. You know you need security. I guess you're willing to pay for it.

And I think as their cars get older and older, eventually they will leave the problem of security to aftermarket specialists, which is what we do with cars anyway. When the car is old enough, you don't take it to the manufacturer official repair shop anymore. Dealers. They'll fix it. That of course will require that the car vendors will open source their systems so third parties can make patches for them.

And I expect that to happen. I think that's the solution. When you buy a brand new car, it's probably going to be closed source. But after 10 years, they're going to open source it and upload all of it to GitHub. And then someone else will make the patches and sell them to people who still want to drive their old cars.

Maybe. We'll see. But everything will become a computer. And cars are getting patches already today. A friend of mine was driving a Toyota as he got an over-the-air update as he was driving on a freeway, which is a little bit— feels a little bit weird, but you know.

And as you all know, Boeing is right now in the middle of creating a patch for a a little bit bigger things for the 737 MAX 8. And when the patch for their planes is ready, I wonder if that's also going to be an over-the-air update.

And as we are converting everything into a computer, we might be making a mistake. The idea that we are right now putting tons and tons of poorly secured devices on the public internet might be something that will come to haunt us in the future. Because mankind has this tendency of coming up with great new innovation, implementing it everywhere, and then realizing that it was a bad idea. I'll show you an example. Let me play you a TV ad from the 1960s.

Smart woman, she's putting a new floor down by herself. Wise woman, she's using Kentile vinyl asbestos tile. Easiest flooring to install, easiest flooring to care for. Save every way with Kentile vinyl asbestos tile. Kentile vinyl asbestos tiles, what a great idea.

Asbestos was such a great innovation, and it really was wonder material with great properties, great insulation, wouldn't catch fire, cheap to make, and a horrible idea. We all now know what a horrible idea it was, but for decades we were implementing asbestos everywhere. So what we're doing right now, one day we will maybe be looking back and thinking about IT asbestos.

The idea of implementing horribly insecure IoT devices with decades-old Linux kernels in them with no possibility for updating and with built-in default passwords, that's the asbestos of our time. And it will come back to haunt us. Right now, we seem to be implementing this everywhere. And it's clearly a bad idea.

Another big trend which is shaping our landscape is governmental attacks. Governments are getting more and more active in this space.

Governments are doing offensive work not just in the space of military, but also intelligence agencies and law enforcement. Yes, cops are using malware all the time in most countries today. They need tools to gain access to information handled by crime suspects. And since today more and more of the communication between people is encrypted, law enforcement can't gain access to information which is in transit, so they have to use malware to look at the endpoints.

Just look at these guys march. That's pretty impressive.

Our military doesn't march like that. It doesn't look like that at all. And when we look at the history of governmental malware attacks, the very first governmental case that I worked with was in 2003. So 16 years ago, that particular attack came from the People's Liberation Army, from, from the Chinese targeting a defense contractor in Europe with an attack where one of the leadership team members of that company received an email. From someone he knew and trusted with an Excel attachment which he opened, which worked fine, which actually contained information which made sense to him.

But the email was fake, the attachment was booby-trapped, and as an end result, they had a backdoor inside of the network of this defense contractor for 18 months until they started figuring out that something is wrong and They called us in and we found this. That was the first case, first governmental case that I worked with. And what I just described to you could be from 2019. We are still today seeing attacks where leadership team members are getting targeted emails from people they know and trust in their local language, speaking about local topics, real projects, real people. And an attachment, an Excel file, a Word file, PowerPoint file, a link to OneDrive.

It's still happening today, 16 years later.

And the word which gets thrown around a lot is cyberwar. Now the vast majority of governmental attacks are not cyber war. Vast majority of governmental attacks is about spying and intelligence gathering, and spying isn't war. Spying is spying. Intelligence gathering isn't war.

Intelligence gathering is intelligence gathering. And if something isn't war, we shouldn't call it a war because we have real cases of cyberwar. When 2 countries which are fighting a war launch cyberattacks against each other, well, then that's cyberwar. And that happens as well. Most latest examples are most likely from, from Ukraine.

