#93 Matt Holland: Zero Day

Matthew Holland is one of the world’s leading authorities in cyber security. He explains exploits, hacking, and defending while providing insight on the mind of the attacker, Huawei, Snowden and what you should be asking your cyber security vendor. -- Want even more? Members get early access, hand-edited transcripts, member-only episodes, and so much more. Learn more here: https://fs.blog/membership/ Every Sunday our Brain Food newsletter shares timeless insights and ideas that you can use at work and home. Add it to your inbox: https://fs.blog/newsletter/ Follow Shane on Twitter at: https://twitter.com/ShaneAParrish Learn more about your ad choices. Visit megaphone.fm/adchoices

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Speaker 00

  It's that going to the doctor scenario when you have a pain, you don't want to necessarily find out what it is because you know, people are naturally averse to bad news. You can't be like that with cybersecurity. If you don't have a cybersecurity vendor, if you don't have a company helping you out with that problem, get on it. Everybody is a target at this point. Your company is not small enough to be off an attacker's radar. I have seen five person companies. Actually, I've seen two person companies attacked and hit. So, you know, my, my advice is don't be, don't be afraid to, to ask for help.

• 0:52Shane Parrish?

  Hello and welcome. I'm Shane Parrish and you're listening to the Knowledge Project. This podcast and our website fs.blog help you sharpen your mind by mastering the best of what other people have already figured out. If you enjoy this podcast, we've created a premium version that brings you even more. You'll get ad free versions of the show. You won't hear this, early access to episodes, transcripts and so much more. If you want to learn more now, head on over to fs.blog/podcast or check out the show notes for a link. This week I'm talking with Matthew Hallman, the founder and CEO of Field Effect Security. For the past decade, Matt's been the guy that every three letter agency in the Western world has called when they have a problem that they can't solve.

• 1:34Shane Parrish?

  Before Matt started Field Effect, he enabled allied governments to pursue their lawful mandate. This episode is all about cybersecurity, exploits, hacking and defending. And while this is a world we all hear a lot about, rarely are the people talking as knowledgeable and informed as Matt. In fact, I'd say he's one of the top three in the world at what he does. Let's dive into the mind of an attacker, what's possible, and what questions you should ask your cybersecurity vendor. Along the way, we'll talk about Snowden, what it's like to work at an intelligence agency, and of course, Huawei and national security. It's time to listen and learn.

• 2:15Shane Parrish?

  So I've known you since, what, 1999 we met?

• 2:21Speaker 00

  Yeah, around then, yeah.

• 2:22Shane Parrish?

  That's crazy.

• 2:23Speaker 00

  Yeah, world.

• 2:25Shane Parrish?

  We used to work together at the intelligence agency.

• 2:28Speaker 00

  Yep.

• 2:28Shane Parrish?

  And then that was the most insane period of time ever, right? We're in this small team. September 11th happens, the world forever changes. Our team works nonstop for effectively seven years. Like, I don't remember any of us having vacation from 2001 to 2008, other than like a random Monday or something.

• 2:52Speaker 00

  Yeah, I mean, firstly, I think vacation is probably largely overrated just because I'm a workaholic. But yeah, no, it was a really neat way to start. I mean, our career is just a year or two apart, but it was definitely a very interesting experience being thrust into an environment where everything you do contributes much more than you would ever think. Because coming out of university, you know, you want to get a job with a good salary. All of a sudden, you're, in our case, we're doing things that actually matter to the country that have a very significant outcome. And it's like going from zero to mature very, very quickly.

• 3:30Shane Parrish?

  Overnight.

• 3:31Speaker 00

  Yeah.

• 3:31Shane Parrish?

  Yeah. I remember one of the first meetings I had with you. We were trying to figure out how something worked and I stood up, you know, in my university sort of bravado. And I was like, oh, I'll tell you how this works. And then I spent like 30 seconds explaining this thing. And then you looked at me and just deadpanned like, you're absolutely wrong. Here's how it works. You stood up and for 45 minutes, you worked through like every instruction that happened in the operating system. And I was just blown away by your level of knowledge.

• 4:01Speaker 00

  I mean, that's kind of you to say. There's probably a factor of blown away at how much of a jerk I was in the process of that, which. I'd like to say has changed, but probably not so much. But yeah, it was, it was a really, uh, it was cool. I, I think the environment that we, we got to work in was learning from people. The, uh, you know, for me, that, that time in my life really defined what a good team was. You know, when you learn something, you share it with other people in the office. I, I remember, you know, there was five or six of us in particular at one point where it was a very large research focused group. And anytime you learn something or I learned something or one of our colleagues learned something, it was a really neat discovery, but we took the time to educate each other.

• 4:43Shane Parrish?

  Yeah.

• 4:43Speaker 00

  And I think what that fostered was a team that, you know, a level of trust that I had never experienced in my life. I, I remember, you know, entering that team, being massively humbled. And, you know, once, once the ego got dealt with, uh, and you could really jump into that environment. It just, it catapults one's growth and, and I still look back to those times and, and consider myself extremely lucky. And I guess always acknowledge that, that, that time in my life largely defined who I am today.

• 5:13Shane Parrish?

  I want to come back to that in a second. I remember it is weird to hear you say it's sort of like you were humbled. You are literally the best in the world at what you do. And we're going to come back to that through this interview.

• 5:24Speaker 00

  Is it drinking whiskey?

• 5:26Shane Parrish?

  Pretty good at that too. I remember showing up like you used to drive me all the time in your Mazda. What was that the?

• 5:33Speaker 00

  It was MX six buddy.

• 5:34Shane Parrish?

  MX six.

• 5:35Speaker 00

  That was, that was the.

• 5:36Shane Parrish?

  Smelled like toffee nut latte.

• 5:37Speaker 00

  Yeah, no, that was the, that was the dream cybermobile.

• 5:41Shane Parrish?

  We spent a lot of time together. What made you leave?

• 5:44Speaker 00

  So I, I, I reflect on that quite a bit, uh, just because I get that question often. And I, I don't think I've ever really had a good answer that, that wasn't necessarily immature. The ultimate reason I left was because I, I saw a limit to what I could grow into and what the vision of the group I was in achieving was. Like there, there was a ceiling arbitrarily put on top of that. And I'm the type of person that I, I don't work well when somebody says this is as far as you can go. Or this is what we're going to do regardless of what the evidence, uh, or ideas or good ideas, bad ideas, whatever. That that stopped and it was not an environment that I said, I can grow here anymore.

• 6:27Speaker 00

  One of the big indicators of that, which you probably laugh at this, but there's a there's a management competition. I screwed up the entire, the entire interview, but it was the same problem where somebody would ask, you know, the interviewer would ask me a question and rather than give the answer of, you know, I would, I would build a team to do this. I would request funding to do this. I would, you know, reach out to universities to bring them into the, into the fold. So, you know, that's the answers they wanted to hear. What I gave them were the technical responses to the questions they were asking. So how would you solve this problem?

