#93 Matt Holland: Zero Day

Transcript from https://podmenti.com/t/6480a51d5f7e5abc

It's that going to the doctor scenario when you have a pain.
You don't want to necessarily find out what it is because, you know, people are
Naturally averse to bad news.
Yeah, you can't
be like that with cybersecurity. If you don't have
a cybersecurity vendor if you don't have a company helping you out.
With that problem.
Get on it.
Everybody is a target at this point. Th your company is not small enough to to be off an attacker's radar. I have seen five person companies actually I've seen two
So
You know, my my advice is don't be don't be afraid to to ask for help.
I'm Shin Parish and you're listening to the Knowledge Project.
This podcast and our website, fs.blog, help you sharpen your mind by mastering the best of what other people have already figured out.
If you enjoy this podcast, we've created a premium version that brings you even more.
You'll get ad-free versions of the show, like you won't hear this, early access to episodes, transcripts, and so much more. If you want to learn more now, head on over to fs.blog slash podcast or check out the show notes for a link.
This week I'm talking with Matthew Holland.
the founder and CEO of Field Effect Security.
For the past decade, Matt's been the guy that every three-letter agency in the Western world has called when they have a problem that they can't solve.
Before Matt started field effect, he enabled Allied governments to pursue their lawful mandate.
This episode is all about cybersecurity, exploits, hacking, and defending, and while this is a world we all hear a lot about, rarely are the people talking as knowledgeable and informed as Matt.
In fact, I'd say he's one of the top three in the world at what he does.
Let's dive into the mind of an attacker, what's possible, and what questions you should ask your cybersecurity vendor.
Along the way we'll talk about Snowden, what it's like to work at an intelligence agency, and of course Huawei and national security.
It's time to listen and learn.
Uh-huh.
So I've known you since
Right.
Nineteen ninety nine we met?
Two thousand.
That's crazy.
Yeah, world.
We used to work together at the intelligence agency. Yeah.
And then
That was the most insane period of time ever, right? We're in this small team
September eleventh happens, the world forever changes, our team
works non stop for
Effectively seven years. Like I don't remember
Any of us having vacation.
From two thousand one to two thousand eight.
Other than like a random Monday or something.
Firstly, I think vacation is probably largely overrated just because I'm a workaholic.
But yeah, no, it w it was a really neat way to to start.
Uh I I mean our career is
You know just a year or two apart, but
It was definitely a a very interesting experience being thrust into a
an environment where everything you do
Contributes.
much more than you would ever think'cause coming out of university, you know, you're
You wanna get a job.
The good salary.
All of a sudden you're it in our case
We're doing things that actually matter to the country that have a very significant outcome.
And uh it it
It's like going from zero to mature very very very quickly. Overnight. Yeah.
Yeah.
I remember one of the first meetings I had with you
Uh, we were trying to figure out how something worked and I stood up
you know, in my university sort of Bravo. And I was like, Oh, I'll tell you how this works.
And then I spent like thirty seconds explaining this thing and then
You looked at me and just deadpan like you're absolutely wrong. Here's how it works. You stood up and for forty five minutes you worked through like every instruction that happened in the operating system. And I was just blown away by your level of knowledge.
Yeah I mean that's kind of you to say. I uh there's probably a factor of uh blown away uh at how much of a jerk I was uh in the process of that, which
I'd like to say has changed, but probably not so much. But
Yeah, it it was it was a really uh
It was cool. I I I think the environment that we we got to work in was learning from people.
The uh
You know, for me that
that time in my life really defined what a good team was.
You know, when you learn something, you share it with other people in the office. I I remember
you know, there was five or six of us in particular at one point where
It was a very large research.
Focused group.
And any time you learn something or I learned something or one of our colleagues learned something, it it was a really neat discovery, but we took the time to educate each other. Yeah. And I think what that fostered was a team that, you know, a level of trust.
uh that I I had never experienced in my life. I I remember
you know, entering that team being massively humbled.
Uh and you know, once once the ego got dealt with.
Uh and you could really jump into that environment. It just
it it catapults one's growth and and I still look back to those times and and consider myself extremely lucky and
I guess always acknowledge that that that time in my life.
largely defined who I am today.
I wanna come back to that in a second. I remember
It is weird to hear you say sort of like you are humbled. You are literally the best in the world at what you do. And we're gonna come back to that.
Through it.
This interview.
Is it drinking whiskey? Pretty good at that, too.
Um
I remember showing up like
You used to drive me all the time in your Mazda. What was that? The It was M X six, but it was M X. Smelled like toffee not latte. Yeah, yeah. No, that was the that was the dream cybermobile. We spent a lot of time together.
What made you leave?
So I I
I I
I reflect on that quite a bit.
Uh just because I get that question often and I I don't think I've ever
really had a good answer that that wasn't necessarily
Immature.
The ultimate reason I left.
was because I s I saw a limit to what
I could grow into and what
the vision of the group I was in.
achieving one like th there was a ceiling arbitrarily put on top of that.
And
I'm the type of person that I I don't work well when somebody says this is as far as you can go.
But this is what we're going to do regardless of what the evidence
Uh or ideas or good ideas, bad ideas, whatever.
that that stopped and and it was not an environment that I said I can grow here anymore.
Um one of the big indicators of that, which um
You'll probably laugh at this, but there's a
There's a management competition.
I screwed up the entire the entire uh interview.
But
it was the same problem where
Somebody would ask, you know, the interviewer would ask me a question.
And rather than give them the answer of
You know, I would
I would build a team to do this. I would request funding to do this. I would
uh, you know, reach out to universities to bring them into the into the fold. So you know, that's the answers they wanted to hear.

were the technical responses to the questions they were asking. So how would you solve this problem? Yeah. My answer was
Well I would do XYZ.
And then I would do this. You didn't play the game. No, it was just I answered the question.
And I think that was the first time it really dawned on me that I probably
don't fit into the mould that
They were looking for.
So I think that's when I I started to
I guess the the
The ball started rolling on my departure.
I remember it changed probably about eight months before you left. Like it started to get more
I don't know, I don't even know how to word this. Like when we started it was
Um very fast moving. We had a lot of authority, a lot of control, a lot of decision making power.
And then slowly
As we became more successful, the irony is like that.
sort of became less and less over time. Yeah, I remember um having a conversation with one of our mutual colleagues at the time, and I remember being very irritated about the um you know the arbitrary handcuffs that were being put on our ability to to innovate.
research, um, you know.
I I remember a contentious time that you and I actually
you know, stood up in a at a town hall and got in a giant argument with uh a director. Stu, if you're listening, we're sorry.
And it it was
It was very frustrating and I remember that colleague saying, This is just part of business, man. Like once you once you're part of a group.
that does something really good and and people take notice and they you know they want to turn that into a larger part of the organization. And with that
comes what you're seeing now.
You know, formalized
you you can't work more than this. You you have different reporting responsibilities. And you know, at that time I just I just wanted to innovate. I just wanted to come up with new solutions to the problems that operations were were running into.
you know, not being able to do that in its raw form was extremely frustrating.
Say left. And we we can't talk about what we did there, but we can talk about what you did.
Right after you left.
And so you started
uh lynchpin and you
You had an unconventional sort of way of of starting that company, which is releasing
Privilege elevation, uh to get some attention on Microsoft.
You wanna talk about that?
Yeah, so
That that was a that was a funny period. So um
you know, at the time my my business partner and I we we we thought, you know, how can we make a splash because when we left
You know, our intention was to um you know, augment the world that we left with, I guess
uh a privatized twist on things.
So we thought about okay, how can we how can we really stir things up a bit? And at the time
Microsoft was releasing mandatory driver signing as part of Windows Vista.
Which she'd showing her age right there. And and you know, there's so much hype around it. And i the way it was being advertised, what it was gonna be the silver bullet to stop all malware, to stop
You know, anything bad that could be happening.
And anybody who has spent any time
I guess on the offensive
Side of the house.
you know, was looking at that and saying
No bullshit. Yeah, it i it'll it'll be it'll make things better.
But it's not gonna be the silver bullet that everybody thinks. So we said, All right, well why don't we just do something kinda funny and you know
Show them. So what we did was we wrote a tool called uh Den Whip Attiv. The name of the company was DenwipAtsive, which is
Vista Pooned.
Uh in reverse.
You know got a signing certificate under this
Fake company.
Legitimately registered.
Fake in reality.
And
release a tool that would load
It was a a signed component that would load an unsigned driver and it was
Not the same.
to do anything other than show how easy it is with the most simplest, goofiest approach to get around
This problem.
And uh so at the time I was in Australia um with my business partner starting things up. We were working out of a closet, really kind of a ragtag setup to start.