Russia and Ukraine are fighting a war right now, and cyber is clearly part of that picture. Cyber is one of the domains of for conflict, one of the domains for war. And technology has always shaped the domains where we fight wars. We humans like to fight wars. We've always been fighting wars.

Technology used to restrict what kind of wars we could fight. So initially we could only fight wars with swords and arrows and bows until we got good enough technology that we could build warships. Which means we got sea war. But the innovation of sea war did not make land war go away. War just expanded into a new domain.

We had both land war and sea war until we got good enough technology that we could expand to air, air war with fighter jets and stuff, and then space with satellites and shit. And now today cyberspace.

And it's not going to end here. These are the domains where we fight wars today. Again, if you look at Ukraine, Russia and Ukraine have been fighting that particular conflict for 5 years now on land, on sea, in air, in space, and in cyberspace.

And right now it's kind of hard for us to imagine what would be the next domain and what comes after cyber. But there will be new domains and they will be revolutionary. I mean, right now it's clear to see evolutionary things like warfighting is becoming more and more robotic and drone-based. That's not really a new domain. It's just an expansion of land war or sea war.

A real new domain would be something groundbreaking, something which would be hard for us to imagine today, like, I don't know, DNA warfare or let's say nano warfare. I guess we could imagine a country attacking another country by dropping nanobots from a plane which would then go into the blood of soldiers on the ground and enter up in their brains and modify their thoughts, which I know sounds very science fiction, But then again, cyber war sounded very science fiction-like 20 years ago. There will be new domains for conflict, new domains for war. And I guess the easiest forecast to make about new domains for conflict and new domains for war would have to be artificial intelligence.

Now, as soon as we start to speak about machine learning and artificial intelligence, things get complicated because of how do we define these things. I remember reading a magazine in the early 1980s which was already speaking about artificial intelligence and how computers are becoming more and more powerful. And I remember how that article from 1983 mentioned that one day we might have computers which are so powerful that those computers would be able to beat the best chess player on the planet. And when that happens, then computers are going to be more intelligent than human beings. That was 1983.

And of course, that really happened in 1997 when IBM Deep Blue beat Garry Kasparov in chess. And when that happened for real, then we all sort of changed our minds. And, you know, that's not really artificial intelligence, just a very powerful calculator. That's not real intelligence. So it's kind of hard to define what is real, wide, strong artificial intelligence.

So that's why it's maybe beneficial to think about projects like brain simulators. There are real projects underway right now which are trying to build full-scale human brain simulators which would simulate every single neuron and every single synapse in a human brain. Now, this is very, very hard to do. We are not even close. But as computing power grows, I guess it's not that hard to imagine that, you know, in 20 years, 30 years, we would have big enough systems which could simulate the whole human brain.

Initially, it would be a massively large data center which would simulate only one brain, and even that would be simulated at very, very slow speeds compared to a real brain, like a million times slower than a real brain. But it would be a real brain. I mean, it would be just like us because it's a brain with hopes and wishes and dreams and just like us. It would want to do all the things we want to do. It just wouldn't have a body.

And as computers get faster, eventually it would be as fast as a real brain. Then it would be a billion times faster.

And that's when, you know, Terminator starts.

Is that going to happen? Maybe. It's not that hard to imagine that we would be able to build the technology to simulate a whole And that's going to change everything. And you don't have to take that from me. You can take that from President Putin.

У нас интеллект это будущее не только रसие, это будущее все вот же лайчство. Здесь класса не вазмужнится и truth на pragmatизировании все вот не угроза. Тот. Кто станет лидером в этой сфेरе будет врести лином мира. Лидером в этой сфेरе будет станет лидером мира.

The one who becomes the leader in AI will become the leader of the world. And I actually believe that the development of advanced machine learning systems and real strong wide AI is going to increase conflict in the world, not decrease conflict in the world. It's going to escalate conflict. Why? Well, imagine that an entity somewhere in the world is getting close to creating real wide, strong AI.

Most likely it would be a company. It wouldn't be a government, it would be a company. Google, IBM, Microsoft, Apple, Alibaba. One of these. Maybe.

Imagine that one of these is getting close.

Other companies, even most importantly other governments, foreign governments would be looking at that and realizing that holy hell, those guys are going to get that capability and if they get that capability it's going to be a game over. They will be superior in everything. They will beat us in everything. They will beat us in every single business decision, in every single technological thing. They will win every war.

