YouSaid · the spoken record

Dan Guido

lines on the record: 47
first: 2024-06-26
most recent: 2024-06-26
sittings or episodes: 1
sources: podcast

Every line below is reproduced as it was said and linked to the record it came from. Nothing here is summarised or generated. Directory · Search · Corrections

“We're already doing. If you create a ticket in Jira, or if you create a Slack message and say, like, hey, can I get this access, please, in a public channel, our AI can detect, did you ask for access? And usually the worst thing that can happen is like back channel access. What that means is someone gives you access without following processes. Now, you can alert yourself that this happened. Oh, this person got access without approval, but the better way is to prevent that from happening in the first place. I think the main takeaway is there will be less and less analysts because agents will take over and you need to upskill them to become more engineers or even prompt engineers. That's kind of one big thing. The second big thing is think about now like the world is changing so quickly what you can do and what you can demand from vendors or what you as an entrepreneur can implement when a system can reason by itself. That's the second thing. And the third thing is I believe because”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Read only. It doesn't always say admin access. So the AI will be able to understand or can understand if that permission is sensitive or not. So they can reason, okay, this person has privileged access or not. And then this person can also reason on role anomalies. Oh man, you know, you were in sales and you have access to this right access in AWS and no one else on your team has that access. So basically, you know, a rag will ask themselves how privileged is this permission, right? What is your usage in that permission? And is anyone else that has similar HRAS characteristics, do they have that access? And you can already do this now pretty easily, right? This is like kind of more, it's not reasoning themselves, but you kind of guide them to go through those steps. That's what chain of thought means. And the last thing I want to say is like the cool thing about access is it can be preventative. So here's one thing that”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“In North America, they will automatically update your roles and downgrade your roles, or at least at the beginning be a co-pilot for you and suggest, hey, this role should be updated in this way, or those two roles should be merged in that way. So this is just like a case study where agents will have a huge impact. The biggest story, I think, about security is that there's enormous complexity and risk, you can never reduce risks to zero. The cool thing is if you move more to an engineering mindset, where you actually fine-tune your agents and models on top of your infrastructure, you will be able to solve certain problems that you were never able to solve before. The rag will look into, okay, is this privileged access? So basically the AI will be able, think about you have a million permissions. How are you going to tag where this permission is actually sensitive or not? It doesn't always say.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“And then the question is like how much did I protect my inside a threat in some way? Why? Because go back to the metro station if the developer has access to everything, suddenly this intruder can just like hop from one station to another and do harm. So how can we make sure that it's kind of just in time only when you are at the station you actually can have access to it? Now that gets kind of hard with like millions of permissions. So what I believe is going to happen, and this is something that we are really working on right now with models that come out that reason. Basically, I think models will be able to reason better than our security analysts in terms of what a certain role should have access to. So basically an agent on your identity and access management system will look into, okay, we had 20 new tickets where these engineers needed access to this type of database that lived”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“I do think we're changing back to an industry of rebundling, especially as we have this autonomous wave coming up. I do believe, I mean, like Wiz is actually a great example of that, is they started with kind of a point solution, but spread out very aggressively and build a compound product very quickly. So how are you going to manage that complexity?”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“And Figma rethought this whole kind of process before there was sketch, there was zeppelin. And what basically Figma said is like, what is the underlying concept that's the same across all of those? And how can I build a solution that covers that all? And I think, by the way, the whole kind of thing that we've seen in here is like we had first a bundling era. By the way, with Microsoft Oracle and SAP, people didn't have a lot of applications. They said like Oracle is doing it all. That was that at the beginning. And then slowly with cloud, especially AWS and Azure made that happen, cloud became so approachable by everyone that suddenly had all those collaboration tools come up.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“So it was 2023. The top three priorities for CXOs was vendor consolidation, optimizing SaaS licensing, because, of course, you don't want to let people go. You rather want to kind of first increase your software spend. So, what does it mean for entrepreneurs? The question for entrepreneurs is like how can I build a compound business from day one? We've seen this actually done well across many companies. I think Data Dog is an awesome company that this is super well more on the DevOps side.