S1: All right, Christine, welcome to unsupervised Learning.
S2: Thank you for having me.
S1: All right. We're going to, uh, we're going to jump
S1: into some stuff, uh, pretty quick here. Uh, start with
S1: the easy stuff. Um, I. So, uh, the cybersecurity industry
S1: has made a lot of, I guess, hubbub about AI
S1: and basically how big it's getting. And I'm wondering, just
S1: what are you hearing about? Like the contrast between is
S1: it is it hype? Is it really happening? Is it really,
S1: really happening? Like how much of it is like potential
S1: energy versus kinetic energy. Like what are you seeing and hearing.
S2: So that's a great question to start. Um, it you know,
S2: I guess I'll, I'll start with your first ask, which
S2: is is it real? Uh, absolutely. It's real. I think
S2: that when you look at the security industry as a whole, um,
S2: when you look at the the places that we have
S2: to focus most of our time and energy as leaders or,
S2: you know, budget or, you know, actually just doing pure
S2: security work, um, you know, you can't help but miss
S2: things like incident response, threat hunting, you know, looking at
S2: indications of compromise, because that's kind of where it all starts. Uh,
S2: and I has a beautiful ability, um, in my opinion, to,
S2: you know, empower smarter decisions, um, quicker, more accurate assessments,
S2: especially when looking at indicators of compromise. Um, within your
S2: incident response team, which again, takes to, you know, tends
S2: to be one of the most critical functions in any
S2: security team, uh, and also one of the hardest to
S2: staff and most costly. Um, so I think that there,
S2: you know, it's definitely real and there's lot of opportunity
S2: to take that and make it, um, much more intelligent. Uh,
S2: you know, it's a battlefield. So as we get smarter,
S2: our adversaries get smarter. So I think there's also a
S2: kind of a give and take of almost that you
S2: have to pay attention. Um, because if you're not paying attention,
S2: obviously your enemies are. Yeah.
S1: Yeah, that makes sense. So you mentioned incident response. So
S1: what are some other areas that, um, seem pretty ripe
S1: for you?
S2: Yeah. Well, I mean, the entire security program and it's
S2: in in its functions and roles are all right for automation. Um,
S2: and I think that companies that are really on the
S2: forefront of this technology are doing things like, you know,
S2: sandboxing their own data lakes and then using AI to
S2: really plug into that to make really great automated decisions. Uh,
S2: I mean, there's definitely a ton of power in that. Um,
S2: if you're a bigger company and have a lot of data,
S2: you know, that's kind of the way to go. But
S2: I think it's really important to to look at the
S2: types of industries and companies that really need to be
S2: focusing on AI. And I think there's a difference between,
S2: you know, I use this example when I'm speaking to
S2: others in the industry, if you are a, you know,
S2: a company that, uh, is a, um, I don't know,
S2: a lumber distributor, you know, you're, you're building boards that
S2: are going to go build somebody's houses. Your attack surface
S2: is absolutely not the same as a company developing security software, right?
S2: You know, the the company that is, you know, maybe
S2: not publicly traded also and doesn't really have that that
S2: risk from, um, customer information might be worried about protecting
S2: maybe their financial data, or maybe their even their company
S2: trade secrets. But a secure software developer who has a
S2: product they're actually selling into, you know, the highly regulated environment,
S2: who inherits their attack surface and becomes part of their
S2: supply chain. You know, that's a more a different role
S2: for AI, right? So I think it's also imperative that
S2: we balance kind of the need for that. And and
S2: you know, where you're going to to invest, so to
S2: speak for that. You know, that latter example of, you know,
S2: companies like ours that are selling, you know, security software
S2: into highly regulated environments. It's we, you know, it's table stakes.
S2: We have to understand that landscape, um, and automation and
S2: AI driven, you know, response really is the value. I mean,
S2: there's lots of value in AI, but that's definitely where
S2: I see the, the most value because you're, you know,
S2: you're you're hitting in so many areas. Um, not only
S2: are you able to look at indicators of compromise and
S2: make quicker, faster decisions, but you can look at hypothesis
S2: driven decisions that have already been proven, which is, you know,
S2: really brings on to the intelligence. So, um, it's kind
S2: of like driving a car from 1986 and driving the
S2: space shuttle. You know, there's just so much more, um,
S2: overwhelming capability. But, you know, of course, that also comes with, uh, responsibility. Um,
S2: but that's, you know, definitely an area I see, um,
S2: disrupting the industry for sure.
S1: Yeah. And you're the VP of product security over there
S1: at BlackBerry. So how are you seeing it in your products?
S2: Well, I think probably the biggest, um, impact we're seeing
S2: in our products is actually the services we're offering with
S2: the AI, you know, included in it. So, you know,
S2: our guard team has, uh, which is professional services that does,
S2: you know, incident response for these, these mid to smaller
S2: enterprise companies or any company for that matter. But where
S2: I really see the pain from this is coming from
S2: these you know many companies that just don't have the
S2: ability to scale this fast enough. Um, you know, attackers
S2: are getting smarter and it takes time. Um, staffing challenges,
S2: all of that great stuff to really scale to that.
