In this episode, Patricia Muoio, Ph.D., Partner at SineWave Ventures and Former Chief of Trusted Systems Research Group, National Security Agency, sheds light on the cybersecurity technology landscape and emphasizes the need to develop technologies that are attack agnostic. Some of the questions driving the discussion include: a) what progress has been made in the development and use of cybersecurity technologies? b) What does it mean to be attack agnostic? c) how near or far are we from taking the burden off people trying to protect themselves from different cyber attacks? and d) the ideal government and industry partnership model to develop innovative solutions.

Time Stamps

02:34 -- How about sharing with listeners some professional highlights?

04:12 -- I'm really intrigued to learn about your career trajectory, considering that you got your doctorate in philosophy, so was it on the liberal side of things?

05:35 -- What's your assessment of the cybersecurity technology landscape?

08:12 -- During our planning meeting, you said, "we need to be able to develop technologies that are attack agnostic." Please expand on that.

12:50 -- While you're saying that it doesn't matter how the hackers get into your system, wouldn't I want to know how they are conducting the attack to be able to prevent it from happening in the future?

14:54 -- If I'm a developer listening in on this conversation, what should be some focus areas for new technology development? And if I'm a consumer of these technologies, how should I approach cybersecurity governance?

27:23 -- Will there ever come a day when I could be as carefree as possible, and click on anything I want, knowing that there is technology that will not allow the perpetrators to exploit that and do damage? Will we ever get to that world?

31:57 -- What is your assessment of the government-industry partnership?

38:19 -- Please share some final thoughts and key messages for the listeners.

Memorable Pat Muoio Quotes/Statements

"I think that many problems like endpoint protection, network segmentation, authentication, encryption are essentially solved. There are technologies that do these kinds of things and do them well."

"I think where a lot of the work needs to be done is making these technologies work together and work appropriately for the system in which they are used."

"We need to be able to develop technologies that should be attack agnostic."

"What it means to be attack agnostic -- you stop attackers from getting in, you stop them from moving around, you stop them from getting out, exfiltrating your data, or encrypting your data, executing their payload in any important way. And the details of how they choose to do them, the shape of the malware they choose to execute simply doesn't matter. What matters is that these actions can be identified in the system and stopped in a more general way."

"Users ought to know when less is more."

"I think people need to be careful to understand when risks that sound very very different in their effect, are actually the same in their cause, and that their solution space needs to address the causes and not the effects."

"As these technologies develop, as people become more comfortable with the notion of self- protecting self-healing systems, we will be able to take some of the burden of the users."

"Understand solutions that are based on your system, and not concentrated on what the attack looks like; but what is my system and more importantly, my business workflows, what do they look like, and build solutions that protect them, and not solutions that are based on external threat conditions."

Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast

Please subscribe to the podcast, so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.

Connect with Dr. Chatterjee on these platforms:

LinkedIn: https://www.linkedin.com/in/dchatte/

Website: https://dchatte.com/

Cybersecurity Readiness Book: https://www.amazon.com/Cybersecurity-Readiness-Holistic-High-Performance-Approach/dp/1071837338

https://us.sagepub.com/en-us/nam/cybersecurity-readiness/book275712

Latest Publication: https://www.imd.org/ibyimd/magazine/preventing-security-breaches-must-start-at-the-top/

Welcome to the Cybersecurity Readiness Podcast

Series with Dr. Dave Chatterjee. Dr. Chatterjee is the author of

the book Cybersecurity Readiness: A Holistic and

High-Performance Approach, a SAGE publication. He has been

studying cybersecurity for over a decade, authored and edited

scholarly papers, delivered talks, conducted webinars and

workshops, consulted with companies and served on a

cybersecurity SWAT team with Chief Information Security

officers. Dr. Chatterjee is Associate Professor of

Management Information Systems at the Terry College of

Business, the University of Georgia. As a Duke University

Visiting Scholar Dr. Chatterjee has taught in the Master of

Engineering in Cybersecurity program at the Pratt School of

Engineering.