And at the time there were uh people being uh
Arrested for violations of uh the DMCA, uh Digital Millenniums Copyright Act, which
you know, back at that time was a really
Contentious thing because it was
changing what people could or could not do with computers and it was a it was a really big deal. So uh when we released that.
Um, some people are like, Oh, that's kinda neat. And other people are, you know, one person in particular was like, This is a violation of the DMCA. You should be arrested.
PS it's not really that cool. I'm going to go and release a tool that um actually exploits
ATI drivers and NVIDIA drivers, and then basically does the same thing, but I've done it a lot cooler.
So take that linchpin. Ha ha. Right. And and in reality that that was I remember that guy. Yeah. That that was so much worse because I and I don't know
If it actually resulted in the revoking of ATI and NVIDIA's
uh signing certificate, but it it was something that
You know, to us it it was
It was over the yeah.
Well, it was stupid to say that we were violating the DMCA and two, the response was just
so much unbelievably worse. And it w it was a very weird first few months of the company.
Do you ever miss sort of working at the intelligence agency?
I miss people.
I miss a lot of really good people. Uh amazing people. That's a very underrated people think that
uh all sort of like government employees are lumped in the same
Same group, they're not
Um as we can both attest to.
Yeah, so I so I miss the people. Uh I miss having firsthand exposure to the mission.
Yeah, I I think back
to some of the things I got to see and be a part of that.
no one will ever know about and and that
It was really cool.
It was really neat being a part of that.
it creates memories that I'm pretty sure if I were to run into somebody thirty years from now on the other side of a bar
you know, immediately there's that connection of like, Hey, we did that. That was really cool.
So yeah, I mean I miss aspects, but I don't miss the the handcuffs that
Uh we're we're
Ultimately part of my departure from there.
And then when you left, do you do you ever feel like there was
They didn't want you to succeed because they wanted you to come back.
Was there a part of you that felt like
They didn't want to give you contracts. They didn't want to
I I don't know if there's any anyway.
Interest in me coming back?
I think there was definitely skepticism as to whether
I could succeed.
Which um
It's f I'm I'm fine with that. I mean
you know, clearly at at the time my business partner and I were the first ones to kind of make that jump and do that together and
Um, there's a lot of skepticism as to whether we should be allowed to do that, whether we are able to do that. I I remember having a departure interview with a high up manager who sat me down and said
You're gonna go sell to China. You're gonna enable China.
And
I I looked at him in the eye and I said are
What on earth would make you think I would ever do that?
That is the most ridiculous thing ever. So so I think there was a bit of fear that we would enable
You know, adversaries of of Allied countries.
Yeah, I mean in retrospect I can understand. I just think it i at the time it was a uh it was an immature view.
I remember going to a meeting a couple of weeks after you left and they were like, Oh, we're not gonna buy anything from him and I was like, We're gonna end up giving this guy like fifty bucks a year.

I wanna say I was closer to reality than they were.
But I mean so so the idea of going private was taking the handcuffs off and creating an environment where we put
really, really smart people together. I'm you know, part of our recruiting strategy was immediately going after the best people in the community.
And
taking all barriers out of their way and making letting them do amazing things. I w I wanna dive into that a little more because you were able to replicate
an entire wing of an agency if you w you want to say that.
With
One twentieth the number of people.
And have higher output. How are you able to do that? You just
Same people. You just took them out of the environment and
What enabled that?
Largely removing barriers. I mean, I I think that was a big component of it.
you know, giving them an environment uh that they could excel in, which, you know
breaks down into what tools do you need?
Do you need to put in a purchase requisition to get what you need, or can I just
Get that for you.
Like I that was one of the comments uh from one person I remember early on when they joined. They're like
Okay, these are the three to do my job.
And I was like Okay.
I'll be back in thirty minutes.
And
Here's your stuff.
And the reaction was
Really?
Like we can just do this?
Yeah.
Go be a genius. Go
produce amazing things.
So I think that was a big component. I think
Making it clear that everything that we were doing was as a team.
And uh I I think as an aside, this is one thing I think people who are entrepreneurs sometimes get caught up in that it's about them.
It's about their journey and the the the way I approach it is no we're all in this together.
I'm really lucky to have you.
In the company.
And
creating that environment where they knew that they were lucky that I appreciated them.
And that whatever we do, we're doing together. I I think it's an empowering
Message.
uh to build a team around.
I remember one of the things I took away that I've learned from you is when you started doing that with people and you were like, What equipment do you need to do your job?
And you just go out and get it for them and they were astonished by how simple that was.
And that's something we do with everybody here too. We just sort of like what is it you need to do your job to the best of your ability?
There's a downside to that too, which is really interesting, because then you lose the excuse of
The equipment's the problem. If only I had the right tools, I could like deliver, right? Like so you s there's this subtle sort of undercurrent to it, which is
uh I expect you to be amazing at what you do and keep getting better.
Yeah, I and I mean I I think for some people, um
Sometimes just that belief helps them get there.
And so you did LP L from what, two thousand and seven? Seven to eighteen. To twenty eighteen. What are some of the lessons you learned about growing that? When you ended, how many people were there?
So so globally
I I'm gonna lump in the the partner company that we we were sold with, but I think for
At the time close to ninety to one hundred.
Um, we sold in twenty eighteen, but I I didn't leave until December of twenty nineteen.
Uh I wanna I wanna come back to that, but what are some of the lessons you learned from growing, scaling, running that company, recruiting
I think one of the
biggest things was I you know, starting a s a company from scratch. Um, you know, at that time I I I had a computer science background. I I clearly had a lot of experience in in
Cybersecurity.
Yeah, I took some accounting courses and marketing courses in university, so I think there was a bit of a foundation as to okay if
You know I remember doing a business plan because that
Was one thing you did.
You made a business plan.
But one thing.
through the lynchment experience that I that I got to have was I got to do every job.
I got the
literally be the janitor. I got to be the marketing person. I got to be the primary salesperson. I remember doing really challenging sales pitches in front of audiences that didn't even want me in the room because I was
you know, stamping on their their creative territory. I got to write code. I got to manage projects.
I get to be the the evangelist in the company.
And going from there to field effects.
But that base I think allows me to really
you know, make decisions that are more informed.
It allows me to to, I guess, understand and appreciate all the different parts of Field Effect and that which is a much more uh direct. Yeah. Um so I think so I think there's that. I think the ability to make decisions uh and be confident in those decisions.
not get caught in uh, you know, paralysis of decision making. That is something that I think at first I I I struggled with, but over time the ability to to filter out the noise
and focus on the things that actually truly matter.
Have a
I've really helped.
Why'd you leave? I mean uh
Right before you left, you're the
You're the guy every
three letter agency and basically the
Allied world would call when they had a problem they couldn't solve.
And you would solve it.
My leave.
I was gonna make a joke about they they ran out of problems, but they didn't no problems done. Uh all problems off. Um actually the same reason I think uh and and this is actually where I think I realized why
you know, the root factor of why I left CSE.
Is it was a similar scenario where um.
Yeah.
Yeah, but it it was a it was a change in in what I could do.
was you know, I I I started to see a ceiling on what I could achieve. And it became clear to me that
You know, I was the square peg trying to fit into the round hole.
because of emissions and and more creative things that I that I thought we could do. And that was that was actually a pretty interesting experience coming to terms that I you know, I was the the square peg.
And the round hole,'cause it definitely took took time to go's not gonna change. Yeah, yeah. And and you go through this evolution of like
What's wrong with everybody? Why why is nobody uh on board with this? And then
The realization that Oh shit.
It's it's me. I'm the problem here.
And then the the appreciation of the
Okay, understanding why that is and I think that that ultimately
uh made the transition very easy, actually. And and uh it's not something that I look back with uh at this point with any animosity or
anything. It was just part of life. You exited with more than enough to sort of walk away.
for the rest of your life and
To sort of like sit on a boat in Costa Rica and never have to worry again and then but the sharks.
There are sharks.
But then you you start a field of fact and
How many employees are you now?
Almost a hundred.
You're almost a hundred. You're entirely self funded.
to this point. So you basically took all this money you made and you were like, Oh, I wanna do this again.
And I'm gonna put it all on the line. Like what went into that?
Thinking.
I several factors. I I think I I really enjoy solving hard problems.
And the the the current state of the cybersecurity industry
To say it's a hard problem is an understatement. Um it is a is a
An un unethical shit show, I would say.
And it
It really bothers me.
Uh where it's at?
I think there's a
There's a large part of me that wants to fix that.
There's also the aspect of I'm like ultimately a serial entrepreneur.
And and
Yeah, I remember chatting with my wife, like when that transition was happening.
She asked me, like, why are you doing this?
And I was like, What else am I gonna do?