S2: And where we're really seeing, I think the most impact
S2: there is, you know, our services team who has the
S2: ability to scale for, you know, for the company that
S2: might not be able to, um, you know, they have
S2: a dashboard and they can literally hit, you know, a
S2: help me button, so to speak. And then we have
S2: a team of people that can run these AI and
S2: automation driven decisions for them. So I think that that's
S2: really been one of the bigger things that we've seen. Uh,
S2: you know, we as a company, historically when we, um,
S2: purchased silence as a company, you know, brought AI into
S2: our company long before I was really even talked about.
S2: So we've we've definitely got the, the historical, um, expertise
S2: built into, um, to some of that decision making with AI.
S1: Yeah, that makes sense. I mean, I guess can I
S1: step back? Um, really interesting. So you have all this
S1: stuff going on there at BlackBerry. You have. I've talked
S1: to multiple people over there, uh, through unsupervised learning, and
S1: it's like you've got a whole bunch of AI research
S1: going on. You've got your whole team there, you've got
S1: all these, uh, different service offerings like you mentioned, incident response, like, uh,
S1: like other players there. And it's like, how often do
S1: you get the question of like, oh, BlackBerry. Oh, I
S1: didn't realize they were doing all these elite things. Is
S1: that pretty much a regular conversation with, uh, outsiders?
S2: It is. It is because, you know, back from the
S2: days of the handset, um, you know, I think everybody
S2: knew and everybody knows that BlackBerry does amazing security things.
S2: You know, I don't think there's any question the brand
S2: has has done us well for that over the years. And, and,
S2: you know, the the unsaid thing is the highly regulated
S2: and people that really, really, really care. And, you know, again,
S2: in my example of the lumber manufacturer to a highly
S2: regulated environment, it's not the same. And BlackBerry has played
S2: in that highly regulated environment, you know, for a very, very,
S2: very long time. And so we do understand, uh, the
S2: importance and the, the just the value of just doing
S2: pure security work. Um, and that's tough in the industry
S2: when you're a, a security software vendor because you're, you're,
S2: you're in security. You're doing security, you have products that
S2: do security. And then the outcome is security. So it's
S2: kind of embedded into, you know, everything that you do. Um,
S2: but I think what's really been cool to see over
S2: the years has been to watch, um, sort of the, the,
S2: the things out of the handset that we were really
S2: good at and to put that into a service. Um, again,
S2: you know, nowhere is that more applicable than what we're
S2: talking about today with our acquisition of silence and just running,
S2: you know, the managed endpoint detection with AI in it
S2: has been really cool to see us take our really intelligent,
S2: smart security thinking and sort of turn it and evolve
S2: into what is the most important thing today. Um, so
S2: you know that that's been really cool to watch. But yes,
S2: I run into that. If I had a nickel for
S2: every time someone asked me if we were going to
S2: make phones again. Oh my gosh, if we ever, you know,
S2: we're I'm not saying we're making phones again. We're not. But,
S2: you know, if we ever were to.
S1: Do that, you heard it here first.
S2: If we ever were, if we ever did that again.
S2: Oh my gosh. Uh, I would have to then go
S2: change my narrative after changing my narrative after changing it
S2: one more time. So yes, it is, um, it is
S2: a complicated world and security, and we definitely play in
S2: lots of facets in it. So it is we make
S2: it complicated too.
S1: So yeah. And now that I'm thinking about it, I'm
S1: thinking about all the places that the handset had sort
S1: of penetration. It was it was really big with the
S1: federal space in the US. And I imagine with governments
S1: all over the world. So if you have talent and
S1: you have tech and you get out of a particular market,
S1: you still have the that talent in tech and you
S1: still have the relationships. So that's that's seems to be
S1: why BlackBerry's security has survived and thrived.
S2: Absolutely, 100%. Um, you know, the one thing over the
S2: years that I've learned is, is as these, uh, regulated markets, um,
S2: the wheel just keeps turning, the regulation just keeps getting harder.
S2: The attackers get smarter, it never stops to evolve. So
S2: if you think about, like, the crystal, I always talk
S2: about my crystal ball. Like, you know, we had a
S2: crystal ball ten years ago, and we were looking at
S2: this like, you know, hey, these are the things that
S2: are going to be important coming up in the next,
S2: you know, ten years. And if you look back at
S2: that crystal ball, um, you know, we were really highly
S2: accurate on a lot of things, both in our team
S2: and in the product teams. Um, and that trust that
S2: you have with the highly regulated market, whether it's banks
S2: or medical or, you know, us federal, um, or any
S2: of the agencies, it's it's really, really, um, important to
S2: them that they, they can trust their vendors because their
S2: security is really only as good as their vendor security. Um,
S2: you know, we can look at, you know, go back
S2: to just outside of AI and malware, but going back
S2: to things like, um, you know, log for J, you know,
S2: just things where it really proved that the supply chain
S2: was really only as strong as its is its weakest link. Uh,
S2: and so I really think that, you know, vendors that
S2: have that trust built in that, you know, really focus
S2: on this. Um, have, have sort of proven their value
S2: over the years. Yeah.