• 7:02Shane Parrish?

  Yeah.

• 7:02Speaker 00

  My answer was, well, I would do X, Y, Z, and then I would do this.

• 7:07Shane Parrish?

  You didn't play the game.

• 7:08Speaker 00

  No, it was just, I answered the question. And I think that was the first time it really dawned on me that I probably don't fit into the mold that they were looking for. So I think that's when I started to, I guess, the, the ball started rolling on my departure.

• 7:24Shane Parrish?

  I remember it changed probably about eight months before you left. Like it started to get more, I don't know, I don't even know how to word this. Like when we started, it was very fast moving. We had a lot of authority, a lot of control, a lot of decision-making power. And then slowly, as we became more successful, the irony is like that sort of became less and less over time.

• 7:48Speaker 00

  Yeah, I remember having a conversation with one of our mutual colleagues at the time, and I remember being very irritated about the, you know, the arbitrary handcuffs that were being put on our ability to innovate. Research, you know, I remember a contentious time that you and I actually, you know, stood up at a town hall and got in a giant argument with a director.

• 8:08Shane Parrish?

  Yeah, Stu, if you're listening, we're sorry.

• 8:11Speaker 00

  And it was, it was very frustrating. And I remember that colleague saying, this is just part of business, man. Like, once you, once you're part of a group that does something really good and, and people take notice and they, you know, they want to turn that into a larger part of the organization. And with that comes what you're seeing now, you know, formalized, you can't work more than this, you have different reporting responsibilities. And, you know, at that time, I just, I just wanted to innovate. I just wanted to come up with new solutions to the problems that operations were running into. You know, not being able to do that in its raw form was extremely frustrating.

• 8:47Shane Parrish?

  So you left and we can't talk about what we did there, but we can talk about what you did right after you left. And so you started Linchpin and you you had an unconventional sort of way of of starting that company, which is releasing a privilege elevation to get some attention on Microsoft. You want to talk about that?

• 9:07Speaker 00

  Yeah, so that was a that was a funny period. So, you know, at the time, my business partner and I, we we thought, you know, how can we make a splash? Because when we left, you know, our attention was to, you know, augment the world that we left with, I guess, a privatized twist on things. So we thought about, okay, how can we how can we really stir things up a bit? And at the time, Microsoft was releasing mandatory driver signing as part of Windows Vista, which is showing our age right there. And, you know, there's so much hype around it. And the way it was being advertised, it was going to be the silver bullet to stop all malware, to stop, you know, anything bad that could be happening. And anybody who has spent any

• 9:48Speaker 00

  time, I guess, on the offensive side of the house, you know, was looking at that and saying,

• 9:54Shane Parrish?

  No, that's bullshit.

• 9:55Speaker 00

  Yeah, it'll it'll be it'll make things better. But it's not going to be the silver bullet that everybody thinks. So we said, all right, well, why don't we just do something kind of funny and, you know, show them. So what we did was we wrote a tool called Den Whip Aziv. The name of the company was Den Whip Aziv, which is Vista Pund in reverse. You know, got a signing certificate under this fake company legitimately registered fake in reality, and released a tool that would load it was a signed component that would load an unsigned driver. And it was not to do anything other than show how easy it is with the most simplest goofiest approach to get around this problem. And so at the time, I was in Australia with my business partner, starting things up. We were working

• 10:39Speaker 00

  out of a closet, really kind of a ragtag setup to start. And at the time, there were people being arrested for violations of the DMCA Digital Millennium Copyright Act, which, you know, back at that time, was a really contentious thing because it was changing what people could or could not do with computers. And it was it was a really big deal.

• 11:05Speaker 02

  How do I negotiate so many great travel deals? My greatest gadget, the Priceline app. It's got hotel deals, flight deals, rental car deals, all of those deals in a bundle. Deals, game day deals, concert trip deals. No one deals more deals than Priceline. Hold your horses, there's more. The app lets you filter hotels by neighborhood, vibe, star level, and amenities like pools and spas and beachfronts. Wait, I'm not done. Stop cutting me off.

• 11:32Speaker 03

  This episode is brought to you by Tic Tac. Lace up and get your game on because the Tic Tac lineup just got a new teammate. Dr. Pepper Tic Tac. This new double threat puts two of your favorite flavors into one box of mints. And when two iconic flavors come together, the result can only be iconic. Score big. Try Dr. Pepper Tic Tac today.

• 11:55Speaker 00

  So when we released that, some people were like, oh, that's kind of neat. And other people are, you know, one person in particular was like, this is a violation of the DMCA. You should be arrested. P.S. It's not really that cool. I'm going to go and release a tool that actually exploits ATI drivers and Nvidia drivers. And then basically does the same thing, but I've done it a lot cooler. So take that linchpin, ha ha.

• 12:20Shane Parrish?

  Right.

• 12:21Speaker 00

  And in reality, that, that was-

• 12:22Shane Parrish?

  I remember that guy.

• 12:23Speaker 00

  Yeah, that was so much worse because, and I don't know if it actually resulted in the revoking of ATI and Nvidia's signing certificate, but it was something that, you know, to us, it was-

• 12:36Shane Parrish?

  It was over the line.

• 12:37Speaker 00

  It was, well, it was stupid to say that we were violating the DMCA. And two, the response was just so much unbelievably worse. And it was a very weird first few months of the company.

• 12:47Shane Parrish?

  Do you ever miss sort of working at the intelligence agency?

• 12:52Speaker 00

  I miss people. I miss a lot of really good people.

• 12:55Shane Parrish?

  Amazing people. It's a very underrated. People think that all sort of like government employees are lumped in the same, same group. They're not, as we can both attest to.

• 13:06Speaker 00

  Yeah, so I miss the people. I miss having firsthand exposure to the mission. You know, I think back to some of the things I got to see and be a part of that no one will ever know about. And that- It was really cool. It was really neat being a part of that. It creates memories that I'm pretty sure if I were to run into somebody 30 years from now on the other side of the world in a bar, you know, immediately there's that connection of like, hey, we did that. That was really cool. So yeah, I mean, I miss Aspects, but I don't miss the handcuffs that were ultimately a part of my departure from there.

• 13:39Shane Parrish?

  And then when you left, do you ever feel like there was, they didn't want you to succeed because they wanted you to come back? Was there a part of you that felt like they didn't want to give you contracts? They didn't want to?

• 13:51Speaker 00

  I don't know if there's any, any interest in me coming back. I think there was definitely skepticism as to whether I could succeed, which it's, I'm, I'm fine with that. I mean, you know, clearly at the time, my business partner and I were the first ones to kind of make that jump and do that together. And there was a lot of skepticism as to whether we should be allowed to do that, whether we are able to do that. I remember having a departure interview with a Hyatt manager who sat me down and said, you're going to go sell to China. You're going to enable China. And I looked at him in the eye and I said, what on earth would make you think I would ever do that? That is the most ridiculous thing ever. So, so I think there was a bit of fear that we would enable,

• 14:35Speaker 00

  you know, adversaries of allied countries, which yeah, I mean, in retrospect, I can understand. I just think at the time it was a, it was an immature view.