I'm I'm just gonna start something else and it's either
Yeah, uh
cybersecurity company that
I'm once again run in that I believe can change the world.
And fix a lot of problems.
Or I can open a coffee shop.
Probably gonna take the same amount of time.
So
How about that?
The cybersecurity firm.
And how important has she been through this?
She's amazing.
Um I I uh I I don't think I I could ever thank her enough. I I think the
The the formula for for for my success, um, she is a she is a huge part of that. Um she has a funny work a whole lot.
Yes.
If you could
If you could sample what makes her run, you know, who she is.
And somehow create like a vaccine and inoculate the world like you would have
world peace, uh, hands down, and and that obviously

Is is a strong statement, but she is a phenomenal anybody who knows her, um, would uh would definitely agree with that. I would agree. She's amazing. She is pretty cool.
You mentioned sort of the state of the cybersecurity industry. Talk to me a little bit about that. Where are we? What's it look like? I mean, there's nobody in the world from my point of view that would have a better aperture into
Not only how things are
how they're sold, but also the attacker's mindset in terms of
what you're buying versus what you're consuming and how it's impacting your business.
This is the part in the discussion where I get angry.
That's okay, we got a lot of scotch.

So
I I think to answer that question.
The first thing you know we need to do is is look at what the cybersecurity industry actually is, because I think there it gets muddled.
um the the way the public looks at it, the way it's reported on. It's just everything. It's like a grab bag for Yeah. So I I think there's there's three
groups are are are pillars of cybersecurity. There's the one there's the offensive side, which we've talked about, the
The the ransomware, the intelligence agencies. I I say offensive, but the whole it's that traditional hacking, which um you know, has b largely been glorified thanks to Hollywood. Mr. Robot gets it right, though I don't know if you've I remember in Swordfish he sits in like eighty seconds later everything's Yeah, no it's largely horseshit. Isn't that how it works?

With VR goggles, yeah. Um but if you ever see Mr. Robot, that that is actually an accurate representation. Um if you ever
Uh curious, but it is a
You know, it is this glamorized thing that is entirely misrepresented, but it is an economy in itself. There's an economy behind.
ransomware and they get paid for it. They are successful. There's an economy behind
intelligence agencies. That that is ultimately what drives that dollars and cents.
On the defensive side
The second bit. Oh, by the way, the first bit only exists because
Uh humans
are generally horrible at writing software. So that wouldn't exist.
Yeah.
People were actually good.
at security models.
And implementing software.
The second bit only exists because the first bit exists. So that's the defensive side. So let let me I guess the best way to describe it is
As a consumer.
It is
probably the worst experience you could go go through. So
If you if you're gonna go buy some cybersecurity.
Um
Are you buying an antivirus? I want to buy. Yeah, buy some cyber. Yeah, because that that's largely because it's it's a it's it's a we're joking about yeah. It's a black box industry, right? A lot of
A lot of businesses, a lot of people don't know what they're actually buying, and that has been exploited by the industry. And this is the part where I get angry.
Because none of the solutions out there. There there are a few.
uh that are that are decent, but
Like you look at what your options are. Do I buy an antivirus? Do I buy any spyway? Do I buy a firewall shade?
Maybe uh an IDS intrusion detection system. Maybe
End point.
uh detect and respond. Maybe uh user behavior analysis, maybe a network monitor.
And the way that
Vendors will
try to push it forward is they say, You actually need all of that, which is
Total crap. You do not need
All of those things, they do not work well together. So that that whole thing
Angers me to no end.
The third bit
is a category that isn't actually cybersecurity.
Uh I read an interesting article uh recently and it kind of clued me in. I was like, actually
Yeah, no this third
Yeah.
And it's that bit that happens
in you know, on the internet, uh, social media, that type of thing.
Uh that isn't actually
Security related. But people like to kind of
So an example would be a little bit more.
um you know election interference. So how do
What are the organized influence in influential campaigns on on social media to to get people to vote in particular directions? I I do not think that's cybersecurity, but that also gets lumped in.
So that that
is the third bit which is kind of like
Faux cybersecurity. It's a little bit confusing because then you lose track of what's actually happening. But I mean, intelligence agencies have been spying on other countries forever. One of the things that have changed now is not only the amount of consumer data and the value of that data, but also that people are spying on companies now.
As it means to fast track their R and D.
Um w why invest hundreds of millions of dollars when you can sort of like just hack into somebody else's computer and download all their work and then claim it as your own?
You know, I mean it it it highlights why
You know, it people uh companies need to take this this problem seriously. And and I don't think it necessarily extends just to large companies at this point, legal firms.
uh accountants.
Huge targets. Huge targets. I mean, you you think about what they're dealing with in regards to confidential agreements, financials of individuals and companies. And and that's one thing I think we've seen over the last couple of years is
the the attention that state sponsored groups are going after. It's no longer, you know, the Sonies of the world. It is now your you're
your law firms because there's a lot of intelligence value there. Patent firms. I mean there's there's a lot of
intelligence value there. So um the
You know, how how seriously smaller companies need to take this threat.
I think has really gone up.
I I find it super interesting. I mean, I was talking to KPM G just last week and they were like oh send me this
And I was like, How do I send it to you?
And they're like, just put it in an email. I was like what?
What are you talking about? Like I'm not putting that in an email.
Yeah.
Okay.
I I sort of compromise with like I used quickforget.com and like uploaded something and was like this is good for like six hours, so you better download it, but
It's amazing to me that the lack of thought that goes into the information you share.
And how that manifests itself or what's exposed, right? Because if somebody breaks into that computer, that whole email chain's there. Now the file's there already, but the
A lot of the emails
Stored in the cloud.
It's a lot easier to access than people realize. What makes you want to tackle this problem? Like this is like
The greatest intractable problem ever with
Tons of competition. Like the government's doing host based
You have private sector doing all of these things, cobbling together solutions. Like what makes you think that you
You can
Have a better
outcome for customers.
Probably arrogance.
Ha.
Um a joke, but that's the thing. I mean, nobody knows the industry better than you do, but like seriously, there's billions of dollars going on here.
Uh yeah, so I mean if we if we look twenty years ago
It's the same.
Problem.
Um one of the things I I tell people when they join who you know, when I hire from intelligence agencies is that
Be prepared to be disappointed.
Because the problems that you are going to see
Will shock you.
that uh you know, that they're still out there. So the techniques that are are ten years old.
or the problems that should be ten years old are still happening today.
And
You know, I think that is that's a large referendum on how
not good the cybersecurity industry is at actually trying to solve the problem. And if and if I look at
you know, the vendors out there, I'm not gonna name any specific competition, but what I see
is a sales strategy that
is like a warped use car salesman strategy. And it that's probably an insult to use car salesmen out there because it's it's much worse.
It's all it's all about the transaction. It's all about, you know, getting getting that done, taking the customers' money and saying good luck.
And
That isn't result for not responsible for anything. Yeah.
And that's not
Making anything better.
How should that work? Like how do people buy cyber isn't it the
I wasn't on
sort of like the acquisition of cyber side, but like this Gardner quadrant, does that sound familiar? Yeah, yeah. So that is uh I guess a measuring system, a measuring stick to help
the vendors or customers or prospective customers, companies, I guess is a better term, to you know, guide them in buying what they they may or may not need.
There are a few problems with that.
The Gardner quadrant system is
often outdated. We we were
For example, Field Effect was marketing a managed detect and response um service well before it was defined in Gartner. And ironically, at the time, we had a hard time
You know, gaining traction.'Cause that's always looking at like existing sort of technology and threats and looking backwards saying like, Oh, these people accomplished this, but not looking forward in terms of
where the industry's going. Yeah. So so that that you know, that that is a it is a useful classification system. It is just
behind the curve continuously.
The second thing is I don't think
businesses actually necessarily know what they're looking for. Yeah, like how would you be educated if you're like um
a law firm, an accounting firm, you got a hundred employees.
You don't have like a cyber guy or girl and you like how do you how do you go about doing that?
So so I mean that's that's ultimately the the realm that
you know, field effects that's in the the small to medium business space because
You know, it is infeasible for every company to have an IT team.
And in in our experience, I mean
An IT team is good.
Um, they have expertise, but they may not necessarily be, you know, security experts. Is is that kind of like Shopify for
Cybersecurity,'cause Shopify is really
Arming you you don't have to worry about building a
store. You don't have to worry about managing inventory. You don't have to worry about the they're arming the rebels, if you will, against Amazon. Like are you giving world class technology to
small and medium sized businesses as a means to like you don't really have to
Know all the ins and outs of cybersecurity, but then it becomes trust based. Like why would I trust you over another vendor?
Uh, that's a great question. I mean, I I I think trust takes time.