S1: This is actually what I'm most excited about with AI is, um,
S1: what what I call like the mini AIS or whatever
S1: it was stolen from open source. But if you look
S1: at how many, uh, contracts are coming through or like, vendors. Um,
S1: and then supply chain relationships. How complex and like web
S1: do they are. And then you have like this team
S1: of four people or whatever for most companies, or let's
S1: say it's 14 people. Like if you're super lucky, you
S1: might be looking at tens of thousands of connections and
S1: then secondary connections on top of that for like all
S1: this different stuff. And then you're looking at billions of
S1: log events per day or whatever. And it kind of
S1: reminds me of, um, a lot of people don't know
S1: that when you're watching, uh, asteroids or meteors in the sky,
S1: it's actually not NASA. It's backyard people with telescopes. Right?
S1: And there simply aren't enough eyes to watch everything that
S1: we have to watch for. And so I really love
S1: the fact that we can very soon we're going to
S1: have so many different eyes and they're going to start
S1: as like, you know, lower intern level or whatever. But
S1: people are already saying 2025, those very cheap eyes might
S1: be like PhD level, right? But imagine you have thousands
S1: of them or millions of them. It's just bottom line.
S1: It's more coverage. It's more coverage of things in security.
S1: And there's many of them that don't have enough people
S1: looking at them.
S2: Yeah, yeah. And you know, the truth of the matter is, um,
S2: you know, if, if in your example, which I love, that, uh, if,
S2: if we don't look at it, you know, apt 32
S2: is right. So it doesn't, you know, we we you
S2: almost don't have a choice because as the evolution of technology,
S2: you know, goes forward, our attackers are going to look
S2: at that no matter what. Right? So you almost have
S2: to respond. It is. And it's a it's a game
S2: of cat and mouse. I'm the first one to admit it. Um,
S2: but you know, it is your responsibility, at least from,
S2: you know, from my perspective, to make sure that my
S2: company knows that, that we don't have a choice what
S2: to look at that stuff because they will be. So
S2: if we're going to fight that fire with fire, you know,
S2: the then, you know, we we have to look at
S2: it which, which is always, um, at the purest form
S2: of the security puzzle. Um, you know, that's always the
S2: fun thing is to sort of think about, you know,
S2: what are their next moves going to be and what
S2: are they going to use, and how do we get
S2: in front of that? And how do we think faster, smarter,
S2: you know, cheaper, better, more efficient? Um, but staffing is
S2: absolutely hands down a challenge. Um, and again, what I
S2: see in the staffing challenge of this is as companies evolve, technically,
S2: it gets harder and harder to understand the technical landscape,
S2: let alone know who to hire, to look at the
S2: technical landscape. So I think you have a few challenges in,
S2: in that area that are making it tough for companies
S2: to scale 100%.
S1: Yeah. Okay. Let's talk about that. Um, a lot a
S1: lot of hiring managers say they can't find people, and
S1: people say they can't find jobs. So what do you
S1: think the disconnect is?
S2: Well, you know, I just read something somewhere. I believe
S2: it was a Gartner. Maybe it was a Gartner report
S2: that said something like, and I might butcher this, and
S2: I apologize if I do, but it was something like,
S2: you know, in the next year, 25% will change jobs, 25%
S2: of of of security staff will change jobs. That's crazy
S2: to me. Like, yeah, just start with that data point.
S2: That's that's insane. That's a quarter of the workforce. I
S2: haven't dug into that enough to know what where the
S2: data came from. But if that's really true, that means
S2: a lot of things. So number one, you know, as
S2: a as a leader that hires and runs a team,
S2: you know, I think are my people. I hear about
S2: the burnout, I get it. I you know what? We're
S2: fighting a war. A virtual war is being fought every
S2: day with these teams. We all know that, right? But,
S2: you know, the burnout factor is real. And I and
S2: I see that. But but also are you know, I
S2: think about things like do we do we understand that
S2: technical landscape enough to be hiring people for the right roles?
S2: Why are people burning out? Um, you know, is it
S2: is it this tug of war of people aren't happy
S2: because the jobs are so hard, and because they're evolving
S2: so fast that we we aren't keeping up or, you know,
S2: is it the tug of war of there's a greener
S2: pasture somewhere else? And then people are finding out that
S2: it's really not I'm not really sure where the, the
S2: balance of of why those numbers are the way they are,
S2: but that was really over overwhelming to me. Um, yeah.
S2: You know, and I and I and there is some
S2: interesting research coming out that I just got a preview of.
S2: That kind of blew me away, too. And it was
S2: the where do you see your the question was, where
S2: do you see your hiring challenges in security. And it
S2: was it wasn't necessarily the staff as it was the
S2: technical complication. Like it was almost like how the question was,
S2: was put out there was we don't understand or we're
S2: having problems scaling our environments technically, let alone hiring staff
S2: to to run that. So it was almost like an
S2: after effect of, you know, we we don't know what
S2: tools to use. We we aren't really sure how to
S2: plug in the right efficiency models. And so because we
S2: can't grasp our technical environment, we're really struggling to hire
S2: people because we don't even know what to ask for.