Hello, everyone, I'm delighted to

welcome you to this episode of the Cybersecurity Readiness

Podcast Series. The discussion today will focus on

cybersecurity technologies, and the significance of government

and industry partnerships in developing these technologies.

Some of the questions driving our discussion are: what

progress has been made in the development and use of

cybersecurity technologies? What does it mean to be attack

agnostic? When developing cybersecurity technologies, how

near or far are we from taking the burden of people trying to

protect themselves from different types of cyber

attacks? And how significant is the government and private

sector partnerships when it comes to dealing with current

and future cyber threats? I'm delighted to have as my guest

today, Dr. Pat Muoio. She is Partner at SineWave Ventures.

Pat is an expert in matters of cybersecurity and computing,

vetting the technical viability of emerging technologies. She's

had a 30 year career in the intelligence community in a

variety of technical and leadership positions. Pat has a

bachelor's degree from Fordham University, and a Doctorate from

Yale. Pat, it is so delightful to have you as a guest today.

Welcome!

Thanks a lot, Dave. I'm really happy to be here. Looking

forward to the conversation.

Fantastic! So before we jump into the

details of our discussion topic, how about sharing with

listeners, some professional highlights?

Sure! So I've had a varied career. And in my time at

the Agency, I worked in a number of computing analytic and

cybersecurity roles, ending up in the research part of the

organization for the last third of my career, working on hard

problems in those areas. In my last position in the Trusted

Systems Research group, we investigated secure operating

systems, mobile security, mobile phone security, formal methods,

we tended to do the kinds of research that individual

companies can't afford or the lead time is so long that you

need somebody to do the foundational work before

companies can pick up on it and start making money. Since then,

I did some consulting work with NIST for a while on

cybersecurity framework and a number of other issues, cyber

physical systems security, and so on. And then I joined

SineWave, which is a early stage venture fund, concentrating on

enterprise technology that can help entities that haven't been

using information significantly in their business processes to

become more information driven. And the government certainly

fits that characteristic, as do a number of industrial segments,

and so on. And I've been with SineWave for about eight years

now, and really scouring the technical landscape for

interesting technologies, again, in the areas of cybersecurity

computing and analytics.

Fabulous! In fact, I'm really intrigued to

learn about your career trajectory, considering that you

got your doctorate in philosophy, so was it on the

liberal side of things?

So the philosophy that I did I my, my education was in

the area of phenomenology, which is about learning about what's

essential, or what what really matters about things by

considering the context in which they live and the accidents that

you can observe about them. And so it really is a way of looking

for the the essential gist of a matter and coming to understand

reality in that way. And I think that's been a central theme of

all my work throughout the agency and I have is this

ability to sort of cut through what's accidental and get to

what matters. The other thing that was a strong concentration

in logic, which tends to go hand in hand with some

phenomenological stuff. And so that, again, was a thought area

that really stood me in good stead in my very varied career.

I feel very fortunate because I got some really exciting

technical opportunities that one typically wouldn't associate

with a philosophy degree and was able to really become what I

consider myself a technologist. Now, despite the fact that I had

probably the least technical degree also,

I'm glad you said what you said, because

I know many listeners will be inspired to hear that. In the

past episodes, I've had discussions with other experts,

and many of them have been very vocal about the importance of

drawing people from different fields. Cybersecurity does not

have to be the monopoly of the technocrats and by technocrats,

we normally associate them with the computer scientists or

computer engineers. It's a pretty large field, and it could

benefit from a variety of intellects, it could benefit

from an eclectic perspective. So that's, that's truly

fascinating. Getting to the discussion on the state of

cybersecurity technologies, progress is being made in a

variety of areas from authentication to behavioral

analytics, blockchain, manufacturer usage, descriptive

(MUD), which associates with IoT devices. I'm interested in how

you size up the progress. Where do you see the strengths? Where

do you see the gaps? What's your assessment of the cybersecurity

technology landscape?