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“50 different tools. And actually, in the last two years, especially as the economy has gone a little bit down, CISOs ask themselves a lot of in terms of how can I consolidate. And that kind of sucks for startups at the beginning, I would say, because they're like, okay, we're starting solving this unique pain point. But then CISOs are like, yeah, but I have 80 vendors to manage. And so the question is that I ask myself a ton is how can we build compound businesses from day one? So how can you actually build a platform from day one even though you're a startup? And actually counter if people say, I need to consolidate that your startup actually can consolidate.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Now, here's the second thing it's about startups, by the way. This is like kind of an appell to all my entrepreneurs. I believe that we need to build compound businesses from day one. So what does that mean? So security CISOs probably have this problem that they need to use.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Actually, hiring for engineering rather than analysts, especially also, you know, as AI will probably automate most of the analyst work. That's, I think, a very important insight is when it comes to career development, as it comes to what type of profile you need to hire, especially engineers and analysts, and building on top of solutions that you're buying is very important. Basically, the premise in this first act is software is becoming an autonomous. It enables us to create more and more. Because of that, entropy is increasing. There are more apps, more entitlements, and more actors. And so what needs to change is security needs to handle this infrastructure with some type of technology operations or without some kind of technology infrastructure. So I think that is kind of one important change that we need to see as this whole market is changing.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Came about, and they said, here's an alert, there's an alert, here's an alert, and we're going to alert you about all those things, and you can remediate it very easily. And so I feel like more and more security became an operating department. Similar thing happened to IT. IT used to be the hackers and slowly but suddenly they became ticket resolvers. Security became a little bit of alert resolvers. IT became ticket resolvers. And I think the new paradigm that we need to think about as we're thinking about entitlements and access as a metro station, security and IT needs to see themselves as the architects of that metro station, more or less. And what DevOps and infrastructures to full stack teams, so I think the same thing we need to think about, IT and security. IT and security need to become, so to say, infrastructure teams to each department, right? And this kind of moves us back to security.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“And I think especially as complexity rises, so we are going from 100 actors to a thousand to 10,000, and also the apps become more complicated. So instead of having just one or two or three metro stations, I will have thousands of metro stations because I can have access to 10 EC2 instances and just like the granularity in the cloud and with Snowflake is going to become more and more and more granular. So the question is like, how are you going to manage that? What's the new paradigm to manage that? So what I believe how we need to rethink things is security was often seen as analysts, right? Actually, security started as hackers. Security people were those people that hacked the networks and there were people that were deep in Linux with the sysadmins and actually most security people were sysadmins before because there was no security 30 years ago and there were true hackers. And then suddenly all those kind of great solutions”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Our bag is not moving stations. RBEC basically means you are marketing person and you have access to everything on this marketing tier, even though probably a lot of that stuff you never use. And sales or engineering is especially spooky. Engineering, UN DevOps, you have access to all customer data because an incident might happen and you need access to it. Now, on top of that, we have all those service accounts coming up, and soon autonomous actors, agents coming up that will also, if we still use RBAG, get access to all of those things. Even though they don't need it. So the concept is I'm a metro station and I need each permission entitlement just for a short amount of time.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Which more of those wagons jump from one station to another, and each station again is an app on entitlement. And why I think that this is interesting is right now how we think about the world is a world of RBAC.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“So, how do we deal with that? So, I love the metro framework. I really love it. If you think about identities, there are certain identities on different tracks. So marketing has their identities, right? Marketing ops, demand gen, content, customer success has their attracts. And each station is more or less an application or like an entitlement. And some of those overlap, right? So for example, customer success and sales overlap maybe in Salesforce. Then design and marketing overlap in Figma. And then especially engineering, there are probably like multiple engineering departments if we zoom in and they overlap when it comes to especially an entitlement level, different permissions that they have access to. So now the interesting thing is people”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Bringing out at the end of the year. So that is actually a whole new paradigm that's changing. And we're like, okay, shoot, how do we equip ourselves for that? So to summarize, actually there are kind of three waves. I just call them two. The first wave is the digitization. The second one is a collaboration. The third one is the autonomy. And now we're at the third one. The interesting thing is that I'm thinking about on a daily basis is apps and access. If you think about everything that you're using, those are apps. We on Zoom, then on Slack, then we go and SSH into a server, which is also an app more or less. Then we use GitHub. So everything is apps. Apps are literally our live blood without apps. We can't do things. The question is, you know, I think that we as security professionals need to ask ourselves more and more is how are we going to manage all those apps with more and more service accounts coming up, right? And with software doing the job themselves.