S2: It was kind of that string of things, and so
S2: I wonder how much that weighs into that as well.
S1: Yeah, I've been pretty skeptical of these things because, like you,
S1: I've been watching these things for, for years. And so
S1: one report comes out, it's like we're going to need whatever,
S1: 70 million new cyber jobs within the next few years.
S1: And I'm like, so whatever the number is, 2 million,
S1: 70 million. I'm like, first of all, every report comes out.
S1: The number is wildly different. Second of all, the numbers
S1: just seem crazy. And then third, if you look on
S1: Hacker News, it's like, oh, here's all the cybersecurity people
S1: who just got laid off. And then you go on
S1: the Reddit boards and you see a bunch of hiring boards.
S1: So these are all the people trying to hire. I'm like, okay,
S1: which one is it? Do we need millions or more people?
S1: Or are we actually having all these layoffs in cyber?
S1: And like you said, let's say we trust that number
S1: of 25% is that people just trading up and they're
S1: going to a better job. Like it's it's quite confusing. Um, yeah, it.
S2: Is. And I just found it. So Gartner recently reported
S2: that by 2025, nearly half of all cybersecurity leaders will
S2: change jobs. Half and 25% will leave for entirely different roles. So,
S2: I mean, you know, I, I, I am so fortunate that,
S2: you know, working for a company that does security. It's
S2: not really I don't go into work every day and
S2: have to, you know, defend my position. We take it
S2: so seriously that it's in every meeting and every discussion. And,
S2: you know, I don't have to I don't have to
S2: fight to get air time. It's like, you know, I
S2: just go in and security is important. It's just table stakes. Right.
S2: But but many companies, it's not. And and you're seeing
S2: more and more of the outsourcing too, right. Like you're
S2: seeing more of these companies just raise their hand and
S2: be like, you know, I'm tapping out. Just do it.
S2: I can't I can't scale it. I don't understand it.
S2: I can't hire the people fast enough. I can't get
S2: enough automation. I have a budget and I don't know
S2: where to spend it. I don't know what to prioritize
S2: because again, you know, the the the evolution of security
S2: keeps rolling and attackers keep rolling. And so they're just
S2: constantly on the hamster wheel of spinning, trying to become
S2: more efficient with less money. And, you know, meanwhile we
S2: got a board that's, you know, absolutely doing their jobs
S2: and saying, you know, and this has changed a lot.
S2: And I feel like what we're not talking about as
S2: leaders is the role of the board. The role of
S2: the board. Driving this down has really put a lot
S2: of pressure on many leaders to really scale with, with
S2: their budget. So, you know, I do feel like the
S2: leaders do take a lot. I mean, I know it's stressful.
S2: I feel it too. But, you know, leadership does take
S2: the brunt of like do the thing, do all the
S2: things with this, you know, and that and that bucket
S2: might be great or it might not be great depending on,
S2: on the company that you're at or you know, what
S2: scope you're able to to do. But 25% leaving for
S2: entirely different roles says a lot.
S1: Yeah, I really liked your earlier point about maybe people
S1: just not being able to articulate what they need. Because
S1: if you think like because the security security group is
S1: usually just responding to engineering and leadership and engineering and
S1: leadership are moving according to the market and according to
S1: whatever drama is happening at the company. So it's like
S1: security is always having to rehash their goals and everything.
S1: So it's like, oh, I guess we're not hiring that
S1: team anymore because that's no longer our focus because we
S1: got a new CEO. So it's like the faster tech
S1: moves and the more chaotic a given company is, the
S1: harder it is to hire for anything really, because things
S1: aren't static.
S2: 100%. 100%. And as that technology gets smarter, the people
S2: will have to scale to be the people have to
S2: be smarter to scale. And where are we training all
S2: these amazing people? Is is security evolving and training as
S2: fast as technology is growing? I don't know. That's the reality.
S2: I don't know and I don't know in security, you know,
S2: we've always had this challenge. You kind of have to
S2: be in it and do.
S3: It to learn.
S2: It. Right. There's no right. You can't you can't. Even
S2: with the role of I attack. Scenarios need humans, you know,
S2: it's like I will always be great at being hypothesis
S2: driven and being able to crowdsource brains, but it won't
S2: tell you if it's raining on Thursday right now. You
S2: know it won't. It won't take into account your environmental stuff.
S2: It won't. It won't say, oh, the wind's blowing at
S2: 15 degrees. We better not land this plane over here
S2: where it's 70 degrees. I mean, it's never going to
S2: be that that agile. It's always going to be a
S2: thinking brain. Right. So so in order to to really
S2: use that to its firepower, we have to have humans
S2: in front of it that know how to execute with it.
S2: And that to me is what I'm seeing is sort
S2: of like the big challenges. We're driving a space shuttle, right?
S2: It's not the 86 Camry. We're driving a space shuttle.