So I think there are many excellent component

technologies, I would actually even say, a sufficient set of

component technologies to build strong cybersecurity solutions.

I think that that many problems like endpoint protection,

network segmentation authentication, encryption are

essentially solved. There are technologies that do these kinds

of things and do them well. Yet, there's still number of

breaches, the breaches rise with the investment in cybersecurity

in some sense. And that is not causal. But but and you still be

wondering why if there are these basic fundamental sound building

blocks, the solutions are not as robust as we would like. And I

think what's really lacking is the ability to architect these

components into a solution to understand again, what matters,

what needs to be guarded against what needs to be in in the

internals of the system, and how to make these things usable.

There's a lot of guidance about the controls you have to have in

place, and there's 128 of them, or whatever. And people have a

hard time finding their way through these lists and lists of

things to a solution, a reasoned solution that works in their

space. And I think that's where a lot of the work needs to be

done, is making these technologies work together and

work appropriately for the system in which they are used.

Interesting. Very interesting. So while while

we were going through our planning meeting, you made a

very interesting yet poignant statement. You said that, "we

need to be able to develop technologies, that should be

attack agnostic." I'd love for you to expand on that. And

because I know listeners would love to hear that perspective.

Yeah. And I think, again, talking to why stuff has not

worked as well as we would have hoped to date. Part of this is

due to the fact that a lot of the development of technologies,

and particularly the selling of technologies, is centered around

threats, scaring people about threats, figuring out what

threat is where, advertising this particular piece of

technology to deal with this particular threat, and so on.

And what that does is it creates this marketplace with a

gazillion pieces of tech in it, each of which does many of which

do just niche little things. And the user is really has no great

understanding of which of those attacks are likely for them. How

severe are those attacks? is this the only solution against

that attack? is something else I'm already doing as a side

effect addressing this particular attack? and so on. So

when you concentrate on the attack on the externals of the

system on what's coming at you, it's a much more confusing space

and one that is difficult to get confidence that you're really

covering the waterfront. If instead you take an attack

agnostic approach and you look at technologies that you can

deploy internal to your system to make your system impervious

to attack no matter what that attack happens to look like, you

can have much better success. So for example, you're worried

about an attacker getting into your system and moving around to

get from a compromised user space, for example, to a space

where they can do some damage to your system in terms of stealing

data or encrypting data or whatever. And so you think about

what are the technologies that enabled me to stop anyone from

moving around, it doesn't matter what exact movement method

they're picking. What matters is if they're moving in a way that

you don't want, that your system does not authorize, they should

be stopped, right. And so there you deal with things like micro

segmentation, you can deal with some Zero Trust kinds of policy

driven solutions, where what it simply stops lateral movement,

regardless of its accidental characteristics. And again,

since you asked me about philosophy, this is a very

phenomenological approach, right? You stop the essential

thing, which is movement rather than the accidental thing. Using

this means to get around. And it becomes very important, you can

see this with access control, right? There's all of this

anti-phishing technology, phishing is a huge threat. And I

think we'll probably talk about it later, I think we're going to

talk about how humans can interact with these

technologies. But anyhow, phishing is a big threat. And

you want to stop that, you want to stop people from stealing

credentials via phishing, but it's also the case your

credentials can be stolen by password guessing, they can be

stolen by web scraping, they can be stolen in a bunch of

different ways. And what you really want is to stop the bad

guy from using credentials, regardless of how they stole

them, right, they read them off my sticky note, regardless, you

want to be able to stop them from using credentials in this

simple mechanisms, like two factor authentication, which

means you stole my password. Now, you also had to have stolen

my phone, if you want to use that password effectively,

because the two factor authentication would require

that additional means. So there, you're not looking at phishing

as the method you're looking at the fact that via phishing,

someone stole credentials, and you can stop stolen credentials

from being effective in the system. And this is what it

means to be attack agnostic, you stop attackers from getting in,

you stop them from moving around, you stop them from

getting out, exfiltrating your data, or encrypting your data,

executing their payload in any important way. And the details

of how they choose to do them, the shape of the malware they

choose to execute simply doesn't matter. What matters is that

these actions can be identified in the system and stopped in a

more general way. Long there, but

no, I think it's very interesting. Thanks

for sharing. As a follow up, while you're saying that it

doesn't matter how the hackers get into your system, wouldn't I

want to know how they are doing something to be able to prevent

it from happening in the future? Or am I missing a point here?