• 14:44Shane Parrish?

  I remember going to a meeting a couple of weeks after he left and they were like, oh, we're not going to buy anything from him. And I was like, we're going to end up giving this guy like 50 million bucks a year. I want to say I was closer to reality than they were.

• 14:57Speaker 00

  But I mean, so, so the idea of going private was taking the handcuffs off and creating an environment where we put really, really smart people together. Um, you know, part of our recruiting strategy was immediately going after the best people in the community and taking all barriers out of their way and making, letting them do amazing things.

• 15:16Shane Parrish?

  I want to dive into that a little more because you were able to replicate an entire wing of an agency, if you want, you want to say that, with 1/20th the number of people and have higher output. How were you able to do that? You just same people, you just took them out of the environment and what enabled that?

• 15:35Speaker 00

  Largely removing barriers. I mean, I think that was a big component of it. You know, giving them an environment that they could excel in, which, you know, breaks down into what tools do you need? Do you need to put in a purchase requisition to get what you need? Or can I just get that for you? Like, that was one of the comments from one person. I remember early on when they joined, they're like, "Okay, these are the things I'm gonna need to do my job." And I was like, "Okay, I'll be back in 30 minutes. And here's your stuff." And the reaction was, "Really? Like, we can just do this?" It's like, "Yeah, go be a genius. Go produce amazing things." So I think that was a big component. I think making it clear that everything that we were doing was as a team.

• 16:17Speaker 00

  And I think, as an aside, this is one thing I think people who are entrepreneurs sometimes get caught up in that it's about them. It's about their journey. And the way I approach it is, no, we're all in this together. I'm really lucky to have you in the company. And creating that environment where they knew that they were lucky, that I appreciated them, and that whatever we do, we're doing together. I think it's an empowering message to build a team around.

• 16:43Shane Parrish?

  I remember one of the things I took away that I've learned from you is when you started doing that with people and you were like, "What equipment do you need to do your job?" And you'd just go out and get it for them and they were astonished by how simple that was. And that's something we do with everybody here, too. We just sort of like, "What is it you need to do your job to the best of your ability?" There's a downside to that, too, which is really interesting, because then you lose the excuse of, "The equipment's the problem. If only I had the right tools, I could like, deliver," right? Like, so you said, there's this subtle sort of undercurrent to it, which is, "I expect you to be amazing at what you do and keep getting better."

• 17:19Speaker 00

  Yeah, and I mean, I think for some people, sometimes just that belief helps them get there.

• 17:25Shane Parrish?

  And so you did LPL from, what, 2007?

• 17:29Speaker 00

  Seven to 18.

• 17:30Shane Parrish?

  To 2018. What are some of the lessons you learned about growing that? When you ended, how many people were there?

• 17:35Speaker 00

  So globally, I'm going to lump in the partner company that we were sold with. But I think we're at the time, close to 90 to 100. We sold in 2018, but I didn't leave until December of 2019.

• 17:49Shane Parrish?

  I want to, I want to come back to that. But what are some of the lessons you learned from growing, scaling, running that company, recruiting?

• 17:56Speaker 00

  I think, I think one of the biggest things was I, you know, starting a company from scratch. You know, at that time, I, I had a computer science background. I clearly had a lot of experience in cybersecurity. You know, I took some accounting courses and marketing courses in university. So I think there was a bit of a foundation as to, okay, if, you know, I remember doing a business plan because that was one thing you did, you made a business plan. But one thing through the Lynchman experience that I, that I got to have was I got to do every job. So I got to literally be the janitor. I got to be the marketing person. I got to be the primary salesperson. I remember doing really challenging sales pitches in front of audiences that didn't even want me in the room because I was, you know, stamping on their, their creative territory.

• 18:39Speaker 00

  I got to write code, I got to manage projects. I got to be the evangelist in the company. And going from there to field effects with that base, I think allows me to really, you know, make decisions that are more informed. It allows me to, to, I guess, understand and appreciate all the different parts of field effect and that, which is a much more diverse.

• 19:00Shane Parrish?

  We're going to come to field fact in a second.

• 19:03Speaker 00

  So I think, so I think there was that. I think the ability to make decisions and be confident in those decisions, not get caught in, you know, paralysis of decision making. That is something that I think at first I struggled with, but over time, the ability to filter out the noise and focus on the things that actually truly matter have, have really helped.

• 19:24Shane Parrish?

  So why'd you leave? I mean, right before you left, you're the, you're the guy every three letter agency. And basically the allied world would call when they had a problem they couldn't solve. And you would solve it. Why leave?

• 19:40Speaker 00

  I was gonna make a joke about they ran out of problems, but it's gonna be funny.

• 19:43Shane Parrish?

  They didn't.

• 19:44Speaker 00

  No, problem's done. I'll problem solve. Actually, the same reason, I think, and this is actually where I think I realized why, you know, the root factor of why I left CSE is it was a similar scenario where.

• 19:57Shane Parrish?

  You guys got bought.

• 19:58Speaker 00

  Yeah, yeah, but it was a, it was a change in, in what I could do. Was, you know, I started to see a ceiling on what I could achieve. And it became clear to me that, you know, I was the square peg trying to fit into the round hole because of emissions and more creative things that I, that I thought we could do. And that was, that was actually a pretty interesting experience coming to terms that I, you know, I was the, the square peg in the round hole because it definitely took time to, you know.

• 20:25Shane Parrish?

  The hole's not gonna change.

• 20:27Speaker 00

  Yeah, yeah. And you go through this evolution of like, what's wrong with everybody? Why, why is nobody on board with this? And then the realization that, oh shit, it's, it's me, I'm the problem here. And then the, the appreciation of, okay, okay, understanding why that is. And I think that, that ultimately made the transition very easy, actually. And, and it's not something that I look back with at this point with any animosity or anything. It was just part of life.

• 20:53Shane Parrish?

  You exited with more than enough to sort of walk away for the rest of your life and to sort of like sit on a boat in Costa Rica and never have to worry again. And then.

• 21:04Speaker 00

  But there are sharks.

• 21:05Shane Parrish?

  There are sharks.

• 21:06Speaker 00

  Sharks.

• 21:08Shane Parrish?

  But then you, you started to feel the fact, and how many employees are you now?

• 21:12Speaker 00

  Almost 100.

• 21:13Shane Parrish?

  You're almost 100. You're entirely self-funded to this point. So you basically took all this money you made and you were like, oh, I want to do this again. And I'm gonna put it all on the line. Like, what went into that thinking?