Yeah, you d you don't just uh magically get trust right out out of the gate. And I and I think that is a uh that is something we put a lot of time into building. We take time to create a customer relationship.
Uh.
customers what their needs are, what are their problems and then
Yeah. Tell us about your network.
How can we help you? Um and
you know, early on in that process, I I think it becomes clear that we're not just out trying to sell
software in a commoditized way. The first thing we do is
Do an external view of the network and and identify, okay, here's a problem right here. We want to help you fix problems. It's not just
Here is a solution.
that you have to run with.
It is all about us.
Helping you be better.
Fixing problems and sustaining that.
moving forward. And that and that is largely a a component that I don't think most vendors in the cybersecurity industry get. They are more interested in showing you
Check out this really cool interface which
No, no one in your company is probably going to know how to use it. And then if you don't see something, it's like, Oh, it's not our fault. It was in the interface somewhere and you didn't
Yeah, you didn't see the logs, so why
Why didn't you action that?
And then that I mean.
I I think the assumption that
the average business is going to care about cybersecurity is is a f a false starting point.
Because businesses, you know, you buy your computer hardware, you get your IT set up. If I'm a
business and I, you know, out there, I'm not starting my day off thinking, Oh, I can't wait to buy some cybers or understand some, you know, cybersecurity. And
That
Is the baseline.
Right. That that I think for uh, you know, an effective solution, that's what you're dealing with. You're you're you're dealing with a company

Doesn't care about cybersecurity.
But you need to help them.
the baseline of the the the interface could be an office manager.
Not somebody who has a computer science degree.
Or somebody who has any
background or interest in cybersecurity.
So having a system that
You know, is set up and built.
and implemented to work with
People who don't necessarily care.
uh or will care or or or should even care because that's not their job.
That's what we do.
Well, that's a good point, right? Like you're not trying to make them care, you're just trying to say this isn't a worry for you anymore. Yeah.
Yeah, and and when something comes up, here's a very concise way of dealing with it.
Not a you know, a series of links, go Google this, learn how to implement a VPN, learn how to use a firewall.
Or how to patch your system.
Um it's a it's a guided approach to this is specifically what you need to do.
Let's flip that around and
Uh what
people don't often see which you can add uniquely is sort of
What's the mind of the attacker? Like if you're looking at acquiring
um valuable information from a
Company.
Walk me through that whole process. Like how do you think about that?
How do you go about doing that? What does that look like?
So initially an attacker is going to profile the target.
And that can look like different things. So if if
You know, the the target has online services.
They'll probe those services to see what's there.
Uh are there any email addresses on your website that uh are really easy to identify?
What type of social media presence is there? And that ultimately will lead into typically a social engineering campaign, uh, either in the form of
you know, an an email that is received that looks really normal, that you wanna trust, and hopefully will get you to click on something or double click on an attachment.
Or it'll go to your phone.
You click on that and
That exploitation occurs.
The other approach that we see quite a bit is uh people don't use multi factor authentication.
with um just a basic email setup.
So brute force brute forcing passwords.
Works.
Somebody gets in.
We'll scope out your inbox and and see what's there, who are your customers.
What's your routine? And then they will uh perform perhaps a financial redirection. So in that case, they would get an idea of what your entire portfolio is and email all of your customers and say
Hey, here's your new payment instructions. And they will have all the outstanding invoices.
Already
uh, you know, listed and ready to go. So they can immediately say, you, you know, you owe us X amount. This is where I want you to send this money now.
And
That is remarkably and surprisingly effective.
Yeah, and hard to track down even though there's like
Total with bank accounts we'll come to cryptocurrencies and sort of run somewhere later. But
with bank accounts, it's it's easy to see where the money goes. It's really hard to get the money back.
Once it's gone. Yeah.
And that that's conventional sort of attacks, right? Versus
um sort of somebody like Boeing or General Electric or sort of Cisco who would have a lot more valuable IP.
And probably worth a zero day or sort of like developing a custom exploit. Can you walk me through like how that would work?
Hypothetically, of course. So I I you're you're interested in more of the pointy end of the stick? Yeah. Yeah. So you know the way the way exploitation works is

Uh let's walk through Windows. Okay.
So if you're going after a Windows box, uh it it's either a server or or workstation. And typically servers, if they're internet facing, gives you the ability to to hit it direct. So if you have a a zero day and um you know a a web
uh server, for example. That is something you can directly access and
an exploit.
direct way, I guess, of uh of attacking the other approach is uh you you have a Windows client, you're you're sitting at your desk, you have a laptop, and you're just, you know, typing away.
And you get an email, that is probably the most common way and what what
that looks like is again back to the the scenario where you're trying to convince somebody
Uh to trust an email. So they click on a link.
What happens? Like walk me through. I click on this link. Yeah, yeah. So so the first thing that happens is
Uh you know, the browser.
Uh would be exploited.
So whatever browser renders that link, uh web browser exploit would would
basically gain code execution and and modern browsers are are definitely getting better at protecting against that type of thing. So you know Chrome is every every browser has a sandbox now.
Most browser
flavors are uh
you know, some measure of Chrome. So even Microsoft Edge is now based on uh Chromium.
And so is brave and so is like
Firefox isn't there, is it? No, no, Firefox is not.
I think they're still rocking their own their own setup. For now. They just fired their threat team.
Oh geez, didn't even hear that. Um so so yeah, it gains execution inside the browser, and then the goal is then to uh gain privilege in the operating system. So that could constitute a sandbox escape to get out of that browser sandbox.
uh a privilege escalation to
ideally uh execute at a higher privilege level to to basically
nullify any security on the host and ideally get execution in the operating systems kernel. And once you're there
It's largely game over.
So what you get
Colonel on an individual host. Walk me through how you
Like how does that become network access to
I don't know, super in min level or
So so once you have that, you you
There there really is no barriers to do to to doing anything on that host.
So if you want to open up comms back to mothership.
You can do that. If you want to access a whole bunch of data, uh you can do that. But how do you open up comms? Like isn't everybody monitoring these links now in terms of like how you exfil information? Uh no.
No. It's a so the so we're kinda diving into why this is actually a really hard problem and why any specific pillar doesn't work. So
If if you only buy a network monitoring solution, you won't see
Really anything that I've described thus far.
If you buy
an endpoint only solution, there may be hints of things that have happened depending on the sophistication
of the endpoint solution, but as soon as it gets so uh particularly deep.
uh in the kernel th you're not going to see that. So
it's a very challenging uh position. That that's why having a holistic approach
is so important. You need network, you need endpoint. So if you get by either one of those things, the other will pick it up. And how does that work? Like on a a particular client, I can understand how those things communicate.
But then how do you how do you take an attack on one company and then translate that into a defense on another company with something you haven't seen before?
So I guess largely that depends on how well
the cybersecurity solution is implemented.
If it is part of a a network where you can dynamically signature an attack quickly.
And
Create an artifact, we'll say.
that can be applied across the network of other customers.
That is a way to combat against that.
I mean the zero day problem is is something that's always going to be there. I I think this is something that a lot of
vendors don't actually realize that no matter how much you lock down your operating system, there's always going to be a creative group out there.
that does things better, that can get around it. I mean if you look at Apple, uh Apple iPhone.
For the past.
I don't know, we'll say decade.
uh they've been adding an increasing number of security mechanisms into the operating system.
That largely
Limit an operator to only
being able to do specific things.
But that is largely crippling from a security standpoint,'cause all you need to do is get around these set of mitigations and you now
can own any Apple device in the world. And a really scary thing is recently a company called Vupen, uh, that isn't you know, they buy zero day exploits. Um, not sure where they go after that, but what they do is well I can speculate, but uh they buy zero day exploits and
Uh they they they posted something recently where they said, We're we're full up on IOS privilege escalations. Um
We got enough.
Yeah.
And and if that isn't a wake up call, uh to to Apple, I
Don't really know.

The industry is saying
Yeah, your operating system is not as secure as you think it is. That it's kinda like the great wall theory, right? Like you have this big wall around, but once you're on the inside of that wall, it's like there's no defenses after that.
Yeah, and and that perfectly describes Apple.
Actually describes
Every mobile operating system out there. Well, Android, talk to me about the specific challenges with Android, because they have their
They've like a host of other problems that aren't
common occurrences that
have to be dealt with. Like everybody has a different version of Android that they're running. It's always at a date. It's Yeah, so Android's an interesting beast because um a lot of it's the most common platform, isn't it? Yeah. Yeah, and it gets a lot of positive attention out there because it is an open platform.
You know, you could download. Yeah, you you can download the source code and you can see what's running. And that is a component of a secure operating system, I guess, that
You know, the average person can go out.
And
Audit what's there. The average person could, if they want, take that, download it, compile it, put it on their phone, and maybe add some additional bells and whistles.