S2: And in order to do that, you got to have
S2: really qualified people on the front end of those space
S2: shuttles to make sure that they get to the right places,
S2: or you know that all the functionality is used. You
S2: know that you're making those right decisions, and it's a
S2: split second in time that I will just always sort
S2: of have that, that it is like giving you a
S2: space shuttle. You still got to know how to drive it, right?
S2: You still got to know how to take off and
S2: you still got to know how to land. And so
S2: I see that as a big challenge. You could peanut
S2: butter that story sort of across all of technology right
S2: now in security, it's only going to be as good
S2: as the people leading it. Mhm.
S1: Yeah I do think AI is going to fill in
S1: some of those gaps. Most importantly the one that you mentioned,
S1: which is um adding context. I think that'll get easier.
S1: But ultimately you still, like you said, got to have
S1: humans running the show at some level. Yeah. The other
S1: problem with the the talent thing, I think, is we
S1: don't really have what the military has, which is, um,
S1: you start at E-1 and you must do E-1 things
S1: before you become an E-2, and you have this pipeline,
S1: and the pipeline is a talent pipeline, and it's also
S1: a maturity pipeline. So and they watch very carefully how
S1: many e-1's do we have? How many e2's do we
S1: have enough e2's to keep the pipeline healthy for e-3s
S1: and same for officers and whatever. So the thing that
S1: we don't have here and actually gets worse with AI
S1: if you start automating away tier one SoC analysts, okay,
S1: so the tier one goes away, how you're going to
S1: go from 0 to 2 or 0 to 3, that's
S1: going to be messed up.
S2: Hundred percent agree with you. And this is again where
S2: silence guard. You know our our service that really is
S2: SOC as a service. This is an absolutely why the
S2: people that I talk to and you know I do
S2: I talk to our customers and I ask them questions.
S2: And I want to learn more about why they came
S2: to us for help. This is their reason. They can't.
S2: So you look at the big 70,000 person company. They've
S2: got that pipeline, they've got the e-1s sitting there getting
S2: trained right. And they know their progression through the system. Yes.
S2: Mid to smaller enterprise companies don't have the staff to
S2: do that. They don't have the luxury to build that firepower. Right.
S2: And so they're constantly hamster wheel chasing the evolvement of
S2: this technology with being able to hire and keep the
S2: senior or senior enough people to be able to make
S2: good decisions. And how do you you know and and
S2: you know this as well as I do, how do
S2: you take one person and scale all of that? When
S2: you're a small company? The answer is you don't. You can't.
S2: There's no way you're either going to have to hire
S2: somebody so senior that, you know, they they can do
S2: all of the things. And then does the senior person
S2: want to do that stuff anymore in their career? Right.
S2: This is why we we can't have nice things in security, right?
S2: We we have all these really amazingly intelligent people. But
S2: then the the work, the actual analyst level work that
S2: needs to happen, you know, it's it's hard. It's it's
S2: a grind. Right. And this is again AI is going
S2: to come in and make smarter decisions. But you still
S2: got to have someone at the dashboard right. Yeah.
S1: And yeah. And maybe that senior person comes in, finds
S1: out they have to do tier one, tier two and
S1: tier three, and they become part of your 25% who
S1: jumps jobs? Right, right. Yeah.
S2: Or with half. It's actually that number was half.
S1: That was half. It was.
S2: Half. The leaders are leaving and then 25% are getting
S2: out of or completely doing different jobs. Didn't say they're
S2: out of getting out of I have to go back.
S2: I didn't say that they were getting out of security,
S2: but they're going to do completely different jobs, which is crazy.
S2: That just says they're entirely different roles is what is
S2: what the report says. So I mean, that just says that,
S2: you know, like, uh.
S1: I think they weren't happy for some reason.
S2: Right. And I think that the pressure cooker that the
S2: other side is facing that companies are facing is, you know,
S2: the evolvement of things like reporting, you know, reporting requirements, um,
S2: the evolvement of breaches that are happening, all of these things,
S2: and they're costing more money. And then you have all
S2: this regulation coming in on top of it, which is
S2: just creating so much more of a pressure cooker for
S2: companies to operate in. Um, you know, and they're worried
S2: about reputational damage. So, you know, that's something that, you know,
S2: before what I don't know, maybe three, 4 or 5
S2: years ago, we all knew, I mean, you know, our brand,
S2: of course, you know, we talk about it all the time,
S2: but but, you know, other companies really didn't I didn't
S2: have any peers in the industry where this was a
S2: huge concern for them. And now it's a concern for everybody,
S2: which is the reporting requirements, your air and your dirty
S2: laundry no matter what. Right. So you're going to have
S2: to take into account with the board, you know, the
S2: damage that it could happen to your brand. So I
S2: think there is so much more of a, of a,
S2: of a willingness for so many more CISOs to sort
S2: of raise their hand and be like, you know, hey,
S2: I'm tapping out. I got to hire a service to
S2: do this. I have to go to a third party.
S2: I just can't it's not it's not helping me drive
S2: my business forward. I have to just have other other
S2: companies and other other, you know, technologies help me with this.