• 21:28Speaker 00

  Several factors. I think I really enjoy solving hard problems. And the, the, the current state of the cybersecurity industry, to say it's a hard problem is an understatement. It is a, is a unethical shit show, I would say. And it, it really bothers me where it's at. So I think there's a, there's a large part of me that wants to fix that. There's also the aspect of, I'm like ultimately a serial entrepreneur. And I remember chatting with my wife, like when that transition was happening.

• 22:02Speaker 00

  She asked me like, why are you doing this? And what else am I gonna do? I'm just gonna start something else. And it's either, you know, a cybersecurity company that I'm once again running that I believe can change the world and fix a lot of problems, or I can open a coffee shop. Probably gonna take the same amount of time. So how about the cybersecurity firm?

• 22:26Shane Parrish?

  And how important has she been through this?

• 22:29Speaker 00

  She's amazing. I, I, I don't think I could ever thank her enough. I think the, the, the formula for, for, for my success, she is, she is a huge part of that. She is a

• 22:41Shane Parrish?

  Cause you're a workaholic.

• 22:42Speaker 00

  Yes. If, if you could, if you could sample what makes her run, you know, who she is and somehow create like a vaccine and inoculate the world, like you would have world peace, hands down. And that obviously is, is a strong statement, but she is a phenomenal, anybody who knows her would, would definitely agree with that.

• 23:00Shane Parrish?

  I would agree.

• 23:01Speaker 00

  She's amazing. She is pretty cool.

• 23:03Shane Parrish?

  You mentioned sort of the state of the cybersecurity industry. Talk to me a little bit about that. Where are we? What's it look like? I mean, there's nobody in the world from my point of view, that would have a better aperture into not only how things are, how they're sold, but also the attacker's mindset in terms of what you're buying versus what you're consuming and how it's impacting your business.

• 23:27Speaker 00

  This is the part in the discussion where I get angry.

• 23:29Shane Parrish?

  That's okay. We got a lot of scotch.

• 23:31Speaker 00

  So I, I think to answer that question, the first thing, you know, we need to do is, is look at what the cybersecurity industry actually is, because I think that it gets muddled. The, the way the public looks at it, the way it's reported on.

• 23:45Shane Parrish?

  It's just everything. It's like a grab bag for

• 23:48Speaker 00

  Yeah. So I, I think there's, there's three groups or pillars of cybersecurity. There's the one, there's the offensive side, which we've talked about the The ransomware, the intelligence agencies, I say offensive, but the whole, it's that traditional hacking, which, you know, has largely been glorified thanks to Hollywood. Mr. Robot gets it right, though. I don't know.

• 24:07Shane Parrish?

  I remember in Swordfish, he sits down like 30 seconds later, everything's.

• 24:10Speaker 00

  Yeah, no, it's largely horseshit.

• 24:12Shane Parrish?

  Isn't that how it works?

• 24:14Speaker 00

  With VR goggles, yeah. But if you've ever seen Mr. Robot, that is actually an accurate representation. If you're ever curious, but it is a, you know, it is this glamorized thing that is entirely misrepresented, but it is an economy in itself. There's an economy behind ransomware and they get paid for it. They are successful. There's an economy behind intelligence agencies. That is ultimately what drives it. Dollars and cents. On the defensive side, the second bit, and by the way, the first bit only exists because humans are generally horrible at writing software. So that wouldn't exist if people were actually good at security models and implementing software. The second bit only exists because the first bit exists.

• 24:56Speaker 00

  So that's the defensive side. So let me, I guess the best way to describe it is as a consumer, it is probably the worst experience you could go through. So if you, if you're going to go buy some cybersecurity, are you buying an antivirus?

• 25:10Shane Parrish?

  This is exactly what I want to do. I want to buy.

• 25:12Speaker 00

  Yeah, buy some cyber. Yeah, because that's largely because it's, it's, it's.

• 25:16Shane Parrish?

  We're joking, but yeah.

• 25:17Speaker 00

  It's a black box industry, right? A lot of, a lot of businesses, a lot of people don't know what they're actually buying. And that has been exploited by the industry. And this is the part where I get angry because none of the solutions out there. There, there are a few that are, that are decent, but like, look at what your options are. Do I buy an antivirus? Do I buy any spyware? Do I buy firewall chain? Maybe an IDS intrusion detection system? Maybe endpoint detect and respond, maybe user behavior and analysis, maybe a network monitor. And the way that vendors will try to push it forward is they say, you actually need all of that, which is total crap. You do not need all of those things. They do not work well together. So that, that whole thing angers me to no end.

• 26:02Speaker 00

  The third bit is a category that isn't actually cybersecurity. I read an interesting article recently and it kind of clued me in. I was like, actually, yeah, no, this third thing or pillar exists that is entirely wrong. And it's that bit that happens in, you know, on the internet, social media, that type of thing that isn't actually security related. But people like to kind of put a box around that. So an example would be, you know, election interference. So how do, what are the organized influence influential campaigns on, on social media to, to get people to vote in particular directions? I do not think that's cybersecurity, but that also gets lumped in.

• 26:44Speaker 00

  So that, that is the third bit, which is kind of like faux cybersecurity.

• 26:48Shane Parrish?

  It's a little bit confusing because then you lose track of what's actually happening. But I mean, intelligence agencies have been spying on other countries forever. One of the things that have changed now is not only the amount of consumer data and the value of that data, but also that people are spying on companies now as it means to fast track their R and D.

• 27:07Speaker 00

  Yeah.

• 27:08Shane Parrish?

  Why invest hundreds of millions of dollars when you can sort of like just hack into somebody else's computer and download all their work and then claim it as your own?

• 27:17Speaker 00

  You know, I mean, it, it highlights why, you know, people, companies need to take this, this problem seriously. And I don't think it necessarily extends just to large companies at this point. Legal firms, accountants, huge targets, huge targets. I mean, you, you think about what they're dealing with in regards to confidential agreements, financials of individuals and companies. And that's one thing I think we've seen over the last couple of years is the, the attention that state sponsored groups are going after. It's no longer, you know, the Sonys of the world. It is now your, your, your law firms, because there's a lot of intelligence value there. Patent firms, I mean, there's a lot of intelligence value there. So the.

• 27:58Speaker 00

  You know, how seriously smaller companies need to take this threat, I think, has really gone up.

• 28:04Shane Parrish?

  I find it super interesting. I mean, I was talking to KPMG just last week and they were like, oh, send me this. And I was like, how do I send it to you? And they're like, just put it in an email. I was like, what, what are you talking about? Like, I'm not putting that in an email.

• 28:17Speaker 00

  Yeah.

• 28:18Shane Parrish?

  I sort of compromised with like, I used quickforget.com and like uploaded something and it's like, this is good for like six hours. So you better download it. But it's amazing to me that the lack of thought that goes into the information you share and how that manifests itself or what's exposed, right? Because if somebody breaks into that computer, that whole email chain's there. Now, the file's there already, but the, a lot of the emails stored in the cloud, it's a lot easier to access than people realize. What makes you want to tackle this problem? Like, this is like the greatest intractable problem ever with tons of competition, like the government's doing host based, you have private sector doing all of these things, cobbling together solutions.