The concept
Is very noble.
The reality of it is not so great.
Because what we have today is there is the main Android branch that, you know, evolves that
Um Google releases Android eleven just got uh recently released.
And vendors will take that.
And they will adopt it as is, or they will customize it, or they will um, you know
take potential parts of the uh what's
um called a change history. It's basically the
The changes that have been made to the code base.
When that is taken in context with vulnerabilities.
The fixes may or may not make it in. So you could have
You know, the latest Samsung phone?
Running Android eleven.
That doesn't actually have all of the security fixes that the main Android branch
Right.'Cause somebody's accepting or rejecting. Yeah.
Yeah, and I and I can tell you that a hundred percent certainty. Um I have not looked at Android eleven, but uh but I have
experienced over the past two decades, there are problems in the Samsung version that have been missed.
Because humans again are part of the equation.
And you know, on the list it'll say, you know, C V E fixed, C V fixed.
But those fixes aren't there.
Bad guys or attackers will know that.
And they will exploit that.
And there is literally nothing you can do to defend against that if you are a target. And that is a
Pretty frightening.
Proposition.
So you would rather go up against an Android phone than an iPhone if you're an attacker.
Uh that's an interesting question.
I I think the odds of getting
uh exploited or higher on Android.
Although the the nature of Android also creates a a a scenario where there's so many different flavors of Android.
It makes it much more difficult to create a mass
Attack.
Whereas on iOS, because it's the same version of the uh of the operating system across the board on every device, if you can find a problem in that, you get all those devices. On Android, you get the nuances. I put nuances in quotes of some of the decisions that individual vendors will make that
That makes it very difficult to take.
an attack on Samsung and apply it to I don't know Google phone or a ZTE phone. So it's
I would say generally it's the the security position on Android is is
Is worse.
You know, the the odds of being hit in a mass attack.
Uh
potentially lower. But if somebody is targeting you, I would say that the odds of you know you
them being successful against you are higher on Android for sure.
as as phones or, you know, if you want to call them personal computers, it's like those are our personal computers, right? Uh more so than we think.
become more prevalent.
They'll become the surface of which
gets commonly attacked.
Walk me through like how does phone exploitation even work? Like is it the same sort of system that you would use for Windows or
Apple, is it different? Like how do you attack the phone?
You have this thing on here all the time. It's got a mic, it's got a camera. So the the unfortunate answer is the exact same way you'd go after every other type of computer.
Uh iOS is just an operating system. Android is just an operating system. There's there's no
There's no special features that make it impervious to attack. There there are different security
mechanisms in place that an attacker needs to get around, but it's the same deal. So if I'm going after your Windows laptop in the scenario that I described, where I send you an email
On
mobiles, uh, it's the same thing. And it's actually worse in some cases. Uh about a year ago, company out of Israel called
NSL group, they got busted for having a WhatsApp.
zero uh zero click mechanism. So there there's some quick lingo dive here. Uh one click versus zero click. One click is you have to social engineer somebody to the point where they can click on a link and exploit the phone. Zero click is where there's nothing you can do.
You are just
Owned and you have no idea.
You don't even see a message.
Yeah, no decision on your part. You're sleeping in the middle of the night. In this case, uh NSO group
um, you know, sends you a malicious bit of content via WhatsApp.
Assuming they've been able to, you know, figure out your WhatsApp ID.
And then exploit your phone and congratulations uh that that whole step of getting around sandboxes, privilege escalation, that it's all the same concepts.
But in this case, it is a direct way to attack a device that you own.
So previously like tools like that were only in the hands of governments and they weren't
generally targeting individuals or small corporations. Has that changed?
I think the accessibility
Is different.
There's like an asymmetry to this, right? Like some some
person, some teenager, guy or girl sitting in there
Garage.
can literally
have a massive disproportionate impact. I'm thinking of the the attack on Twitter recently and how how you know that was a social engineering attack. And um
Yeah, and and
you know, in the context of going after mobiles, I mean that
That's that's it all comes down to the accessibility of the attack factor and the the creativity of the person running
the the attack factor. So
I was thinking, you know, with a with N SO group.
Yeah, there's a there's a lot of articles on them about who they sell to and don't sell to. Um, they have a whole group now, or whole internal group within the company that I've read.
uh dedicated to making sure they make ethical decisions.
I don't
personally trust that they're making it ethical decisions. Why do you need a group to make ethical decisions?
I mean that's an indication that, you know, ethics weren't a component in the founding of the company. Uh but that's a probably a whole other discussion. But yeah, I I I think you know the the the the point that
the attacker and what that looks like is is
You know, it it it's much
More plausible that it is not an intelligence agency.
You know, y you look at the the
The groups that are running out of uh
you know, other countries. I'll I'll pick on India a little bit just'cause I've seen some
You know, some IP reports on
Yeah, some some
problems coming out of there, but firms of
social engineering efforts. You know, it it doesn't take a lot to go after Android that's two years old. And how many I haven't looked at the statistics.
Of how
you know, what the the market coverage is of of Android versions.
pretty confident that if you're rocking a version of Android that's a year old.
You're probably
Pretty big target.
And that
You know, again, I don't mean to pick on Android, but that is just a a reality of how that ecosystem has evolved.
People don't really realize the scale at which this
affects the economy, right? Like
You see these ransomware attacks, which I want to come to next in terms of like
Twenty million dollars paid in Bitcoin, but what you don't see is the trillions of dollars in IP that have been transferred to foreign governments.
Over the last decade. Recently we've seen a lot of
Intellectual property leaks.
Um I I kinda feel that
You know, it's
If you were gonna steal intellectual property and then create a competing product
With traces, which you know, Huawei got busted for that. Yeah, well, I want to come back to Huawei. Yeah, yeah. Internal rage meter just went up. Um
Yeah, it's a much more
you know, deniable scenario where
you know, things hit the internet and people say, Okay, I just it was out there now, so it's public domain knowledge. So the you know, having separation from the attacker and the beneficiary of of you know, the results of the attack, um, you know.
It makes a lot of sense if if
one's goal was to get a hold of somebody's intellectual property. I mean
Once it's out there.
Everybody's going to consume it. You know, you look at the leaks of the the whole eternal blue
leaks. It's a series of tools from uh an a NSA that got leaked.
Um Windows vulnerabilities. Yeah, I want the WikiLeaks.
False Advan? No, that was that was NSA.
Was there C CIA ones or am I making that up? No, there was one that was rooted in uh um Vault Seven was was that group.
Oh, was that leak, I guess. Um the one I'm referring to, um was uh
from NSA and it was a it was a whole treasure trove of of tools. And th this one was particularly interesting because it really there there are events that occur that destabilize, I guess, the defensive posture.
Ransomware in general, I don't get how it even exists. It is the easiest malware to detect and stop. How there's even an industry around that blows my mind.
But the attack vector
Uh that people use to wrap
Ransomware the payload.
Weaponize the that chain that I talked about earlier.
basically allowed a you know a point and exploit capability on patched Windows machines.
To walk me through ransomware. Like what what happens.
Uh depends on the flavor, but the uh the the
the overall goal is to extort money.
uh out of the the victim. So there's different ways to do that.
If you attack uh an individual
you would, you know, potentially encrypt their personal photos.
credit card information, maybe other personal compromising information.
And then um say
Give me X amount of money.
Or I'm going to I'm going to, you know, expose all your photos or I'm going to delete it all. When it comes to businesses, it's more of going after intellectual property where if a particular workstation gets compromised, ransomware runs on that workstation.
encrypts everything, potentially deletes deletes everything at the time.
Uh typically making a copy of it because there's value in that.
And then we'll go through all the network shares and do the same thing.
So uh there's one one particular uh there's different groups, I guess, of of ransomware actors out there. Some that are
uh, you know, won't call the bluff and others where if you say, Ah, I'm not gonna pay you.
They will a hundred percent follow through on what they're going to do.
And this weird
I guess sub industry has emerged from
ransomware actually being a thing and being accepted.
Where companies
will actually act as negotiators. So if you think back to those really cool movies
Where, you know, there's a really cool ransom or sorry, uh hostage negotiator uh trying to talk somebody out of out of the scenario. That exists.
For ransomware. And it it it it drives me
Do the bargaining for me, yeah.
Yeah, yeah. Why is that a problem? Like do do
Like do your customers have ransomware problems? Like Well no, because they they they use covalents. Uh we we protect against that that vector. Um, but the how how do you stop that? Like
If it's that easy to stop, why doesn't everybody stop it? I I wish I had an answer to that. I I don't think you know a network monitoring solution.