Well, I think you need to know it, if you're a security

company that are making solutions that would stop it in

the future. I think you need to know it, if you're a government

that's analyzing these things, to understand this data threat,

perhaps do forensic activity to find bad guys and stop them. But

as an average user, say, you knew a malware took this

particular form, and what could you do differently, right? If

you had a technology that would be effective against that

particular form of malware, you would have deployed it. Because

it's an unpredictable when the malware is going to come at you.

If you don't have a technology that deals with that particular

shape of malware, you're you're then have to fall back on using

these attack agnostic methods that don't care what its shape

was. So you might want the knowledge, I don't know for

reporting to management or but in reality, if there are no

knobs in your system that you can turn using this information,

what's the point of having the information, there's nothing you

can do to change your response to the threat? Because, you

know, the particulars of the threat?

Okay, that that helps. I guess I was

approaching it from the perspective of a developer of

solutions,

correct? Yeah, correct. There, you do need to be aware

of what's going on in the world. And one of the things that's

actually different about my role in SineWave compared to my role

in the government, is my focus has really switched from how is

cybersecurity from the consumers point of view rather than from

the developer's point of view? And that's been a different an

interesting change in thinking.

Interesting, and I think this is a great

opportunity to to share with both the user and the developer

community, some words of wisdom, for instance, if I'm a developer

listening in on this conversation, what should be

some focus areas to develop new technologies? And say, I'm a

consumer of these technologies, how should I approach

cybersecurity governance? And I know these are very broad

questions, I'll let you take it whichever way

a couple of paradigms or topic areas that I think have a

lot of promise that if I were developing technologies, at this

point, I would be concentrating in those areas. I think Zero

Trust is a hugely important insight, a concept that's been

around forever. But now, computation is quick enough that

you can actually readily carry out the kinds of activities

needed to make sure that if somebody's coming into your

system, they're supposed to be and that when they're in your

system, they're doing things that they're supposed to have

access to. So I would, I think there are many exciting Zero

Trust technologies ranging from the network layer, up through

the application layer. And I think that area is really

important, and is an attack agnostic in the way I think it

ought to be. The other thing that's exciting to me is Context

Aware security, as we were less mature in our understanding of

security and security policies, we often had to make decisions

that were sort of all or nothing, there was no nuance to

the execution of controls, security controls on our system.

And that led to some unfortunate situations, there was the

Facebook hack, where they were down for many, many hours

because their security controls made it difficult for their

resilience people to come back in and bring the system back up.

And and so when you have these very draconian black and white

choices, it's the only ones available to you can often be

problematic. So I think, Context Aware security where you can be

much more nuanced in what you allow, and why, looking at more

features to determine whether this activity is one you want to

permit or not, I think that's very important as well. And I

think over time, as we start having more machine to machine

communications that we want to secure, for example, we're going

to need the policies to really be robust enough to handle

operational situations that aren't always the same, and that

black and white doesn't always work for it. I think there's

still some, the hardware layer is always I don't know, seems

always to be the least covered in most people's investments in

cyber. And in some sense, that's problematic, because the more

foundational you are, the better. In some face, I think it

kind of makes sense because hardware attacks are often close

access and beyond the realm of many over the wire hackers, and

so maybe they're not so important for the average user.

I think blockchain and AI this I'm a little ambivalent about

blockchain, I think it has a lot of promise for data provenance.