• 29:02Shane Parrish?

  Like, what makes you think that you, you can have a better outcome for customers?

• 29:08Speaker 00

  Probably arrogance.

• 29:12Speaker 00

  A joke, but that's probably.

• 29:13Shane Parrish?

  I mean, nobody knows the industry better than you do, but like, seriously, there's billions of dollars going on here.

• 29:20Speaker 00

  Yeah. So, I mean, if we, if we look 20 years ago, it's the same problem. Well, one of the things I tell people when they join who, you know, when I hire from intelligence agencies is that be prepared to be disappointed because the problems that you are going to see will shock you that, you know, that they're still out there. So the techniques that are 10 years old are the problems that should be 10 years old are still happening today. And, you know, I think that is, that's a large referendum on how not good the cybersecurity industry is at actually trying to solve the problem. And if, and if I look at. You know, the vendors out there, I'm not going to name any specific competition,

• 29:59Speaker 00

  but what I see is a sales strategy that is like a warped used car salesman strategy. And that's probably an insult to used car salesman out there because it's it's much worse. It's it's all about the transaction. It's all about, you know, getting getting that done, taking the customer's money and saying, good luck. And that isn't resulting-

• 30:20Shane Parrish?

  We're not responsible for anything.

• 30:21Speaker 00

  Yeah. And and that's not making anything better.

• 30:25Shane Parrish?

  How should that work? Like, how do people buy cyber? Isn't it the? I wasn't on sort of like the acquisition of cyber side, but like this Gartner quadrant? Does that sound familiar?

• 30:35Speaker 00

  Yeah, yeah. So that is, I guess, a measuring system, a measuring stick to help the vendors or customers or prospective customers, companies, I guess is a better term, to, you know, guide them in buying what they they may or may not need. There are a few problems with that. The Gartner quadrant system is often outdated. We we were, for example, field effect was marketing a managed tech and response service well before it was defined in Gartner. And ironically, at the time, we had a hard time, you know, gaining traction.

• 31:05Shane Parrish?

  Because that's always looking at like existing sort of technology and threats and looking backwards, saying like, oh, these people accomplished this, but not looking forwards in terms of where the industry is going.

• 31:15Speaker 00

  Yeah, so so that that, you know, that that is a it is a useful classification system. It is just behind the curve continuously. The second thing is, I don't think businesses actually necessarily know what they're looking for.

• 31:27Shane Parrish?

  Yeah, like, how would you be educated? If you're like a law firm, an accounting firm, you get 100 employees, you don't have like a cyber guy or girl and you like, how do you? How do you go about doing that?

• 31:41Speaker 00

  So so, I mean, that's that's ultimately the the realm that, you know, field effect sits in, the the small to medium business space, because, you know, it is infeasible for every company to have an IT team. And in our experience, I mean, an IT team is good. They have expertise, but they may not necessarily be, you know, security experts.

• 32:01Shane Parrish?

  Is that kind of like Shopify for cybersecurity? Because Shopify is really arming you. You don't have to worry about building a store. You don't have to worry about managing inventory. You don't have to worry about that. They're arming the rebels, if you will, against Amazon. Like, are you giving world-class technology to? Small and medium sized businesses as a means to like, you don't really have to know all the ins and outs of cybersecurity, but then it becomes trust based. Like, why would I trust you over another vendor?

• 32:30Speaker 00

  Uh, that's a great question. I mean, I think trust takes time. You don't just magically get trust right out of the gate. And I think that is a, that is something we put a lot of time into building. We take time to create a customer relationship, ask customers what their needs are, what are their problems? And then, you know, tell us about your network. How can we help you? And, you know, early on in that process, I think it becomes clear that we're not just out trying to sell software in a commoditized way. The first thing we do is do an external view of the network and identify, okay, here's a problem right here. We want to help you fix problems. It's not just here is a solution that you have

• 33:11Speaker 00

  to run with. It is all about us helping you be better, fixing problems and sustaining that moving forward. And that is largely a component that I don't think most vendors in the cybersecurity industry get. They are more interested in showing you, check out this really cool interface, which, you know, no one in your company is probably going to know how to use.

• 33:31Shane Parrish?

  And then if you don't see something, it's like, oh, it's not our fault. It was in the interface somewhere and you didn't.

• 33:36Speaker 00

  Yeah, you didn't see the logs. So why, why didn't you action that? And that, I mean, I think the assumption that the average business is going to care about cybersecurity is, is a false starting point. Because businesses, you know, you buy your computer hardware, you get your IT set up. If I'm a business and I, you know, out there, I'm not starting my day off thinking, oh, I can't wait to buy some cybers or understand some, you know, cybersecurity. And that is the baseline.

• 34:04Shane Parrish?

  Right.

• 34:05Speaker 00

  That, that I think for, you know, an effective solution, that's what you're dealing with. You're, you're dealing with a company or a customer that doesn't care about cybersecurity, but you need to help them. The baseline of the, the interface could be an office manager, not somebody who has a computer science degree, or somebody who has any background or interest in cybersecurity. So having a system that, you know, is set up and built and implemented to work with. People who don't necessarily care or will care or should even care because that's not their job. That's what we do.

• 34:42Shane Parrish?

  Well, that's a good point, right? Like you're not trying to make them care. You're just trying to say this is no worry for you anymore.

• 34:47Speaker 00

  Yeah, yeah. And when something comes up, here's a very concise way of dealing with it. Not a, you know, a series of links. Go Google this, learn how to implement a VPN, learn how to use a firewall, learn how to patch your system. It's a guided approach to this is specifically what you need to do.

• 35:04Shane Parrish?

  Let's flip that around and what people don't often see, which you can add uniquely is sort of, what's the mind of the attacker? Like if you're looking at acquiring

• 35:18Shane Parrish?

  valuable information from a company, walk me through that whole process. Like, how do you think about that? How do you go about doing that? What does that look like?

• 35:28Speaker 00

  So initially, an attacker is going to profile the target and that can look like different things. So if, you know, the target has online services, they'll probe those services to see what's there. Are there any email addresses on your website that are really easy to identify? What type of social media presence is there? And that ultimately will lead into typically a social engineering campaign, either in the form of, you know, an email that is received that looks really normal, that you want to trust. And hopefully it will get you to click on something or double click in an attachment. Or it'll go to your phone and you click on that and that exploitation occurs.

• 36:06Speaker 00

  The other approach that we see quite a bit is people don't use multi-factor authentication with just a basic email setup. So brute force, brute forcing passwords works. Somebody gets in, will scope out your inbox and see what's there, who are your customers? What's your routine? And then they will perform perhaps a financial redirection. So in that case, they would get an idea of what your entire portfolio is, and email all of your customers and say, hey, here's your new payment instructions. And they will have all the outstanding invoices already, you know, listed and ready to go. So they can immediately say, you know, you owe us X amount. This is where I want you to send this money now. And that is remarkably and surprisingly effective.