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Then something interesting happened as we made it collaborative, right? Workday is not really collaborative, neither is Salesforce. But then suddenly Zoom, Slag, Figma, Airtable, all those kind of great companies came about in the 2010s, and suddenly it became very collaborative. So that was kind of, I would say, the third change that happened in software, which is pretty cool. Now, what changed in the last two years is we moved from just like digitizing in it to cloud, to collaboration to autonomy, right? So we're creating more and more autonomous software. And it started honestly for the first time with something like a Grammarly, where they are more like kind of co-pilots that help you kind of do a job better. Even like GitHub, this is GitHub co-pilot there in the middle. They're not fully autonomous, but they help you do your job better. The big trend that we're seeing right now is especially OpenAI.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Is we cloudified, I guess, the office. I was like with Salesforce, they kicked it off and work day and Atlassian, those were the first cloud companies, so suddenly we're in the cloud. So those are where AWS was born, I think 2004, 2005. That's when we cloudified it.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“I just want to take you a little bit on a historical journey. All right. So the funny thing is if you look 60 years back, We are all ideas. So there's two types of factories there's a product factory and there's an idea factory. So what the product factory is, is usually where the cars are born, right? Or where windows are made. And where the idea factory is, is where we create and design those cars, right? And especially the idea factory changed in the recent years and changed like two years ago again. So the idea factory looks something like the office or more like in the 60s. In the 60s, 50s, there were no computers. It was really interesting. And we mostly used typewriters and pen and paper. So then the computers came about and we digitized the office. That was kind of the first step. IBM, SAP, Oracle, Microsoft, all those big companies came about and digitized it. So that was step one. Step two.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Example, how do I speak to a live agent at United? How do I speak to a live agent at Uber, right? And what we see happen here is they're able to generate a bunch of the spam content across these different third-party forums, get them all upranked, get them all to dominate that first page of search results. And again, it's just a classic case of, well, they would have to script this and generate the content now. They can make it more dynamic with AI and generative AI specifically.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“One is SEO poisoning case, so specifically something that we've seen out there a lot for airline industry, finance industry, any industry that has customer support, phone numbers, things like that, right? We've got the traditional SEO poisoning attack where people find a way to get content upranked for any given company. And what's interesting is basically how well can people do this in 2024. What we're seeing a lot of things happening today is that they're putting it on these third party sites that do have great domain ranks, things like Microsoft. It could be LinkedIn. We've seen a lot with Hub as well, of course, and Webflow, other platforms like that. And so they're taking advantage of the fact that these are legitimate third party sites with great domain health, stuff that Google will quickly uprank or any other search engine will quickly uprank. And they're generating content and conversations on forms.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Companies outside the financial sector where a pharmaceutical company had an impersonator talk about how Viagra is going to be free now and saw that impact the stock price very, very quickly. Again, stuff that has happened before, but what we're seeing in 2024 and what we're expecting in 2025 and beyond is that this just gets easier and easier to do and it gets to the point where it makes it really hard to tell what's real or not online.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Or entirely new threat, right? Like, we've always had social media, we've always had video platforms, and we've had bad guys try to create fake content to achieve certain means. I think the main lesson here in terms of what we're seeing is that it's just become a lot easier to do. And so just there's entire markets around fishing kits and there's entire markets around cybercrime in general. We're going to start seeing and we're already seeing that same sort of stuff come around with deep fake technology, impersonation technology, and just how do you personalize attacks more and more for your target victim? I think the biggest thing too is that we're seeing this not only to run scams, but ultimately this stuff is impacting businesses at large, actually just on the talk this morning, chatting with some big banks out there. And one of the biggest concerns for them is how can they watch out for a bank run that's orchestrated by a deep fake campaign, right? Or we've even seen this effect.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Financial institutions, chief technology officer. And so what we've quickly been seeing here, right, in terms of the landscape is more and more deep fake videos being produced in the exact same way models being trained in a very similar way, the voice being generated in a very similar way, and the intention of attack being operated in a very similar way all across different platforms, whether it's YouTube, TikTok, any sort of video platform out there, we're already seeing deep fakes emerge, and this impacts a whole bunch of different sort of individuals, whether it's business, whether it's celebrities, or even political campaigns. Of course, big federal election this year, it's top of mind for everyone. The good news bad news is that it's already happening and we're seeing it happen across a lot of different platforms. So I think the biggest thing here, though, is like, this is not necessarily entirely novel attack surface writer.