Unfortunately, I haven't seen it been used yet in a way that

delivers on that promise, I remain optimistic that it will

end up being an important part of our solution space, but I'm a

little worried as to why it's taking quite so long to find its

way. There's some stuff as a consumer that I would in general

worry about, for example, a lot of people are selling behavioral

analytics and AI and they're selling it in language that

makes it sound like the decisions that come out of these

systems are one you can rely on and act on. And what's not often

spoken about or well understood with cybersecurity artificial

intelligence, is that artificial intelligence is probabilistic,

at best, right? It can be completely right, it can be only

right to a certain percentage. And in some percent, some cases,

those percentages are quite high. But in some percentage

cases, they're really not. And when people want to take actions

on these probabilistic measures where the confidence measures

are not clearly understood or displayed by the technology, I

think you can get into some very, very bad situations. I've

seen some insider threat situations in particular, where

people use these probabilistic approaches and say, Oh, this guy

has been coming in late at night or he's printing from an unusual

printer and stuff like that. And then they start opening security

cases on these individuals and can be quite life disrupting

when it turns out the probability of those things

meaning you are a spy or meaning you are a hacker is in the 70

percents right? So it's going to be wrong a lot. And I think as

we start doing these more disruptive actions based on

these conclusions, we have to be a little more careful that the

people taking these actions really understand the confidence

in those kinds of conclusions. So for that reason, I'm very

leery of many of the behavioral analytics and AI technologies

that are coming out now. The other thing that I think

consumers or users need to think about is, what are they shaped

like, right? Do they can they have if the technology assumes a

security operation center, and they don't really have people

that can look at all of this data and make sense of it,

that's not a technology they should buy, right? If the

technology assumes a level of expertise in their own company

that they don't have, they should not be looking at those

technologies as things they should deploy. And it may be

that the other solutions are simpler, but they they are more

appropriate to use in their setting, because the chances of

error are much, much lower because they match what the

company is structured as in what their security knowledge

consists of. So I think and then the final thing I want to say on

this is users ought to know when less is more, there are a number

great insights. And you've shared so

many things that I'm excited about. So I want to pick up on a

of partial technologies, things that address this or that

few things and share my two cents. First, you're so right,

individual cybersecurity problem. And the thought as you

that there's so much out there by way of technology solutions.

buy a bunch of them, and then magically, they all work

And we are getting swamped and inundated with new names for new

together to come up with a holistic solution, but they're

types of attacks. And it is very hard for even for reasonably

working together is often problematic. And the holistic

sophisticated professionals to organize these different types

solution often still has gaps. And the individual problem may

of attacks under categories and try to see the big picture like

be actually solved by something else. So for example, ransomware

how would I map these attacks, to the different types of

is malware with an encryption payload rather than a steal your

vulnerabilities and the tools associated with the

data payload, if you had strong malware protection, you don't

vulnerability. There has been some mapping, I'm privy to that,

need additional ransomware protection, because the problem

but it is very, very confusing. It is very technical. And when

with ransomware is that malware got into your system, and that

somebody is buying or investing in new technologies, and there's

it shows to encrypt rather than steal, doesn't mean you need

gonna be people who will not have this kind of a background,

something different to fix it. And so I think people need to be

or may not afford to have the expertise to filter through what

careful to understand when risks that sound very, very different

the vendors are offering. There, the suggestion that I have, and

in their effect, are actually are the same in their cause, and

I think it is in sync with what you're saying is let the vendors

provide you in writing, what their solutions can't do. What

that their solution space needs to address the causes and not

they are not promising. And how is that significant or

the effects,

I want to add to what you just said, which I agree with

insignificant from their assessment of the company and

talking about company assessment, you're so right when

100%. And I think it's particularly interesting when

you said just don't keep buying technologies because your

competitor has them. You should have them you read about about

we're going into sort of an enterprise that already has

it, understand your organization understand your needs, it goes

back to technology 101. Like, again to quote you, you said

significant cybersecurity investment, ie some of these new

less is often more I couldn't agree with you more, and the

world of general technology implementation. I like to share

technologies, some of the zero trust, for example, actually

my perspective that if possible, you're better off investing in

one or two platforms as opposed to having 1520 different

render obsolete a ton of the stuff that people have already

solutions because now it becomes a coordination challenge

coordination nightmare, a maintenance nightmare. So the

bought, and enable you to take a fresh look at your architecture

extent to which you can simplify your solutions the extent to

which you have greater clarity on what do you mean by

cybersecurity defense in the context of your organization.