• 36:51Shane Parrish?

  Yeah. And hard to track down, even though there's like a total with bank accounts, we'll come to cryptocurrencies and sort of run it somewhere later, but. With bank accounts, it's easy to see where the money goes. It's really hard to get the money back once it's gone.

• 37:04Speaker 00

  Yeah.

• 37:05Shane Parrish?

  And that's conventional sort of attacks, right? Versus sort of somebody like Boeing or General Electric or sort of Cisco, who would have a lot more valuable IP and probably worth a zero day or sort of like developing a custom exploit. Can you walk me through like how that would work hypothetically, of course?

• 37:25Speaker 00

  So you're interested in more of the pointy end of the stick?

• 37:27Shane Parrish?

  Yeah.

• 37:28Speaker 00

  Yeah. So, you know, the way exploitation works is... Specific platform you'd like to walk through?

• 37:35Shane Parrish?

  Let's walk through Windows.

• 37:37Speaker 00

  Windows, okay. So if you're going after a Windows box, it's either a server or workstation. Typically, servers, if they're internet facing, gives you the ability to hit it direct. So if you have a zero day and, you know, a web server, for example, that is something you can directly access and exploit. And that is a very direct way, I guess, of attacking. The other approach is you have a Windows client. You're sitting at your desk, you have a laptop and you're just, you know, typing away and you get an email. That is probably the most common way. And what that looks like is, again, back to the scenario where you're trying to convince somebody to trust an email. So they click on a link.

• 38:19Shane Parrish?

  What happens? Like, walk me through, I click on this link.

• 38:21Speaker 00

  Yeah, yeah. So the first thing that happens is, you know, the browser would be exploited. So whatever browser renders that link, web browser exploit would basically gain code execution. And modern browsers are definitely getting better at protecting against that type of thing. So, you know, Chrome is... Every browser has a sandbox now. Most browser flavors are, you know, some measure of Chrome. So even Microsoft Edge is now based on Chromium.

• 38:47Shane Parrish?

  And so is Brave and so is like Firefox isn't there, is it?

• 38:51Speaker 00

  No, no, Firefox is not. I think they're still rocking their own setup.

• 38:54Shane Parrish?

  For now, they just fired their threat team.

• 38:57Speaker 00

  Jeez, I didn't even hear that. So yeah, it gains execution inside the browser and then the goal is then to gain privilege in the operating system. So that could constitute a sandbox escape to get out of that browser sandbox, a privilege escalation to ideally execute at a higher privilege level to basically nullify any security on the host and ideally get execution in the operating systems kernel. And once you're there, it's largely game over.

• 39:26Shane Parrish?

  But you get kernel on an individual host. Walk me through how you, like, how does that become network access to at a super admin level?

• 39:36Speaker 00

  So, so once you have that, you, you, there, there really is no barriers to do, to doing anything on that host. So if you want to open up comms back to mothership, you can do that. If you want to access a whole bunch of data, you can do that.

• 39:51Shane Parrish?

  But how do you open up comms? Like, isn't everybody monitoring these links now in terms of like how you exfil information?

• 39:57Speaker 00

  Uh, no, no. It's a, so, so we're kind of diving into why this is actually a really hard problem and why any specific pillar doesn't work. So if, if you only buy a network monitoring solution, you won't see really anything that I've described thus far. If you buy an endpoint only solution, there may be hints of things that have happened depending on the sophistication of the endpoint solution. But as soon as it gets so particularly deep in the kernel, that you're not going to see that. So it's a very challenging position. That, that's why having a holistic approach is so important. You need network, you need endpoint. So if you get by either one of those things, the other will pick it up.

• 40:38Shane Parrish?

  And how does that work? Like on a, a particular client, I can understand how those things communicate. But then how do you, how do you take an attack on one company and then translate that into a defense on another company with something you haven't seen before?

• 40:53Speaker 00

  So I guess largely that depends on how well the cybersecurity solution is implemented. If it is part of a network where you can dynamically signature an attack quickly and create an artifact, we'll say, that can be applied across the network of other customers, that is a way to combat against that.

• 41:14Speaker 02

  Bonjour, compadre. It's the

• 41:18Speaker 02

  how do I negotiate so many great travel deals? My greatest gadget, the Priceline app. It's got hotel deals, flight deals, rental car deals, all of those deals in a bundle, deals, game day deals, concert trip deals. No one deals more deals than Priceline. Hold your horses, there's more. The app lets you filter hotels by neighborhood, vibe, star level and amenities like pools and spas and beach fronts and wait, I'm not done. Stop cutting me off.

• 41:46Speaker 03

  This episode is brought to you by Tic Tac. Lace up and get your game on because the Tic Tac lineup just got a new teammate. Dr. Pepper Tic Tac. This new double threat puts two of your favorite flavors into one box of mints. And when two iconic flavors come together, the result can only be iconic.

• 42:04Speaker 03

  Score big. Try Dr. Pepper Tic Tac today.

• 42:09Speaker 00

  I mean, the zero day problem is something that's always going to be there. I think this is something a lot of vendors don't actually realize that no matter how much you lock down your operating system, there's always going to be a creative group out there that does things better, that can get around it. I mean, if you look at Apple, Apple iPhone for the past, I don't know, say decade, they've been adding an increasing number of security mechanisms into the operating system that largely limit an app writer to only being able to do specific things. But that is largely crippling from a security standpoint, because all you need to do is get around these set of mitigations and you now. Can own any Apple device in the world.

• 42:53Speaker 00

  And a really scary thing is recently a company called Vupin. That isn't, you know, they buy zero day exploits. Not sure where they go after that, but what they do is, I can speculate, but they buy zero day exploits. And they, they, they posted something recently where they said, we're, we're full up on iOS privilege escalations.

• 43:13Shane Parrish?

  We got enough.

• 43:14Speaker 00

  Yeah. And if that isn't a wake up call to, to Apple, I don't really know what would be. That's, that's basically the industry is saying, yeah, your operating system is not as secure as you think it is.

• 43:27Shane Parrish?

  But it's kind of like the Great Wall theory, right? Like you have this big wall around, but once you're on the inside of that wall, it's like, there's no defenses after that.

• 43:35Speaker 00

  Yeah, and that perfectly describes Apple. And that, that actually describes every mobile operating system out there.

• 43:41Shane Parrish?

  Well, Android, talk to me about the specific challenges with Android, because they have their, they have like a host of other problems that aren't common occurrences that have to be dealt with. Like everybody has a different version of Android that they're running. It's always at a date, it's.

• 43:57Speaker 00

  Yeah, so Android's an interesting beast because a lot of.

• 44:01Shane Parrish?

  It's the most common platform, isn't it?

• 44:03Speaker 00

  Yeah, yeah, and it gets a lot of positive attention out there because it is an open platform. You know, you could download.

• 44:08Shane Parrish?

  Security nightmare.