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“In 2022, $8.8 billion was lost by consumers alone in the US. We've had 39 billion credentials stolen by bad actors that same year. And the cost to launch a disinformation campaign that's AI generated is quickly approaching zero. So if you've seen a lot of the startups that are currently pitching about how we can make it easy to generate AI videos or how we can make it easy to generate AI voices, right? That same sort of stuff is going to the bad guys as well. And so how are we seeing this manifest today with real world people and real world businesses? So one common scheme that has grown super quickly just in these past couple months has been the merge of a lot of deep fake videos, specifically deep fake videos of individual personas. It could be Taylor Swift, could be Travis Kelsey, could also be your CEO and could be your”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Already, and then finally, this is the first email about two years after the very first interaction with the mailing list where Gia Tan is actually now doing the release notes for the project. He's been made a maintainer, and this is the first release going out. So two-year kind of effort here. If this is indeed stateback, this is probably not the only thing they did in that two-year period, right? They probably have other things going at the same time, right? So we shouldn't overreact and assume that Linux is like totally backed order or anything like that, but also probably this isn't the only thing that these folks were working on, right? So the truth is like somewhere in the middle here.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Until there is a new maintainer, and then the maintainer finally replies and pushes back and says, Hey, I haven't completely lost my interest here, but I've been having some mental health issues, and I have a lot of things going on in my life. But again, maybe Giatan will have a bigger role in the project. And so a few months after that, Lassie, Colin merges the first commit with Giatan as the author, you can see here, and they actually are listed as an author. This is a pretty innocuous change. And then again, the pressure continues from DGAR and Dennis, who's this other persona that are both there to really just support the idea that GIA should be made a maintainer. And you can see here, you ignore the patches that are rotting away on this mailing list. Right now, you choke your repo. Why wait until 5.4.0 to change maintainer? Why delay what your repo needs, right? So applying the pressure. And then again, the last one here is great. Like, why can't you commit this yourself, Gia? I see you have recent commits, so just kind of pushing more and more. And then finally, Lassie says, again, GiaTan has been really helpful off list. He's practically a co-maintainer.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Some kind of chat conversation going off list now, and they're collaborating more closely building up the trust. And he says, he might have a bigger role in the future, at least with XC Utils. It's clear that my resources are too limited and something has to change in the long term. So the kind of idea has now been planted in his mind that he probably should give access to somebody else to help maintain the project. And again, this all sounds nefarious because I'm doing it in a talk and I have slides up here, but this is also open source working correctly. This is thinking about, oh, hey, maybe I'm not the best maintainer. Maybe I should hand this off to somebody. That's pretty normal as well. At this point, nothing actually nefarious has happened, by the way. There's no bad code that's been included. This is just laying the foundation. Okay, so a couple weeks go by. So now we have this character GGA Kumar who enters, and this person's much more aggressive and really starts to apply more pressure. So they go over one month and no closer to being merged, not a surprise. So like dropping into threads to just sort of nag the maintainer and kind of make him feel like he's not doing a good job. Progress will not happen.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Not nice. Don't do this, people. And I think one of the interesting things about this whole situation is that this is another one of the things I've seen change in the way that open source is done is traditionally you think of a project like Linux or WordPress or these big foundation-backed projects. They have the structure up here at the top where you have one project, one entity with many, many maintainers that are participating in the project. A lot of times they're paid by their employer to even work on the project and to submit patches as part of their day job, right? But what we see a lot more of as we've shifted into this world of many, many, many dependencies, a lot of tiny dependencies is more of a structure like this where you have an individual with hundreds potentially, hundreds of projects that they take care of. And that was the case here with Lassie Collin. He had multiple projects that he was managing as an individual maintainer. Okay, so let's continue on. So this is three months has gone by. He replies, he apologizes for the slowness, and he also adds in a bit about how Giatan has helped him off list with X-Utils. So probably they”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“The bigger multi hundred line patches were ignored, right? Typical also typical behavior for an overloaded maintainer, right? Okay, then a couple months go by, and now we see a new character enter the picture. This guy Jigar Kumar sends kind of a few emails complaining that some of Jatan's patches weren't landing. This is often used to pressure maintainers to include code in projects. Patches spend years on this mailing list. There's no reason to think anything is coming soon. So aggressive, right? At this point, remember, he's already landed a few of the patches, but the pressure is building here. And then this is insert project name still maintained. That is the bane of a maintainer's existence. It's the meanest kind of issue you can open up on a project, in my opinion. This has happened to me many times. I have a couple screenshots here. Is this still being developed? And like on a perfectly active project because their PR wasn't looked at for a little while, right? Here's another one on one of my projects. Is this project dead?”