S2: So it is a really interesting evolvement. Um, in, in
S2: the the pressure cooker of the Y, I guess I
S2: is so needed is is definitely interesting, especially over the
S2: last year. Yeah.
S1: So here's, uh, something I didn't plan on saying in 2024, but, um,
S1: it seems like crypto is coming back. Um, or at
S1: least the interest is I, I haven't been tracking it closely,
S1: but it seems like the attacks are coming with it.
S1: Are you all seeing a lot more attacks inside of crypto?
S2: Yeah, I mean, I think I think you're right. I
S2: think it is interesting how crypto and crypto mining specifically
S2: has sort of done this. I think it hit like
S2: this really. I think when crypto was kind of new,
S2: it hit like this. Wow, you can mine. And then
S2: I think it went kind of quiet for a while
S2: and I didn't hear a lot more about it. But again,
S2: you know, going back to something like apt 32 where,
S2: you know, that is like kind of their common theme
S2: and they're really, really. So, I mean, right, as security professionals,
S2: we got to respect the fine art. The fine art
S2: might not be what we want to see every day,
S2: but we do have to respect the fine art of,
S2: you know, what they do, you know, and, and and
S2: what we see as far as in its simplest form, um,
S2: you know, of using a computer to do a lot
S2: of really hard math problems, you know, to make money. Great. Okay.
S2: But when you have a group like apt 32, that is,
S2: you know, from writing their own custom spyware, um, you know,
S2: or Mac OS malware that's using, you know, double extension, uh,
S2: techniques written in Perl. That's crazy to me, all the
S2: way to going on Facebook and getting people to click
S2: phishing links, which in it's also simplest form is the
S2: need to train employees. Right? So, you know, when you
S2: get in the leadership level of talking about this stuff,
S2: you know as well as I do, you know, the
S2: CEO is always want to know, okay, how do I
S2: how do I stop this. How do I how do
S2: I do how do I deal with things like, um,
S2: crypto mining and how do we protect ourselves from stuff
S2: like this? And it all comes back to kind of
S2: the same thing, right? It's all, you know, training your
S2: employees to not click on, you know, links in emails
S2: or here or there. But again, AI is making that
S2: so hard to detect that that is becoming a, you know,
S2: kind of a huge arms race is who's going to
S2: be faster at that, you know, are we going to
S2: train our employees faster? Are we going to, um, you know,
S2: or are we going to let AI sort of take
S2: over that, that, uh, you know, that space and let
S2: it become even even more relevant to crypto mining and
S2: all things malware?
S1: Yeah, that makes sense. And I guess these names here
S1: are cryptojacking. Is that really just stealing crypto? Yeah. And then, uh,
S1: crypto mining is just, uh, taking control of a resource, uh,
S1: someone else's resource and using that to mine, right?
S2: Yeah, yeah. And with crypto mining, it's really interesting because,
S2: you know, again, back in the day when it was
S2: sort of up and coming, it was such a big surprise.
S2: I feel like we almost got to a point where
S2: we got overloaded on it and became so common. But
S2: the thing with crypto mining is that most I would
S2: say I'll go on a limb and say most, most
S2: companies that aren't really looking for that sort of traffic
S2: don't really know that adversaries are using their systems to
S2: do crypto mining until they get the hide power bill,
S2: or they experience a lag, you know, a systems lag where,
S2: you know, hey, how come this, you know, application is
S2: taking so long to load or you know, or why
S2: why is this system running so slow or it just
S2: took four minutes to download this one, you know, web
S2: page or whatever. You know, they're having some sort of
S2: indicator that they don't even really know as an indicator. Right?
S2: So I think that that is the beauty in its
S2: simplest form of a system being taken over to do
S2: those hard math problems as it takes resources to do
S2: the math problems. Right. Um, you know, criminal scan machines
S2: for ones they can, you know, they can penetrate and
S2: get into and then they're in and they're in the
S2: compromised systems and victims just don't realize it. And they
S2: don't they don't know they're compromised until they see something.
S2: And then when they see something, they don't even know,
S2: that's what it is. Right? So I think that's the
S2: beauty of it is from an attacker perspective, is they
S2: can be in there undetected forever. And then until you
S2: get this really high power bill and someone in procurements
S2: like something is wrong, I'm paying this bill. It's four
S2: times the size. We should go look at that.
S1: Yeah, it reminds me of, uh, Cuckoo's Egg. If you
S1: remember that book, um, where, um, who was it? Cliff Stoll? Uh,
S1: I think he was at, um, Lawrence Livermore lab, and
S1: he was just checking logs and noticed, like, a weird
S1: spike of, like, someone buying something for, like, $0.02 or
S1: something and just starts digging and ends up uncovering, like,
S1: this massive, like, German and Russian, uh, spy operation and everything.
S1: And as you were saying that I was thinking of like,
S1: I wonder if really, really smart crypto miners, they throttle
S1: their stuff to try to fly under the radar, you know,
S1: because if you just go crazy, you're more likely to
S1: get caught.