• 44:09Speaker 00

  Yeah, you can download the source code and you can see what's running. And that is a component of a secure operating system, I guess, that, you know, the average person can go about and audit what's there. The average person could, if they want, take that, download it, compile it, put it on their phone and maybe add some additional bells and whistles. The concept is very noble. The reality of it is not so great. Because what we have today is there is the main Android branch that, you know, evolves that Google releases. Android 11 just got recently released and vendors will take that and they will adopt it as is, or they will customize it, or they will, you know, take particular parts of the, what's called a change history.

• 44:52Speaker 00

  It's basically the, the changes that have been made to the code base. When that is taken in context with vulnerabilities. The fixes may or may not make it in. So you could have, you know, the latest Samsung phone running Android 11 that doesn't actually have all of the security fixes that the main Android branch has.

• 45:10Shane Parrish?

  Right, because somebody's accepting or rejecting.

• 45:12Speaker 00

  Yeah, yeah. And I can tell you that 100% certainty. I have not looked at Android 11, but what I have experienced over the past two decades, there are problems in the Samsung version that have been missed because humans, again, are part of the equation. And, you know, on the list, it'll say, you know, CVE fixed, CVE fixed, but those fixes aren't there. Bad guys or attackers will know that, and they will exploit that. And there is literally nothing you can do to defend against that if you are a target. And that is a pretty frightening proposition.

• 45:46Shane Parrish?

  So you would rather go up against an Android phone than an iPhone if you were attacker?

• 45:51Speaker 00

  Uh, that's an interesting question. I think the odds of getting exploited are higher on Android. Although the the nature of Android also creates a scenario where there's so many different flavors of Android, it makes it much more difficult to create a mass attack. Whereas on iOS, because it's the same version of the of the operating system across the board on every device, if you can find a problem in that, you get all those devices. On Android, you get the nuances, I put nuances in quotes, of some of the decisions that individual vendors will make that that makes it very difficult to take an attack on Samsung and apply it to, I don't know, a Google phone or a ZTE

• 46:31Speaker 00

  phone. So it's, I would say generally, it's the the security position on Android is is is worse. You know, the the odds of being hit in a mass attack are potentially lower. But if somebody is targeting you, I would say that the odds of, you know, you them being successful against you are higher on Android for sure.

• 46:49Shane Parrish?

  As phones, or, you know, if you want to call them personal computers, it's like those are our personal computers, right? More so than we think, become more prevalent. They'll become the surface of which gets commonly attacked. Walk me through like, how does phone exploitation even work? Like, is it the same sort of system that you would use for Windows or Apple? Is it different? Like, how do you attack the phone? You have this thing on you all the time. It's got a mic, it's got a camera.

• 47:18Speaker 00

  So the unfortunate answer is the exact same way you'd go after every other type of computer. iOS is just an operating system. Android is just an operating system. There's, there's no, there's no special features that make it impervious to attack. There, there are different security mechanisms in place that an attacker needs to get around, but it's the same deal. So if I'm going after your Windows laptop in the scenario that I described, where I send you an email on mobiles, it's the same thing. And it's actually worse in some cases. About a year ago, a company out of Israel called NSO Group, they got busted for having a WhatsApp zero, a zero click mechanism. So there, there's some quick lingo dive here. One click versus zero click.

• 48:02Speaker 00

  One click is you have to social engineer somebody to the point where they can click on a link and exploit the phone. Zero click is where there's nothing you can do. You are just owned and you have no idea by.

• 48:13Shane Parrish?

  You don't even see a message. Like, you're just.

• 48:15Speaker 00

  Yeah, no decision on your part. You're sleeping in the middle of the night. In this case, NSO Group, you know, sends you a malicious bit of content via WhatsApp, assuming they've been able to, you know, figure out your WhatsApp ID and then exploit your phone. And congratulations, that, that whole step of getting around sandboxes, privilege escalation, that it's all the same concepts. But in this case, it is a direct way to attack a device that you own.

• 48:42Shane Parrish?

  So previously, like, tools like that were only in the hands of governments and they weren't generally targeting individuals or small corporations. Has that changed?

• 48:51Speaker 00

  I think the accessibility is different.

• 48:55Shane Parrish?

  There's like an asymmetry to this, right? Like, some, some person, some teenager, guy or girl, sitting in their garage can literally have a massive disproportionate impact.

• 49:08Speaker 00

  I'm thinking of the, the attack on Twitter recently and how, how, you know, that was a social engineering attack. Yeah, and, and, you know, in the context of going after mobiles, I mean, that, that's, that's, it all comes down to the accessibility of the attack vector and the creativity of the person running the, the attack factor. So I was thinking, you know, with, with NSO Group, you know, there's, there's a lot of articles on them about who they sell to and don't sell to. They have a whole group now, a whole internal group within the company that I've read, dedicated to making sure they make ethical decisions. I don't personally trust that they're making ethical decisions.

• 49:46Shane Parrish?

  Why do you need a group to make ethical decisions?

• 49:50Speaker 00

  I mean, that's an indication that, you know, ethics weren't a component in founding of the company. That's probably a whole other discussion. But yeah, I, I think, you know, the, the, the point that the attacker and what that looks like is, is, you know, it, it's much more plausible that it is not an intelligence agency. You know, you, you look at the, the the groups that are running out of, you know, other countries. I'll, I'll pick on India a little bit just because I've seen some, you know, some IP reports on, you know, some, some problems coming out of there, but firms of social engineering efforts, you know, it, it doesn't take a lot to go after Android that's two years old. And how many?

• 50:30Speaker 00

  I haven't looked at the statistics of how, you know, what the, the market coverage is of, of Android versions. Pretty confident that if you're rocking a version of Android that's a year old, you're probably a pretty big target. And that, you know, again, I don't mean to pick on Android, but that is just a reality of how that ecosystem has evolved.

• 50:50Shane Parrish?

  People don't really realize the scale at which this affects the economy, right? Like you see these ransomware attacks, which I want to come to next in terms of like $20 million paid in Bitcoin, but what you don't see is the trillions of dollars in IP that have been transferred to foreign governments over the last decade.

• 51:10Speaker 00

  Recently, we've seen a lot of intellectual property leaks. I, I kind of feel that, you know, it's, if you were going to steal intellectual property and then create a competing product with traces, which, you know, Huawei got busted for that.

• 51:24Shane Parrish?

  Yeah, well, I want to come back to Huawei.

• 51:27Speaker 00

  Internal rage meter just went up. You know, it's a much more, you know, deniable scenario where, you know, things hit the internet and people say, okay, I just, it was out there now. So it's public domain knowledge. So the, you know, having separation from the attacker and the beneficiary of, of, you know, the results of the attack, um, you know, it makes a lot of sense if, if one's goal was to get a hold of somebody's intellectual property. I mean, once it's out there, everybody's going to consume it. You know, you look at the leaks of the whole Eternal Blue leaks. It's a series of tools from NSA that got leaked, um, Windows vulnerabilities, you know, went to WikiLeaks.