We must steal that technology. And if we can't steal that technology, we must destroy that technology. This is why I believe this development will only escalate crises in the world. It's going to be such a big game changer that it's going to escalate things.

Are there any good news around machine learning? Well, yes. The good news is that right now, today in 2019, we're still far away from this. And right now, today in 2019, when we look at how machine learning is being used today, all of it is being used for good. We are not seeing attacks using machine learning yet.

Yes, there are examples on how machine learning could be used to do attacks, but those are typically academic research. We haven't seen real attackers using, for example, self-programming programs which would change their behavior based on how well they're able to gain access to different systems and using machine learning to do that. That, that's technically doable, but it hasn't been done. What we are seeing are attacks against machine learning systems used by security companies. Security companies have been using machine learning for years and years.

We started our first machine learning project 8 years ago, and we started seeing attacks against our machine learning systems maybe 5 years ago. Because machine learning needs data to learn. You need to teach the machines, and the way you teach them is that you feed them data. And that data has to come from somewhere, and attackers know that they can poison— they can poison the data. They can try to feed us data which would make our machines learn the wrong things.

So that's a real attack, but that's far away from seeing attackers doing real new botnets or real new phishing operations using machine learning techniques. And I believe the reason why this isn't happening yet is the skills gap. What I'm saying is that if you are right now someone who is able to to program machine learning systems or do data analysis for artificial intelligence, you don't have to go into life of crime. You will easily find a well-paying job and you will easily find a company which will fly you in any city in the world where you want to work and will give you a great job because we have such a lack of machine learning specialists right now. And that's not going to last forever.

Eventually, it's going to be easy enough to deploy machine learning systems that any idiot will be able to do it. And then we will start seeing attacks using machine learning. We're just not there yet.

So this creates an arms race, and this cyber arms race is different from every single arms race we've ever seen before.

Most arms get most of their power from deterrence, which means you don't have to use the weapon at all. All you have to do is to have the weapon and to make sure that your enemies know that you have the weapon. Prime example is nuclear weapons. There's only 11 countries on the planet which have nuclear weapons.

Nuclear weapons have been used in a real conflict 2 times in the history of mankind. That's it. The rest of the power of the tens of thousands of nuclear warheads on the planet is not in using them, it's in having them and making sure everyone else knows you have them. So how do we know which countries have nuclear weapons? Well, they are the countries which do nuclear weapons testing.

And they do it for a reason. They do it to show it off. Hey, we have nuclear weapons. Don't come at us. We have them.

Exactly in the same way, we know exactly how many aircraft carriers United States has, or how many fighter jets United Kingdom has, or how many tanks do the Russians have. How do you find this out? Well, you Google for it and you'll just find it from Wikipedia.

But how do you find out what is the offensive cyber capability of Italy or New Zealand or Vietnam? I have no idea. There's no way. We, we have no idea what they have. They probably have something.

But what exactly do they have? They are not showing it. There's no parades of cyber weapons being showed during Memorial Days. We're just guessing. I call this the fog of the cyber war.

We have no visibility into the weapons being developed by militaries for offensive cyber use. So whatever power cyber weapons have, it's not in deterrence. Cyber weapons have no deterrence power because we have no idea who has what. To make it even worse, cyber weapons rot. Cyber weapons don't work forever.

This is easy to see. Cyber weapons are based typically on a vulnerability. Let's say there's a new vulnerability in Latest version of Google Chrome. Well, that's pretty good. Can be used to gain access to your enemy's systems for now, for maybe a year, 2, until Google finds out.

They find a bug, they fix the bug, your weapon no longer works. Or they ship a new version of Chrome which is different and your weapon no longer works. Cyber weapons, just like real weapons, rot. They have an expiry date. They have limited lifetime.

And if you've spent millions into developing a weapon which has a limited lifetime and nobody knows you have it, that means sort of like a wasted investment. You've spent all this money to build something you never used and you got zero deterrence power out of it because nobody knew you had it. And this pretty much automatically creates an incentive to actually use these weapons. Weapons. And I'm not saying, you know, countries are gonna start wars just to use their weapons.