and perhaps jettison a number of tools you have in your

And once you have that clarity, evaluate the vendors evaluate

the solutions, see what fits best. And finally, it's not

inventory. One of the things I worry about is that CISOs don't

enough just to buy the tools, look inwards and see is the

organization ready. From a from a people standpoint, from a

do that often enough, they don't look at their system and say,

process standpoint, you will agree that going back to the

people process technology framework, they all need to fit,

All right, now that I have this other opportunity, this thing

you can have a great technology, but you don't have the right

process, you don't have trained people end result is not going

can go away. They're afraid to look like they made a mistake if

to be great. So to find that balance requires some planning

requires some reflection require some thought, as opposed to just

falling for a pitch. So that was great, you covered a lot of

they argued for this $300,000 piece of technology, and now

very, very interesting and important ground. So moving along.

they're saying, well, we can get rid of this 300,000 piece of

technology, people would then say, Well, why did you make me

buy it in the first place, it's only been two years, because

what's the issue here? And so I think we need to get a different

kind of technical integrity and the decision making on this

space, realize the space is evolving and realize that

revisiting and changing is not indication of error, and that we

need to be brave enough to just do that.

Absolutely. You have to manage expectations.

From a CISO standpoint, that means you have to be able to

educate, inform socialize your leadership team and prepare them

for what you just said that yes, I might come to you asking for

money to invest in certain technologies. But do remember

that it's quite possible that in a matter of a year's time, or

even less, these technologies might be obsolete. And we might

have to think about investing in something else. That's the kind

of world we live in, it's a kind of an informed risk that we need

to take. I think the word here is informed risk. Yeah, because

like you said, just like with AI solutions, there is a

probability involved. Similarly, with human decision making, we

are making decisions based on the information that we have, as

long as we've made a reasonable effort to get our arms around

the issues and make informed as opposed to chaotic, impulsive,

reactive decisions. I think we are a little better of I don't

know if we have this one ideas approach, an ideal solution. But

I think the message that I'm picking up from you cutting

through the technical aspects of it, is you have to be very

deliberate, you have to be very thoughtful, you have to involve

the technocrat as well as the business person. So offer both

the perspectives and then look at it from a holistic

standpoint, develop an integrated view, as opposed to a

siloed approach to things. So moving along to a question that

is very close to my heart. I imagine a day, and I'm sure many

do. Where humans don't have to worry about knowing the do's and

don'ts. Will there ever come a day when I could be as carefree

as possible? And click on anything I want, knowing that

there is technology that will not allow the perpetrators to

exploit that and do damage? Will we ever get to that world?

So I am optimistic that technologies exists are under

development that will enable the system to take care of itself,

even in the face of user error. Now that said people should

always be responsible and don't Don't be, yeah, don't be

foolhardy. But I think it's unreasonable to say all right,

let's do fishing training. So people will recognize that this

is a fish Should a message. Phishing training is not all

that successful, attackers get more and more clever about

making messages look like legitimate messages, people are

often in a hurry, the boss wants this now, and they're not going

to stop and parse the the front line to make sure it's a L and

not a one. So I think it's unreasonable to put the burden

of reducing fishing on fishing education, I think there are

technologies that can do that parsing for people, and so on

and so forth. But apart from that, as I spoke earlier, if you

architect your system in a way that even if the credential is

stolen is not useful, the fishing won't be as problematic.