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“A couple of more patches after this one, all totally ignored by the maintainer, who at this point has been maintaining this project for about 15, maybe 20 years. This is a long-time project and the guy running it is just, at this point, it's in maintenance mode. It's basically, he's sort of burned out, he's sort of kind of half maintaining it, checking the mailing list once in a while, but really not actively working on this anymore. So it's something that a lot of maintainers go through. And so then finally the maintainer, this is like, I think three more months after the last email, we see that the maintainer just randomly comes by and merges a couple line change to the project that is the first code from this GiaTan individual that's actually included in the project. And what I think is interesting about this is all of his other patches were ignored. The patch that was merged is this like trivial two-line patch that you can just look at and kind of as an overloaded maintainer you can look at this and sort of figure out what it's doing and oh it fixes a bug cool let me just merge it and move on”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“That they did also seems to indicate that it might be the same people behind solar winds, probably, but again, this is all just kind of speculation. I want to kind of go into a little bit so you can kind of see just the character of what this attack kind of looks like. So this is kind of individual who ends up committing and releasing the malicious code. And this is his first email patch to the mailing list where they do the development for this project XE utils. It's interesting this is just kind of a totally pointless patch, right? This is like the kind of thing that as a maintainer you get all the time someone just drive by dropping in an editor config file, which is basically does nothing, right? It's a no-op in terms of the functionality of the project. And oftentimes you'll see these from people who just want to get to be able to say that they're a contributor to a project. It doesn't require any understanding of the project. It's just noise, but you can see their first attempt to kind of get involved in the project. Then they sent another patch a month later fixing some kind of build problem, and they also sent a”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Way that they did this was just so interesting, and it's something, I mean, look, I'm sad that it happened, but I'm also like, I've been telling you guys about this for so long. I'm sort of like kind of satisfied in a way that finally there's an example that's really caught the imaginations of folks. So what happened here was we had a group, like I said, probably state-backed winning over the contributor of the project over several years of work. So that's like a scale of time invested in this that we haven't seen in other attempts like this. And then they introduced a sophisticated, though not flawless backdoor that was aimed at compromising SSH servers. So it's a pretty multi-layered vulnerability. There were multiple personas involved from identities that hadn't been seen anywhere on the internet before, so that kind of is another indication that probably this was someone relatively sophisticated. This wasn't just someone doing it for the lulls. And so probably suggesting kind of state-backed actors here. And then just the way the timeline and the kind of some of the stuff.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Now, usually in this talk, I like to talk about solar winds, but we actually have a better example that was gifted to us, the XD Fills attack. So everybody here has heard about this by now, but this was some group likely, I think, backed by a state that infiltrated an open source data compression project called XC Utils.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Relentlessly all the time. So, conclusions I was part of this move from like waterfalls to continuous and then saw this, we just heap stuff onto our developer's plate and then saw developers learn to resent and avoid security more and more. I think what we should do instead is help them out. Like they're very, very busy people. We should build a system that makes it fast and easy for them to go do something they want to do and then has security victims as a side effect. So it's like when you want your dog to take vitamins, you don't just put vitamins in your hand and offer them to the dog. You put the vitamins in the peanut butter and the dog wants the peanut butter and the dog gets the vitamins too. I think this is what we should be doing for our developer users”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“To mess up GoLang libraries to handle a lot of security things. And actually, my mom sent me this article recently. Mom's so funny. She knows that I work in security and sends me everything that has security in it out of Wall Street Journal. And usually it's something that either happened three months ago or it's got nothing to do with me. But this one was written by Larry Ellison and it's not very old. His point is it's time to hand over cybersecurity to computers, basically just relentlessly hounding the users and like trying to get the users to be smarter. Like it doesn't work anymore. What we want to get is developers back to just writing app code, like working on the business, not having to be security people all the time. So today, if you think about it, devs have to burn down this never-ending pile of JIRA tickets. This causes annoyance with the security team. If you had a friend that only showed up when they wanted you to do something, you're probably going to start avoiding that friend. And we're getting a ton of that. What if instead if they just use systems that made good security choices on their behalf and forget about all of this like training?”