S2: Yeah, that that is a really, really, really, really good
S2: good point and good question. And again you know I
S2: can't I can't just help but use my, my my
S2: my crystal ball. I mean there will be I that
S2: will help detect that stuff, right. Like like I'm a
S2: I'm a criminal. I need to figure out how to
S2: fly a detector on the radar. Give me all the paths,
S2: performance issues that have caused, you know, this to be detected.
S2: They're going to learn from that. Of course they are.
S2: I gotta learn from that too. Right. So, you know,
S2: there is as I keeps, criminals are just going to
S2: get smarter and smarter and smarter.
S1: Yeah, yeah. The I basically look at the, the legitimate
S1: load on the system. Although the question is like how
S1: does it know the difference between legitimate and not. But
S1: if you if you could look at like what the
S1: business is supposed to do and see like all the
S1: different processes running and then it sees, wait a minute,
S1: what's this weird process that's got, you know, spiked usage?
S1: Maybe that's worth looking into. Well, um.
S2: I mean, I don't want to help exploit anything, but
S2: if this were me, okay, if this were me, I
S2: would want to know what normal is. Yes. Right. I'd
S2: want to. I'd want to be there silently looking at normal.
S2: I'd want to track normal for a very long time,
S2: and I'd want to set that as a baseline, and
S2: then I'd want to increase that by 4% and let
S2: it go. Right. Or whatever your, your throttle looks like.
S2: But you're absolutely right. I mean, sorry, that was probably
S2: I want to be helpful to anybody. But that is
S2: what I absolutely I mean of course. And I can
S2: provide that.
S1: Okay. So you mentioned the crystal ball. What is, uh,
S1: 2025 look like for you? What do you, uh, what
S1: are you anticipating or what might surprise you? What are
S1: you thinking?
S2: Um, so, I mean, for the year in for 2025, even.
S2: What is it, July? So maybe not even the rest
S2: of the calendar year, but for 2025, I think I,
S2: you know, the one thing that I'm watching very closely
S2: is regulation. Um, what how we evolve as a security
S2: industry is really interesting from the from the very, very,
S2: very top perspective. What I see is companies being held
S2: accountable more so than ever. Right. So you see a
S2: lot of very big companies publicly being held accountable in
S2: where it's hurting them the most, which is how they
S2: make money procurement. Right. You see lots of we see
S2: a lot of government regulation. We see a lot of
S2: industry regulation. We're seeing that across the board. And it's,
S2: you know, table stakes for companies like ours where that's
S2: where we're really selling into those environments a lot the
S2: highly regulated environments. So we really do have to pay
S2: attention and understand that. So that's the first thing. I
S2: think that's where the pressure will come for, for all companies.
S2: I think the result of that will be you're going
S2: to see lots of kicking and screaming, lots of, you know,
S2: translation of things that what I always say internally is
S2: it defies gravity. There are a lot of really well
S2: intentioned regulations and things that we have to pay attention
S2: to as companies or as, you know, as security practitioners
S2: that don't translate well into reality. Well, and I'll give
S2: you an example, you need to stop all vulnerabilities, right?
S2: Said who ever. There can be no vulnerabilities and you
S2: must respond to everything in four minutes. Well, that's great
S2: in theory, that's amazing. Right? But but you know as
S2: well as I do that defies gravity. There's just, you know,
S2: nobody can do that. So no company it doesn't matter
S2: how big you are. As a matter of fact, it
S2: almost becomes more difficult for the bigger companies because their
S2: surface tends to be so much bigger, right? They have
S2: so much more to watch than maybe the lumber manufacturer,
S2: as you know this much. And the huge software producer
S2: has a supply chain, um, in it. So I think
S2: that in 2025, we're really going to see a lot
S2: of pressure on supply chains knowing what's, you know, you're
S2: a producer, you're a seller, you're a consumer. You wear
S2: one of three hats. Are you wearing all three hats?
S2: Are you wearing two of those hats? Are you wearing
S2: one of those hats? And I think what we'll see
S2: is a lot of pressure on those roles to know
S2: where they are. We're going to see a lot more, um,
S2: arms races and security. And what I mean by arms
S2: races is how fast can you scale the the technology
S2: evolvement and the AI machine. It's fighting AI with AI
S2: and it absolutely is a thing. And, and, you know, uh,
S2: I do talk to a lot of other CISOs about
S2: this that, you know, if you sleep on that one,
S2: you're going to end up getting outpaced faster than you
S2: can grow. So don't don't, you know, don't think for
S2: a second that you don't have to worry about it
S2: because you do. That's you know, I rinse and repeat
S2: that all the time. Um, the other thing I think
S2: we're going to see in 25 is a lot more
S2: companies looking at the liability hot potato. So there's a
S2: hot potato in all of this. That's a liability right.
S2: To reporting to a board of directors, to procurement, to
S2: how we make money and to revenue and to what
S2: we report publicly. You will see a lot more CISOs
S2: realize that liability hot potato is something that they need
S2: to start taking chunks out of that they own. So
S2: you're going to see a lot more managed services, right?
S2: You're going to see a lot more scalability with bigger
S2: vendors where, you know, I can go to a bigger
S2: vendor and they can provide me these services. I can
S2: then check that off my list and not necessarily have
S2: to worry about it.