And there's there's lots of things that talk again, about

zero trust technology that even if somebody got in, they can't

move around, or they get in, they're recognized as bad, and

they're stopped from executing. So So I think there are going to

be technologies that let the system protect itself, I think

part of what we need to do is stop expecting the user to be an

element in that protection. And we have to stop thinking that

there has to be humans in the loop, roll these security

decisions, and get comfortable with the notion of the system

protecting itself. And not that every security block that every

action block needs to have a human okaying it so long as the

human is in the loop like that, then we will have technologies

where this has been protect itself, because there'll be this

time lag in which bad things happen. And and you can't

overcome that. So I think yes, as these technologies develop,

as people become more comfortable with the notion of

self protecting self healing system, we will be able to take

some of the burden off the users. And now we should

certainly take the blame off the users. But it just doesn't it

doesn't make sense. It's it's hard to think that that putting

them at fault, does you any good.

True, very true. You want to be able to

take the human element out to the extent possible. Otherwise,

it's a never ending problem. Because you can train you can

make people aware, but then people will forget, and then you

have to retrain. So the extent to which, like you said, we can

develop self healing systems, self correcting systems, self

fixing systems, whatever the appropriate word is, which is

where I think a lot of development is taking place as

well. I think that would be a welcome. Welcome improvement,

welcome change. So from the standpoint of technology

development, it is a given that you want the best resources

involved, if you just left it to the private sector, they would

innovate, often to the detriment of society. That's where

government comes into play rules and regulations come into play

to lay some ground rules. At the same time, the government is

able to do things that the private sector cannot, what is

your assessment of the partnership, in terms of where

we are and where we should be?

So I think it's interesting that because there's

a lot of new initiatives in terms of public private

partnership in place, and and certainly the awareness of the

need for this kind of interaction is heightened these

times where it seems to be working well as in what I would

call forensics situation, something happened. And the

government helps the private sector figure out what happened,

what are the characteristics of that attack? How could they

prevent it, and so on. And I think that's important

collaboration and a fairly effective collaboration, then

the government could disseminate warnings or papers that describe

these conditions, and so on the flip. The downside of that,

though, is that's a very attack centered way of working. And as

I said earlier, I think that that way of working is really

long for the world. And I think for the security community, that

collaboration is viable and important. I think for the user

community, that collaboration doesn't have as much impact.

Another type of collaboration that I'm quite familiar with is

such collaboration or development collaboration. I

think that's usually important. As I stated in passing earlier,

the government is often in a position to do research, that's

longer term where the payoff is more uncertain, where you don't

need to get to a bottom line to revenue and within three years,

the industry just can't do and I think recognizing the enabling

ways for the that government investigation to translate

effectively into the private sector is very, very important.

I think there are initiatives to involve academics or commercial

people in actual government research. And I think those

provide some transition paths that are quite valuable. And I

applaud that and think there needs to be much more of that

there are activities to have government employees embedded in

companies to learn how the problem looks from the

commercial point of view. And similarly, I think that kind of

research and development collaboration is extremely

important. One of the issues that I was involved in and, and

and changing my mind about actually is the issue of

government guidance for normal for for enterprises, or small

medium businesses or users of any type. And the government is

very, very smart and knows a lot about that guidance, and has a

lot of processes in place to get good input from commercial

sector. On that guidance. The NIST framework, for example, had

many conferences in which people collaborated on what this

guidance should look like, and what are the controls that

matter? And and what are the levels that make sense. And I

think it was greatly enriched by that commercial involvement in

its formulation. However, the government has fairness

requirements, and requirements that keeps them from from saying

anything that will block innovation, that leaves that

guidance at quite a high level. So I think the NIST framework is

right. But for many people, it's kind of difficult, if not

impossible, to actually use to, to help them making concrete

decisions. So I think there's a step, a collaboration step

that's missing from the statement of the initial and

that, and again, for the fairness reasons, and you can't

stop collaboration reasons. That's right, you don't want

this to come out with saying, for control number three, you

need to need Joe Schmo has encryption mechanism, because we

know it works, because that's giving Joe Schmo an unfair

commercial advantage. And that's saying that the only thing that

will work here is encryption. And if some new method comes out

in the future, that will work just as well as encryption, it's

proscribed wouldn't meet the sort of standard and guidance.