Will not stop n uh ransomware. There's nothing you can do about it. You need to be on host. Yeah, you you have to be on host and you have to have a measure of sophistication, uh and uh tradecraft to to identify and block it. We've seen we have some coexistence scenarios where
Uh, I I won't identify the companies, but they are very, very large, successful companies, cybersecurity companies. And
the ransomware gets by them, but we stop it and it blows my mind.
That's
Yeah.
Based on the
Because for you that's easy.
Like that's not a big thing that you're worried about. It is it is a very, very basic
profile to stop, identify. I I might be jaded because I've been doing this for twenty years and in the grand scheme of uh things that I've been a part of.
Uh ransomware's definitely low on the sophistication bar.
Do you think it would exist without cryptocurrency and anonymous
payment forms.'Cause it's always seems to be, at least in the news, it's always like, You need to pay him bitcoin so I can like run away with this money and
Yeah, I would say definitely be harder.
Because that is definitely a very convenient payment structure.
uh to pay to pay with Bitcoin.
The I'm just thinking in the cases where we we've seen financial redirections and those are anonymous accounts that are used and then torn down.
Um so there's there's definitely
How hard is that to track? Like if you're sort of like the FBI or the
Another three letter agency like
To follow that path.
Uh.
I I don't know
I don't know about that.
Uh that's not my not my background. But I would say the
The challenge would not necessarily be the difficulty. It would be the average
Person or business.
getting any agency
To care.
To track it down.
because that intel agencies, law enforcement agencies aren't sitting around waiting for things to do. They you know they're there's really big problems they're going after and trying to fix and solve and
Um, you know, a small company, uh you know, a law firm getting
ransomware uh is is just low on their
Well it's not even a matter of payment for them. In some cases it's life or death for the business because you can effectively turn the business off overnight and
Just eliminate it, especially if you're small and you you don't have these sort of like big bank accounts to pa
Yeah, yeah, I I'm aware of um, you know, businesses that have been shut down because of ransomware.
The the the payment.
It's just too high and uh the it's much easier just to say
Okay.
Fold thrown in the towel. Uh we're gonna fold out shop and maybe start again and
Th this is ultimately why I don't
like I I get very frustrated that companies will pay ransom or
not take the time to um hire a company ahead of time. Like it's much much easier and cheaper to be preventative.
And uh to
to harden your your system and and be ready for attacks. I mean that that is the reality of today. And anybody who thinks otherwise is, you know, they've got their head in their sand, um, you're going to get ransomware and bad things will happen and hopefully
It doesn't kill your company or compromise customer data. That's that's a whole other
aspect of this equation that I don't think
people take into consideration if there are legal obligations to report
compromises in customer data now.
There are fines. I I I remember um
before Covid nineteen dropped, there was discussions about, you know, six figure fines going to Canadian companies.
uh if they are uh ransomware, customer data gets compromised, and it is shown that they weren't taking the problem seriously ahead of time. So they didn't have
the adequate security protections in place.
What's adequate? Like that sounds so subjective.
Yeah, yeah, I mean
Is that back to that Garner, I check the box, you can't sort of like fire me.
So so if I was a uh you know, virtual CISO, I would I would probably, you know, reference the Gardner Quadrant to make sure that
you know, the executive board is covered in regards to liability. Um
There's almost like two layers to this, right? There's the apparent layer.
Which is like I wanna solve cybersecurity. Um, but the real layer is like I wanna keep my job and
Yeah. Easiest way to do that is not take any risks and go with the industry standard and
Ultimately that when it comes down to accountability
That is a safe way to go. It is unfortunately uh
Yeah.
Yeah, it it's it's
It's the safe way to go. But it is not the best thing for the company. It is not
Uh it is not forward facing.
Uh I just I think it's being naive in regards to the the type of attacks that are coming. So if you're a customer and you don't know a lot about this, what are the
questions you should ask to sort of reveal the type of
solution you're getting for real instead of sort of like checking the box.
You know, right off the bat I would say, How are you protecting my company?
To tell me how you're protecting my company.
Like
Full stop.
What happens when something goes wrong?
And and you'll probably get a whole bunch of, you know, sales jargon.
What's the difference between a good answer and a bad answer to that question?
Oh God, if s if somebody uses the word next generation
Seamless.
Um
We'll we'll stop everything. Yeah. AI, we've got machine learning.
Any of that if any of that comes up.
Big red flags.
So if if somebody can give you a good answer to
What happens when your system fails?
That
Gives you comfort.
Then I think that is a that is a good
position to move beyond. When I said earlier that
you know, the cybersecurity industry is like a
A bunch of unethical
Uh, use car salesman.
Uh it's it's because
There's so much jargon and salesmanship that goes into this.
For example, the
The process of buying a car, um, what do you expect when you go to a dealership?
To buy a car.
What what what do you want to walk away, assuming you really like a car or a brand, what do you expect to walk away after a transaction occurs? The car. Yeah.
Unfortunately.
with uh the the current cybersecurity industry.
There are sales.
uh persons all over the place that will will say, you know what you need is you need some wheels.
And then another salesperson will say, I can sell you the engine.
And another salesperson will say, I'll sell you the steering wheel. You probably only need the steering wheel.
Uh, but I can sell that it's gonna it's gonna be great. And it is up to you as a as a as a company to put those things together and make use of that. So you're cobbling together the solution yourself and each vendor like no vendor is responsible then because it's like oh this person, there's a lot of finger pointing.
Yeah. And ultimately the the only
working cyber solution. And I don't care what the the the sales point is, the only true working cybersecurity solution is one that
Looks at it from where's your data? How are you going to be attacked?
Across the board.
So it needs to include an endpoint component, a network monitoring component, a clo component, potentially an IoT component, uh, an XYZ for things that we don't even need to know it exists yet. This is where this whole concept of next generation drives me nuts because people say we have this next generation.
thing and what I'm seeing right now is the exact same thing I've been seeing twenty years ago.
Regardless of whether it has a machine learning component or not.
Like what does that mean, next generation? Like if you knew the next generation of exploits, you'd be
Well well, ultimately it doesn't mean anything. A g a good solution should be iterative. A good solution should be engineered to handle the future without needing to put a sales tag around
A uh you know
This is what we have now. We call it the next generation thing that the world's never seen. PS it's got machine learning, AI.
Blah blah blah blah blah, which ultimately
doesn't mean anything if you are a buyer. All it does is confuse you.
Drives me so much jargon in this industry in particular, right? And a lot of it is salesy. Like it's created by the
Yeah. Sales teams, the sales force, the
Yeah. The the number of times
I have had to worry about
This uh you know, these features that are sold.
uh to businesses around the world, uh being on the other side of the coin just years ago.
Uh never.
I I've never had to worry about machine learning.
And by the way.
existing machine learning implementations and a lot of solutions out there.
is the exact same thing that, you know, I've seen in antiviruses back in two thousand five. They just didn't call it machine learning. It was just
training analytics to to look for anomalies and
So when you were an attacker, what did you worry about?
Oh, that's an intimate question.

Getting caught. I mean, ultimately. Uh yeah. I mean so as an attacker, it is a continuous
balance between risk
Uh and losing a capability.
And this is what does that mean? And I'm speaking from um, you know, back when I uh, you know, was at CSE. Uh
It means that
You know, when I said earlier that
On the you know, that first
Pillar of cybersecurity.
Call it a pillar.
There's an economy behind it. So there's a cost to building
Uh
capabilities to to go after
A particular target.
If you lose that capability, that immediately is uh an expectation of okay.
Find a new one.
Uh it's difficult.
There's cost to that. There's labor.
And in that
That is a very big component that goes into the
The I guess the risk.
equation as to
how you're going to approach an operation.
How aggressive you're going to be.
And different different you know agencies around the world will do different things.
I mean you look at China and Russia i they're remarkably aggressive.
Uh with a lot of
I don't say disregard to their own intellectual property and what they're using, but they're they're certainly not quiet about what they're doing. It's like spray and pray, right? Yeah, I I find I find it really intriguing. Um it makes uh makes me wonder a little bit like do they have a
An army of thousands of people in warehouses cranking the stuff out.
Which they probably do.
Which is really scary.
Yeah, one of the things that I always found really fascinating about
intelligence problems was there's always a country with more people
uh who are just as smart, if not smarter than you, and just as good, if not better, technology than you.
And yet you're
tasks with sort of defending or
in some cases acquiring information against these people.
And the hubris that sort of like goes into oh we know best and
Yeah, i that that was always an intriguing calculation, um back uh
back at C S E um
It's a good debate to have, I guess, if if you've got um you know something that
Took a lot of time to build.
Do you throw it down a hill and hope for the best? Or do you protect it? Do you put
shoulder pads and and knee pads on it and uh you know try to make it last as long as possible and so talk me through that though like how do you see that because
Allied governments, friendly governments, whatever you want to call them have
Exploits that are zero days.
that they don't release that have huge national security implications. Like we've we've seen some of those become public.