No, no, no. What I'm saying is that militaries who develop these weapons, when they start to reach their end of life, they might just pass them on to intelligence agencies that, hey, you know, we have this thing, might be useful to you guys, won't work for much longer, but it still works today. And this creates an environment where these weapons are going to be used more. Just because they exist, just because all this investment has been done to develop them, and just because they don't work forever. And cyberwar doesn't just play out in the virtual world.

Sometimes it plays out in the real world as well, as we saw 3 weeks ago between Israel and Palestine. You all probably saw the news about how Israeli Defense Forces launched an attack against Hamas. The news broke from the Twitter feed from the spokesperson from IDF who posted a video of them sending a missile strike against the cyber headquarters of Hamas.

And that's pretty real world. That's pretty real. And I think we just crossed a line here. I think we just crossed a line. I believe we crossed one line in 2010 with Stuxnet.

I believe we crossed another line 3 weeks ago when this happened.

Stuxnet crossed a line where we, the mankind, for the first time launched a cyberweapon which could have killed people. Stuxnet started destroying centrifuges. If there were any scientists nearby, that would have been lethal. We don't know if anybody died because of Stuxnet, but the creators must have known that this could kill people and they launched it anyway. This is the same thing with no question whether it could kill people.

Of course it could kill kill people. And this is also a good example of open source intelligence because when this happened 3 weeks ago, I got interested about it and I tweeted that, you know, does anybody happen to know where exactly was this Hamas building? A couple of hours later, yeah, I got a reply. I got the coordinates. So on the internet, someone always knows.

This is what we call open source intelligence.

Another good example on how virtual becomes something in the real world are the operations run by Russian cyber operatives. Guys like these. This photo is from a year ago, from April last year, taken at the Schiphol Airport by Dutch foreign intelligence photographing Russian cyber operatives as they get off their plane, rent a car, drive the car to The Hague, check into this hotel which happens to be conveniently located right next door to this building which is the Organization for Prohibition of Chemical Weapons which at the time was in the middle of analyzing the nerve gas used in the Skripal poisoning in Salisbury, United Kingdom. And as those Russian operatives started hacking the Wi-Fi network of OPCW, they were intercepted by the Dutch intelligence.

And it's a different ballgame if you are an organization like OPCW, which really does have to fight against foreign governments and foreign intelligence agencies. But most companies don't. Most companies are not a target of foreign intelligence agencies. Most companies are a target of criminals. And criminals don't want to hack your company.

Criminals want money. They don't really want to hack you. They want money. And if it's too hard, too slow, too expensive to break into your network, they will forget about you and will go after an easier target. Target.

So you don't have to have perfect security if you're only fighting criminals. You just have to have a little bit better security than the other victims. The attackers will go after the low-hanging fruit. And believe me when I tell you that the internet is a garden of low-hanging fruits. So many easier targets to hit if you're only fighting criminals.

And one note about Russia and China. Russia is the biggest country on the planet. China has the most people on the planet. But they're very different countries. It's quite surprising how despite the fact that Russia has all these great scientists and programmers and technology universities, they are unable to export any technology.

They're not exporting technology. You're not using any Russian technology. You don't have any Russian technology in your pocket. You do have Chinese technology in your pocket. Most of us can't name a single Russian technology company.

We can all name, you know, Lenovo and ZTE and Huawei and Xiaomi and all these Chinese companies, which means in times of crisis, in times of conflict, the amount of potential visibility China has on the rest of the world is completely different from what Russia has. And I guess this is one of the reasons why there is now this massive conflict between the United States and China and this whole Huawei incident and away.

So as we are building defenses around our networks, just building strong walls around them is no longer enough.

Yeah, we want to have the walls, we want to have the firewalls and the gateways and the proxies, but today it's not enough. You have to look beyond the walls, you have to keep monitoring what's happening inside your walls if you want to be able to defend. You have to assume that they— the attackers will get in anyway, which means you have to be able to detect when there is a breach so you can react when there is a breach. And there will be a breach.

And when security works, nothing happens. I wish you good luck in your work making sure that nothing happens. Thank you for your work.

Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado Equals Security.