So you have to keep these things in a way where you allow for the

inclusion of new technologies into comply with the standards,

even when you have not yet imagine those new technologies

and to avoid picking winners. So that leaves this this

translation space, that I think in the formulation of the

framework, this was the lead and the commercial people provided

contributions, perhaps as this other stage where the commercial

people, the various industry segments, interpret that

guidance and make it more consumable for individuals. So I

think a government it certainly has the expertise and the

wherewithal to think seriously about these problems in a

foundational way. But then getting that foundational

understanding translate into pragmatic solutions is a place

where both in terms of tech transition and interpretation of

guidance, I think some work is needed. Yeah, I guess I'll stop

there.

sense. It makes a lot of sense, you've

again touched upon many points. And as you were speaking, it

kind of dawned on me, that we're really talking about, and it's

probably a bit of a philosophical note, we talked

about this important tension, between complexity and

simplicity, to solve problems of the magnitude that we are

dealing with in the cybersecurity space. These are

complex problems that often require complex responses.

However, the communication of it, like when you say, the

prescriptive part of it, to be able to filter down what needs

to be done contextualize it. That's another skill set that is

so important. Because what's the point of making 112 guidance or

recommendations about controls? Some people will just look at

the enormity of it and will just say, Well, I don't think I have

the time to go through it. I'll just go and hire somebody and

get them to give me some quick suggestions, or what are the

basic things I can do to protect my organization, I don't have

the time to go through those 115 guidance or recommendations. So

that's where we need some expertise to help contextualize

the recommendations. And I know that CISOs and CIOs play that

role. They get the details and then they filter through it and

then they try to implement what makes sense. So that's kind of

my two cents. We are coming to the end of our session here.

I've been really enjoying it. So that's too bad that we have to

call it for today. But I'd like to give you the opportunity to

conclude the discussion with some final thoughts, some key

messages for the listeners.

Yeah. So I guess and you you were coming at this, I think

in the comments you just made and comments you made earlier,

when it comes down to it. Really what matters is that people

think critically about their system and their problem space

and their solution space. And it, yes, there there are ways in

which their situation is similar to others. But there are ways in

which their situation is different from others. And they

need to not get caught up in marketing. So much as in a

decision making process that's driven by an understanding of

what they do, and what they need to protect, and what their

system is structured like, what their skill levels are, and

really thoughtfully choose their solutions, with that

understanding of their starting point in mind. I think this

return to understand solutions that are based in your system,

and not concentrated on what the attack looks like, but what is

my system and more importantly, my my business workflows, what

do they look like, and build solutions that protect them, and

not solutions that are based on external threat conditions, I

think there's a lot of promise, despite the fact that there are

still a number of breaches, I think the technology has come a

long way. And people are are beginning to think, to be much

more security aware. It's a big disparity between where

enterprises are at and where small and medium businesses are

at. And so the ecosystem can have a lot of bad things

floating around in it, just because a lot of users are just

simply not security aware at all. There's no security,

hygiene in huge parts of the ecosystem. I certainly see the

interest in using security solutions moving way down to

smaller and medium sized businesses. And I think that

will actually be a big help too, and that the whole ecosystem

will be healthier, as more and more of the users begin to

become security aware.

Fantastic. That was terrific. Thank you

again for your time. And as I said, I look forward to many

more future discussions with you.

Excellent, thank you very much, and I really enjoyed it.

A special thanks to Pat Muoio for her time

and insights. If you liked what you heard, please leave the

podcast a rating and share it with your network. Also

subscribe to the show, so you don't miss any new episodes.

Thank you for listening, and I'll see you in the next

episode.

The information contained in this podcast is for

general guidance only. The discussants assume no

responsibility or liability for any errors or omissions in the

content of this podcast. The information contained in this

podcast is provided on an as-is basis with no guarantee of

completeness, accuracy, usefulness or timeliness. The

opinions and recommendations expressed in this podcast are

those of the discussants and not of any organization.