And have massive implications. Wasn't the NHS hack in Great Britain the result of a stolen zero day from
An allied government?
That one's tough.
Um
Like should they disclose them? What's your like how do you think about that?
So so from what I so full disclosure, I don't have as much much exposure to what
the internal debate is on that. I'm aware that it happens. I I think a lot of it comes down to what the perceived value is gained versus lost if you dis if you if you don't disclose something and you use it operationally.
Uh is there more good
For the the the mission, the country, its people.
by not disclosing it versus disclosing it and losing a capability.
Yeah, it's a tough one because you know, the the the the adversaries of uh Allied governments aren't going to disclose. They're they're not going to care. If they have something they can weaponize, they will use it and
I I think
Unfortunately, that is probably the the tone that is set globally that
underpins a lot of these the the decision making. Like if if you're being attacked constantly and having your intellectual your nation's intellectual property stolen, I mean
You could disclose all the vulnerabilities you have and you know about as a nation, it's not gonna stop them. Uh it's just not going to there. There are, you know, going back to the the Vupen example.
of um
There are more out there.
It was a backlog, apparently. Yeah.
Yeah.

Probably.
Push some of your buttons here, so you might want to
Take a drink.
Yeah.
Talk to me a little bit about
Wow.
I'm just gonna leave it there. Expand on why. Uh so
We've had many conversations. What a chestnut.
That situation is.
So Huawei's had a bit of a an interesting
Less than smooth ride, uh I I would say. They came out of nowhere with all this tech. Yeah, which which
Miraculously happened right after a Cisco leak. A giant Cisco source code leak. It's a coincidence.
Yeah, so I
You know, there there's there's document ties to uh the Chinese federal government.
With that company existing.
There is
I don't know if they were ever convicted. It was back in two thousand three, two thousand four, but there was a there was a very clear cut case that Huawei was using
Conveniently leaked intellectual property. This is back to
You know, if I was
going to steal your intellectual property. It is much more deniable.
Yeah.
I leak it out to the internet.
and then use it and come out six months later and say, Oh, look, I just found this out there and I used it.
Really convenient.
Um
Que incidence. Yeah.
And and
you know, where we are today, Huawei basically, you know, price undercuts.
Other
Vendors.
And it you know, I ask how do they get to that point? That that sounds like they have a lower R and D budget. And how do you have a lower R and D budget?
You you get intellectual property via
creative means.
You know, today with
uh them being banned from the US
Uh I don't disagree with that.
Uh I I have different thoughts about the whole TikTok situation. Um, why don't you disagree with that? Uh Why don't I disagree with them being banned? Yeah, I I mean I agree with them being banned too. Yeah, so I don't think there is
A framework to build trust. I don't think they have
earned that trust and giving you know
If a if a nation is going to re kit their entire country with a new type of wireless gear
Especially with
the complexities of five G you need to trust that vendor.
You need to be sure that the interests of that vendor
Uh our uh
the very least not opposed to the interests.
of the country.
that you're in. And
I I don't know how anybody could possibly say that about Wa.
I remember when the Brett did this whole thing, like we're gonna set up this accredited lab, we're gonna test it, so we're we're gonna allow British Telecom to use it.
Uh but we'll test everything that's deployed.
I remember just like that would fall apart in a second because the minute there's a zero day
You're gonna deploy it right away, especially if it's leaked on the internet.
And then you've deployed code that you haven't code reviewed and then the whole thing just falls apart and I'm like
Okay, well it doesn't scale to the realistic pace of software development. Right. So let's let's imagine that a government does have a program in place where every iteration of source code and these aren't small systems, we're we're talking millions of lines of source code. Let's assume
You have a crack team of amazing source reviewers that can say with confidence
Yep, this looks great.
Uh or better yet, they have a set of automated tools to be able to derive that answer, which
Is challenging, probably possible.
Extremely challenging. The realistic outcome is the time for
Uh say Huawei releases a new iteration.
The time from that release because
If they are a vendor that actually believes in securing their product and that
new release of the firmware has uh you know fixes.
Time matters. You're you're against the clock before um, you know, vulnerabilities could be discovered and and put out. Cause all it takes is for them to release that firmware once, have somebody rip that firmware apart and identify differences between the old and new.
So you're immediately up against the clock. And if this ideal analysis process is being slowed down in any way, you're immediately compromising the vendor.
in giving them the the argument that this system doesn't work because what they and
I don't necessarily disagree with that if I was the vendor and my releases were being slowed down by a month.
I would get pretty cheesed because it's not my fault. Yeah.
Yeah, you're slowing down fixes.
And and oh I'm sorry, your your routers just got hacked.
That's on you. That's that's not on the vendor at that point.
So I don't think that concept is one that actually works.
And the way to avoid that is sort of like just not allow that in your critical infrastructure, or do you think it should be not allowed in any infrastructure?
Your personal take.
Oh my personal take. I I I I'm again I'm I'm completely fine with the band.
I mean there's they're still allowed to uh
sell into Canada.
Uh I I'm not aware of what the uh I think it's not allowed in the the I mean, my knowledge is that it did, so we'll have to like fact check this, but I think it's not allowed in the critical components of Canadian telcos, but it's allowed on the periphery.
But I mean but that's like silly when you think about it, right? Because you don't want to ever be held hostage to somebody who can
You can turn that off.
And somebody who's more patient than you, right? Because you could just go twenty five years with no
incident and then all of a sudden there's an incident. But you've built up twenty five years of trust and credibility. So the story you tell yourself is we haven't had an incident, it's cheaper.
because it's likely subsidized and not only R and D, but subsidized by the government.
Yeah, so I mean I'll ultimately this is I I don't have any problem with the
Huawei being banned in the US. I I would not I would not argue about that.
By the way, the the name of the vendor is Erodium.
Boopin started sorry, Boopin started Zer Zerodum.
Oh okay. Yeah I always lump them together just you know. Well same parent company, I would imagine. Yeah.
Yeah.
Wh w what do you think of Snowden?
Yeah.
I feel like you're asking questions that have slowly taken years off my life. Uh
So I've been doing that since I met you. Uh no, you're great, but
I do not agree with what Snow did in any way.
And that is that is putting it very, very kindly. Regardless of
You know, at this point there's been things that he brought to light that has been declared illegal.
The
The unfortunate
Assumption is that
Agencies, security agencies, and tele agencies are, you know, these devious groups that are like, Let's do whatever we can. And I don't think
the average person actually realizes
how difficult that job is.
how normal the people are who do that job. They have families, they come in, they want to, you know, solve a mission or solve a problem.
Make
Things better.
And
The way he went out.
uh with this giant trove of information which I'm gonna come back to
completely ignores the
the the way that technical implementations get approved. It's not like developers are sitting at their desk and say, I have this great idea. Let's go do it, and all of a sudden it's running in operations without any
you know, accountability or review.
There is a team of lawyers, depending on the size of the country, that will look at that and say, this is okay, this is bad.
Uh, I remember being at CSC and arguing for something for I d don't know how many years
But there was there was a problem legally and it didn't get through. And and that
that vetting process people take extremely serious and
If something goes through that process, there is a measure of legality to it. There are a group of lawyers
Who
Honestly.
Like to say no.
to ideas uh that have said, yep, this is okay.
So the idea that
Anything that has been deemed illegal.
You know, I I'm not in a position to say that's right or wrong, but what I can say is the process that those things would have gone through.
So so that whole side of things, um, uh I I find unfortunate.
um because the the byproduct of that is distrust for agencies that are working extremely hard.
To keep
Country safe.
extremely disheartening for those people to, you know, get dragged through the mud publicly.
when the public doesn't actually have an awareness as to how much they sacrifice on a day to day basis. Like I couldn't count the number of
long nights that I've seen people work. Um you know to it it
Can you
Break families, it can break relationships and um It has, yeah, definitely.
So
The other side of it is
Yeah, trusting
his intentions. So he he had gripes about
You know.
those types of illegal, you know, uh mass monitoring or mass surveillance programs in the US.
Why did he go public?
With such a large
archive that had nothing to do with that. Why did he, you know, expose completely legitimate legal intelligence gathering programs
That have
A ton of people's names associated with that. Why did he go out the door with that? And that I think is what I have a much larger
problem with in that
you know, there was no thought process. I y you know, it sounded it to me it seemed like more
He was just giving the intelligence community the middle finger.
Yeah, I mean I I sort of took away the same thing from that whole thing, which was
even if he felt just in what he was doing, it would have had a a different sort of feel to it when it came out.