S1: And guarantees the bigger ones can provide guarantees.
S2: Absolutely, absolutely. We just did our own right. We just
S2: did $1 million guarantee. And so you're going to see
S2: a lot more CISOs raise their hand and be like,
S2: are you going to reduce my liability? Not even just security,
S2: but but how are you going to take the pressure
S2: off my shoulders so that I can go worry about
S2: doing other stuff so my company can make money? You're
S2: going to see that in 2025, really take a much
S2: more of a balancing act. So I do suspect that
S2: that companies that offer managed services or that can scale,
S2: offering more sort of chunks of availability for their their
S2: customers are really going to start to see, as companies
S2: wake up and sort of be like, oh, I don't
S2: have to do that. I can hire someone else to
S2: do it. Um, you know, and honestly, in my bottom line,
S2: that saves me 10% because of the staffing issue or
S2: the technology scalability issue. Um, I think we're going to
S2: see a lot of that. And that will be a
S2: combination of regulation, putting pressure on companies to pay attention,
S2: causing liability. I mean, look at Executive Order 14028. You know,
S2: CEOs are signing personal attestment. When does that ever happen
S2: in history? Yeah.
S1: Yeah. And what about insurance? Insurance probably be more popular
S1: because of that.
S2: Well and cyber insurance rates. Right. They're going through the
S2: roof because there's so you know, if their rates go
S2: down by 10% and they're saving, you know, you know,
S2: maybe the managed service that they have costs, you know, 5% more.
S2: But in reality it would cost them 20% more than
S2: that to hire the people. And then their cyber insurance
S2: rates drop by 10%. You're going to see a lot
S2: more evening of the scale of of how companies look
S2: at how to manage their, you know, their incident detection response,
S2: especially especially, um, I think that's just one area that's
S2: ripe for disruption.
S1: So yeah, I, I love these three that you mentioned.
S1: I think you're spot on. Um, I've got a friend named, uh,
S1: Sasha Ziegler who is talking about basically this big evolution.
S1: Basically Enron, you had CFOs got woken up, um, right.
S1: And now, uh, this year and last year, basically, the
S1: SEC is causing CISOs to wake up. So he's talking
S1: about cyber CFO. So it's basically this bifurcation where you
S1: have technical CISOs potentially dropping down to like VP of security.
S1: And like the the more business oriented move up into
S1: like head of risk.
S2: Absolutely. 100%. It's a.
S4: Business. Yeah, it's a business.
S2: And it's a costly business to maintain this company, right?
S2: I mean, the budgets are huge or the, you know,
S2: the it's a forcing function of. I absolutely think you're right.
S2: And that person in that role has to balance out
S2: the ability to generate revenue of a company to the
S2: liability that that is on that curve of security, because
S2: you can't, you know, the the awakening of the CISO
S2: has been, oh, gosh, you know, security is really, really
S2: important to my company. But if I don't do it,
S2: if we don't do it, you know, now with the
S2: evolution of regulation that's happening, the brand is going to
S2: be toast. So we won't have anything to sell in
S2: the first place. Right? So no one will trust us.
S2: So especially if you're in the supply chain, I think
S2: that role will be very popular if you're in the
S2: supply chain somewhere. Um, and you actually are selling a
S2: widget or a part of a widget to another company
S2: that has to sell a widget, right? And so you're
S2: buried in there's a liability factor where, you know, the
S2: company may be selling the end widget is going to,
S2: because of regulation, are going to turn around and hold
S2: you accountable. So that is going to be the really
S2: and I mean, you know, as far as our IoT
S2: brand with with QNX in vehicles, things like that or
S2: satellites or anything where they're going to turn around and
S2: start pointing fingers. You know, that's where that that role,
S2: I think, is really going to be critical is to
S2: understand the entire liability to a revenue chain and not
S2: just a CISO looking at risk to, you know, it's
S2: a different skill.
S1: Yeah. Yeah, absolutely. Well, uh, I love these predictions. I
S1: think you're absolutely right. And perhaps we can revisit, uh,
S1: here shortly. But, uh, thank you so much for your time.
S2: Yeah, absolutely. We'd love to.
S1: All right. Where, um, where can we follow, uh, your work.
S1: Your team's work? BlackBerry's work.
S2: Yeah, absolutely. Well, blackberry.com for our external, uh, website. Um,
S2: you follow me on LinkedIn. I'm Christine Gadsby on LinkedIn,
S2: and I'll connect. You know, just send me an invite.
S2: I'll connect and happy to chat. I have lots of
S2: amazing conversations with other CISOs and other VP of Product Security,
S2: or even on the network side, just chatting with other
S2: people around these future future predictions. And I wrote down
S2: the name that you just gave me. I'm going to
S2: I'm going to reach out to Sasha to. That's a
S2: fun conversation. I love having it. Awesome.
S1: All right. Well, I enjoyed it.
S2: Awesome. Same. Thank you. Daniel.
S1: All right. Take care.
S2: You too. Cheers.