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“One of the projects that really informed how I see this is Lemur, the Netflix released in 2015. Google launched the Identity Aware proxy in 2017. Chrome added a password manager by default back in 2018. And Clint Gibbler, one of my friends and somebody that has done a lot of work in the space, did his talk in 2021 called How to Eradicate Vulnerability Classes. So Lemur, when I got to Netflix, it was in 2017, and I remember just being blown away at how easy it was for our developers to just get things like certificates without having to select a cipher suite and pick crypto parameters and rotate it and store your private key securely. It just made it like dead symbol. And the benefit of this is that developers never have to learn about crypto anything. They just get it for free. Google has done just probably more work than anybody here. So we're going to upscale people to HTTPS automatically. Chrome updates itself, which became standard for many other pieces of software. We have these basically like impossible.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“The first time the job shortage news articles was in 2015, early 2016, were short a million jobs already in 2016. This is just piling up more and more. We don't have enough security people to actually do the work that we need them to do. So where does this leave us? I think that we're entering a new phase, phase four of security, where basically telling developers it's your job you fix security all the time. Didn't particularly scale well. I think that that's becoming very evident today. So years 2020, blinding lights is number one. Box office is bad boys for life. Who does security? I think systems do security. What we're doing doesn't scale. We have developer fatigue. I hear people tell me all the time, like, oh, we take the posture management and then we just filter out everything that's not higher critical. And then we ship those JIRA tickets to developers. Training relentlessly, obviously. It doesn't matter how many times we've trained developers on like all the SQL injection types. They still don't remember it and really they shouldn't have to. So milestones.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“We also have big bug bounties, so crowdsourcing more and more vulnerabilities in the hopes that the attackers aren't going to use these things to cause massive breaches for us. So much posture management. So the first was cloud security posture management. Evident was the first company here. At Netflix, they'd also created security monkey, which is basically open source posture management. And since then, it's just like posture management just exploding all over the place. We have AppSec posture management, data security posture management, identity posture management, SSPM, like whatever that bottom posture management is, just so much posture management everywhere. And what these things are really good at doing is going and finding problems after they're already deployed, right? And then you have to go do something about it because just knowing about risk, you can't just tell your boss, like, hey, okay, well, here's all the risk that we have. They're going to want you to reduce it somehow. And so what we move to since this is now developer zoning security is we rip a bunch of jura tickets for them and we call it a day. So we also are getting at this time job shortage.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“You have to do with security before you ship your product for the year. And now we're moving to cloud, and we're doing continuous deployment. And security is like, I don't know when I do these assessments anymore. So what we do is we basically take every single developer and tell them, guess what? Good news, you're a security person now. So we're also getting more and more mega breaches. If you look at the numbers from this time, every single year it's exponential growth in the number of public breaches, the size of the breaches, the damage in the breaches. vendors still exploding. So EDR, Next Gen firewall, detection, all deposture management, dev training, bug bounty. Milestones, the first use of the term devsecOps was actually in 2013, and we had the first CSPM, which gave birth to this massive posture management industry that we have today. We start to see no before, right? It's like we're going to train developers continuously. Developers are going to learn about all of the types of cross-site scripting and SQL injection with one day, like once per year of training, where they learn it and then they immediately forget it at the next day.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“We also get more compliance. So PCI DSS version one was written in 2004. This mandated security activities, again, vendors are trying to get themselves into the standards so that they can sell more product, right? It's like, okay, well, if you're going to deal with payment card data, then you need to do web scanning, for example. Proof point was an example of one of the companies here. This was founded in 2002, still around today, very successful, but email security, right? So as soon as you have email being used as widely as it is today, and we also have email viruses, it's okay, we're going to need something to filter out spam and viruses. So proofpoint started that. And then also in Perva, a big web application firewall that's also still around today. Okay, phase three is DevSecOps. So the year is 2013. Billboard number one is thrift shop, box office number one is Iron Man Who does security? It's everybody's job. We've collectively decided that basically security doesn't scale. Like we've been this sign off function that”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“I actually thought it was much more recent, but this is a very old term. And then socks regulation was, I think, the first compliance standard that actually mandated some security activities. There was a growing community of folks that were really interested in web security and all of what's possible here. And Mark Kurfee started this group called OASP to basically make this knowledge more socialized so that people knew about it. One of the first projects in OWASP was the OASP top 10. And that immediately became like, how can I get my vendor shit to be one of the top 10 things that people are buying? So this is, you know, you get more tailwagging than dog. It's like, oh, my thing should be, you know, in the top five for sure because it's going to help us sell a lot more of it. Now we have the beginning of the big internet worms. So at the time, Windows basically didn't come with any firewall. You started up, it would get immediately compromised by stuff. The worms here were costing a lot of money. So we had like attacks like mafia boys, DDoS in 2000.