And in you don't need to reveal the techniques, you can just reveal the details of the programs. But the actual techniques that he revealed, the software techniques, the exploitation techniques, the
I mean that
Okay.
definitely cost people lives that
had a huge impact on people working there.
Yeah. And and how how far back did he set programs?
How much did
you know, entire agencies need to go into damage control because some Yahoo decided that this thing over here was illegal.
And then oh
PS here's a whole bunch of other interesting stuff unredacted.
being released. Yeah, I I think people think, oh, there's no names associated with it, but like on the original documents, there's definitely names and I think we both assume that every intelligence agency worth their salt in the world has unredacted copies of all of those documents. Yeah, yeah, to the best of my knowledge, WikiLeaks doesn't receive redacted versions of things. I mean
That's that's largely on him if he's pardoned.
A little part of me will die if he is pardoned. Why do you think he's in Russia?
Is there is there something to that story?
I mean
The where where's the safe place to go when you've uh burned, you know, a particular group, like right into the enemy.
Yeah, I mean.
Yeah, I'd be really curious to actually know what his living conditions are like right now. And uh
Uh you know, hopefully they're not comfortable.
But I mean he brought it upon himself. There there's other ways he could have done that.
Uh and and come forward with uh how could you have done that differently?
What do you think?
Well, like internally, there's lots of outlets for that stuff. He said he followed that.
There was no documentation released that I I can remember that he did follow those. Yeah. I mean you you look at the the whistleblower protection and that's in place now. Was that post Snowden there or previously that I d I don't know whether it was post Snowden. I mean maybe his decision to do that
would have actually improved the protections for whistleblowers. And uh you know, that's probably important to acknowledge, but it's um I thought he was the best thing to happen to Lynchman, though.
I remember like and I I don't mean that in a negative way. I just remember like what happened in the immediate aftermath of that was
They lock down
the process by which people get hired. So like
I don't think you or I would make it through today.
From start to finish.
Um because of our backgrounds and sort of
different quirks of our personality. And and so what happens is like post Snowden, you end up hiring I call it the stormtrooper problem.
Which is like you end up basically hiring the same type of person, right? There
They're sort of like never had a problem in their life. They uh get straight A's, they do all the right things, they tie their shoelaces the right way.
And they come into the organization and they get promoted.
And
The process for promotion now is sort of like here are the ten things you need to do to get promoted.
Because it's so sort of like laid out and so bureaucratic.
That you end up you're thirty and all of a sudden you're you're
in charge of solving a problem that nobody's ever solved before.
But you're in a group of people who all see the problem the exact same way. So you all share the same blind spot. So I remember when that started happening, I was like, Oh man, this is like great news for Matt, because
You're hiring in a way the misfits of the
The industry, right? The people who don't want to go to meetings, the people who
don't want to fill out the forms to go travel, the people who just want to be able to do their job.
Yeah, I I'm trying to think back of uh, you know, what was there was there an effect. I I I don't actually know if I could speak to that without
violating an NDA, honestly. But um
Yeah, we don't want to get you in trouble. Yeah. This year.
Yeah, I think how you characterize the the the mindset of these organizations are um
It's pretty accurate. I I mean the
Well we both sat in meetings where they're like, Oh, we can't hire this person'cause there's like a flaw in their background and
And there's some legitimacy to that too, right? Like you you're trying to manage
Top secret information you're trying to manage risk and manage an organization, but the flip side of that is like you're hiring effectively the same person.
Yeah, y y you' you you're not wrong.
I I definitely don't uh don't disagree. I think from one one benefit to Lynchpin from that was definitely it pushed people out the door.
Uh absolutely. Uh I and I think that's a trend that uh that continues. Um
uh to this day. I mean I'm I'm still
you know, full disclosure, actively recruiting from a intelligence agencies.
the people that are excited to leave and do something more and uh
you know, for the lack of better better terms, be unleashed to solve technical problems. Like there's that there's that hunger there.
Uh and it's uh
I love that perspective of unleashing
people that have sort of like had handcuffs before and it's like now your ceiling is not
Bureaucracy.
Your ceiling is your own ability.
Yeah.
Uh I've been I've been doing this for fifteen years almost as an entrepreneur in, you know, two companies and I've gotten to
witness
People
Going.
go through that unleashing process and it is really cool to see
Um how you know one month after
They're they're just blown away with what they are now
afforded.
And what what
What
You know, I'm not saying don't do this. It is just here's the goal, here's the problem.
Solve it.
Let me know what you need.
We'll catch up every once in a while. In Canada, people typically join join the company with, you know, one year leave of absence or a five year sabbatical component. And I always I always laugh about that because yeah, I mean
Nobody's ever gone back. Well, yeah, so yeah, so from a risk standpoint
Uh that makes sense.
So I I never I never argue with that.
uh but from a practical standpoint, nobody's ever gone back and it's become something that I've seen weaponized against the employee, you know, oh you're you're going to this company.
We're not gonna give you your one year leave of absence and it's like
Okay. That is extremely bad decision and you're showing some really unfortunate true colors. Um
You know, in that in that. Does that ever make somebody stay? Or does it like push them out the door faster? Pushes them out the door faster. And motivates them. Yeah.
Chi on shoulders, man. There's something to the motivation that comes from that that
Just drives people.
I mean
Google's Project Zero is largely built from people who have exited the
Um
intelligence in industry with a chip on their shoulder.
I don't know if that's worked s worked out so well.
But
I w I wanna just sort of like end on some of the lessons that you've learned growing
Field effect now to
Hundred people.
That's the critical phase for a lot of companies. Like a lot of companies break in this sort of like
Forty to a hundred people range'cause you start reaching
The ceiling of
the processes that you put in place
But also the ceiling of the people who've got you here. How do you think about that? How do you scale and how do you go beyond that and
crack through that sort of ceiling? Uh I I think the the the first component is is making sure that everybody is going in in the same direction.
You you have to be very straightforward.
Frank, honest.
when you know, looking internally, but also what the company goals are and
Everybody needs to know what the company goals are.
I I don't think that
you know, execution is not necessarily something that comes naturally.
uh to a lot of people. And and and for me right now, like one of my one of my biggest concerns as we approach one hundred
uh as we go through Covid nineteen. I mean when this Covid nineteen started there was, you know, a decision to be made to go aggressive or or or
cower, I guess, from the scenario and you know
In my opinion, it was just very clear we go aggressive because
you know, our competitors are probably going to be
Category B and
Damage control. So um so you can get ahead. Yeah. So so execution is a is a big part of that. And it takes a bit of time to to understand what execution looks like.
in each particular problem or a given company. So that discovery of, you know, how do we execute as a group has been something that
I I think is is extremely important and and largely the the company is absolutely
Doing amazing at it.
Uh and and that
that I think is is one thing that um you know always resonates in my head that
Yeah, everybody has great ideas.
But how you push through is execution. You need to you need to material materialize those great ideas into things that are reality.
Is there anything else you want to say about the state of cyber before we wrap this up?
Have I have am I out of swear jar? No
Say whatever you want. I think we're already explicit at this point.
So so so I would say um
You know, if if you are a company.
uh looking for help. It it is it can be a challenging thing. I I think it's uh it's that going to the doctor scenario when you have a pain.
You don't wanna necessarily find out what it is because, you know, people are
Naturally averse to bad news.
You can't
be like that with cybersecurity. If you don't have
a cybersecurity vendor if you don't have a company helping you out with that problem.
Get on it.
Everybody is a target at this point. Th your company is not small enough to to be off
An attacker's radar. I have seen five person companies actually I've seen two

uh attacked and hit. So my advice is don't be afraid to to ask for help. Um hello at field effect.com
Yeah, the second thing I would say is uh anybody out there looking for uh, you know, a really cool opportunity for a really cool company, you know, the experts of the world, regardless of what company you're working for right now, we're always looking for more people.
That's amazing. My my kids call you Uncle Matt, but they also uh whenever Elon Musk comes out, they say
We we know somebody's gonna do more than Elon and we're sort of like and they're they're pointing to you, so we're we're looking forward to seeing how this progresses over the next couple of years. I d I don't know how to respond to that, but that's very uh that's very kind to them.
Thanks for chatting, man. Yeah, thanks for having me. It was a good time.
Uh
Yeah.
Hey, one more thing before we say goodbye.
The Knowledge Project is produced by the team at Furnham Street.
I wanna make this the best podcast you listen to, and I'd love to get your feedback.
If you have comments, ideas for future shows or topics.
Or just feedback in general, you can email me at shane at fs.blog or follow me on Twitter at ShaneA Parish.
You can learn more about the show and find past episodes at fs.blog slash podcast.
If you want a transcript of this episode, go to fs.blog slash tribe and join our learning community.
If you found this episode valuable, share it online with the hashtag The KnowledgeProject or leave a review.
Until the next episode.