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“That and then you explain why this web application security is an actual thing and why they need vendor solution for it. All right, phase two is the risk sign-off function. So the year is 2004. Billboard number one is yeah by Usher and Little John. Box office is Trek 2. This is what phones look like. By the way, these phones will last longer than you will. These things were like basically indestructible. Who does security? Now we have a security team that does it. So this isn't just a thing that IT does with some of their time. So this is when we start to get the beginning of traditional security activities. We have Microsoft basically getting popped in the mouth and they need to do some stuff differently. Tech companies start hiring people that are actually called security. Vendors now is exploding. So we have antivirus firewall still email security web application firewall DAST and SAS. Milestones here. We had the first use of the term cross-site scripting again by Microsoft engineers, OWASP plus founded in 2001. The first use of the term shift left.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Nothing with it. They just sit on it forever. And so there was this big moment at the time full disclosure where it's like, okay, well, we're just going to put the full gory details of this thing and force action from vendors. And then that led to regular patching cycles. So Microsoft quickly copied that. We also had the first web application security tools. So this is Nikdo, an old one from 2001. It was kind of open source. But this is the beginning of these tools being broadly available. And then this is the beginning of what I call the tail wagging the dog when it comes to vendors and security. So from some of the folks I talk to, we basically have these new attack paths and the buyers, in this case IT, were very uneducated about how this works. So it's like you need to have your web port open. It needs to be legit open. And I can get in and compromise you through that. IT didn't understand it very well, so vendors had to do their part to come in and educate the IT buyers that this was possible. What this looked like was basically I just completely compromised all your systems and they said, how did you do that?”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Box office number one is Harry Potter and the Sorcerer's Stone. Who does security? IT does security. So context here, this is the start of when we get like big hacking. So it's not just like a thing that happens once in a while. Businesses have all either moved online or are rapidly moving online. Vendors now is antivirus firewalls systems management. Milestones here. Microsoft engineers coined the term SQL injection in 98. The first big internet worm that made it bad for business was Code Red. The first patch Tuesday was in 2003. And I don't know for anybody that's old like me. We had this Y2K thing, which was actually like complete nothing burger. But what was interesting about it is we cared enough about computers and what they do that we thought it might be a thing. So one of the changes here was bug track and full disclosure. So back in the day, we had mailing lists, bug track, people would send security vulnerability reports and vendors would basically do”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“An app that you went and dealt with. It was a site that you came to. So, this is Apple's site from 97. Hackers are like these dingy people. It's not like an actual job. One of the things that really moved from this to the next phase was web browsers went from that Apple thing that I just showed you to a place that you go do business. Netscape made a lot of those things possible. So they brought forward SSL, they had the first bug bounty. They were putting forward a standard of how we're going to build out apps on the internet. And that standard was JavaScript. At the same time, we had Java, which was one of the first ways of building apps on the internet from an old company called Sun, today known as Facebook. Checkpoint was founded in 1993 from somebody that came directly out of IDF and used all of the stuff that they learned to productize the web application firewall. Okay, phase two. Security is an actual thing, but it's a function of IT. So the years 2001, Billboard number one is hanging on by a moment.”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source
“Okay, phase zero, the Dark Ages. The years 1995. Billboard number one song, Gangsters Paradise, the box office number one was Batman Forever, nostalgia for the old people here. Who does security? Nobody does security. It was a totally different world. You have to realize that we didn't have much internet connectivity. Patching wasn't really much of a thing. Vendors was basically like antivirus in the start of firewalls. Milestones of this dark ages time, we had the first DEF CON, we had the first CISO Steven Katz at City Corp. So that year they actually had a breach where somebody stole money and they said this can never happen again without us having someone to go chop their head off when it happens. So this is the first CISO. We have the first word macro virus. The first bug bounty came from Netscape as we'll get to your Netscape did a lot of cool things that moved forward security and of course the hackers movie It was Web 1.0. It wasn't”
2024-06-26 · a16z Podcast · Cybersecurity's Past, Present, and AI-Driven Future · IDENTIFIED FROM THE TRANSCRIPT · source