• 52:07Shane Parrish?

  Was that NSA or was that the CIA ones that got released?

• 52:10Speaker 00

  Vault 7? No, that was, that was NSA.

• 52:13Shane Parrish?

  Was there CIA ones or am I making that up?

• 52:16Speaker 00

  No, there was one that was rooted in Vault 7 was, was that group. Uh, was that leak, I guess. Um, the one I'm referring to, um, was, uh, from NSA and it was a, it was a whole treasure trove of tools. And this one was particularly interesting because it really, there, there are events that occur that destabilize, I guess, the defensive posture. Ransomware in general, I don't get how it even exists. It is the easiest malware to detect and stop. How there's even an industry around that blows my mind. But the attack vector, uh, that people use to wrap ransomware, the payload, weaponize the, that chain that I talked about earlier, basically allowed a, you know, a point and exploit capability on patched Windows machines.

• 53:00Shane Parrish?

  So walk me through ransomware. Like what, what happens?

• 53:03Speaker 00

  Uh, depends on the flavor, but the, the, the, the overall goal is to extort money uh, out of the, the victim. So there's different ways to do that. If you attack, uh, an individual, you would, you know, potentially encrypt their personal photos, credit card information, maybe other personal compromising information. And then, um, say, give me X amount of money or I'm going to, I'm going to, you know, expose all your photos or I'm going to delete it all. When it comes to businesses, it's more of going after intellectual property where if a particular workstation gets compromised, ransomware runs on that workstation, encrypts everything, potentially deletes, deletes everything at the time, uh, typically making a copy of it because there's value in that. And then we'll go through all the network

• 53:47Speaker 00

  shares and do the same thing. So, uh, there's one, one particular, uh, there's different groups, I guess, of, of ransomware actors out there. Some that are. Uh, you know, won't call a bluff and others where if you say, I'm not going to pay you, they will a hundred percent follow through on what they're going to do. And this weird, I guess, sub industry has emerged from ransomware actually being a thing and being accepted, where companies will actually act as negotiators. So if you think back to those really cool movies where, you know, there's a really cool ransom, or sorry, hostage negotiator, uh, trying to talk somebody out of the scenario. That exists for ransomware and it drives me up the wall.

• 54:30Shane Parrish?

  For me.

• 54:30Speaker 00

  Yeah, yeah.

• 54:31Shane Parrish?

  Why is that a problem? Like, do, do, like, do your customers have ransomware problems? Like?

• 54:37Speaker 00

  Oh, no, because they, they, they use covalence. Uh, we, we protect against that, that vector. Uh, but the one thing-

• 54:44Shane Parrish?

  But how, how do you stop that? Like, if it's that easy to stop, why doesn't everybody stop it?

• 54:48Speaker 00

  I, I wish I had an answer to that. I, I don't think, you know, a network monitoring solution will not stop ransomware. There's nothing you can do about that.

• 54:56Shane Parrish?

  You need to be on host.

• 54:57Speaker 00

  Yeah, you, you have to be on host and you have to have a measure of sophistication, uh, and tradecraft to, to identify and block it. We've seen, we have some coexistence scenarios where, uh, I, I won't identify the companies, but they are very, very large, successful companies, cybersecurity companies. And the ransomware gets by them, but we stop it. And it blows my mind that, you know, based on the-

• 55:21Shane Parrish?

  Cause for you, that's easy. Like, that's not, that's not a big thing that you're worried about.

• 55:26Speaker 00

  It is, it is a very, very basic profile to stop, identify. I, I might be jaded because I've been doing this for 20 years and in the grand scheme of, uh, things that I've been a part of, uh, ransomware is definitely low on the sophistication bar.

• 55:39Shane Parrish?

  Do you think it would exist without cryptocurrency and anonymous payment forms? Cause it's always seems to be, at least in the news, it's always like, you need to pay in Bitcoin so I can like run away with this money and-

• 55:50Speaker 00

  Yeah, I would say it'd definitely be harder because that is definitely a very convenient payment structure, uh, to pay, to pay with Bitcoin. The, I'm just thinking in the cases where we, we've seen financial redirections and those are anonymous accounts that are used and then torn down. Uh, so there's, there's definitely-

• 56:06Shane Parrish?

  How hard is that to track? Like if you're sort of like the FBI or the, another three letter agency, like to follow that path?

• 56:16Speaker 00

  I don't, I don't know about that. It's not my, not my background, but I would say the, the challenge would not necessarily be the difficulty. It would be the average person or business getting any agency to care, to track it down because that intel agencies, law enforcement agencies aren't sitting around waiting for things to do. There's really big problems they're going after and trying to fix and solve. And, um, you know, a small company, you know, a law firm getting ransomware is, is just low on their.

• 56:49Shane Parrish?

  Well, it's not even a matter of payment for them. In some cases, it's life or death for the business because you can effectively turn the business off overnight and just eliminate it, especially if you're small and you, you don't have these sort of like big bank accounts to pay.

• 57:03Speaker 00

  Yeah, yeah, I'm aware of, um, you know, businesses that have been shut down because of ransomware. The, the, the payment is just too high and it's much easier just to say, okay, fold, throw in the towel. Uh, we're going to fold up shop and maybe start again. And this is ultimately why I don't like, I get very frustrated that companies will pay ransom or not take the time to, um, hire a company ahead of time. Like it's much, much easier and cheaper to be preventative and to, to harden your, your system and be ready for attacks. I mean, that, that is the reality of today. And anybody who thinks otherwise is, you know, they've got their head in their sand. Um, you're going to get ransomware. Bad things will happen and hopefully

• 57:48Speaker 00

  it doesn't kill your company or compromise customer data. That's, that's a whole other aspect of this equation that I don't think people take into consideration of. There are legal obligations to report compromises in customer data now. There are fines. I, I remember, before COVID-19 dropped, there was discussions about, you know, six figure fines going to Canadian companies. Uh, if they are ransomware, customer data gets compromised and it is shown that they weren't taking the problem seriously ahead of time. So they didn't have the adequate security protections in place.

• 58:21Shane Parrish?

  What's adequate? Like that sounds so subjective.

• 58:24Speaker 00

  Yeah, yeah, I mean.

• 58:26Shane Parrish?

  Is that back to that Gartner, I checked the box, you can't sort of like fire me?

• 58:30Speaker 00

  So, so if I was a, you know, virtual CISO, I would probably, you know, reference the Gartner Quandary to make sure that, you know, the executive board is covered in regards to liability.

• 58:44Shane Parrish?

  There's almost like two layers to this, right? There's the apparent layer, which is like, I want to solve cybersecurity, but the real layer is like, I want to keep my job. And the easiest way to do that is not take any risks and go with the industry standard.

• 58:58Speaker 00

  Ultimately, when it comes down to accountability, that is a safe way to go. It is unfortunately.

• 59:04Shane Parrish?

  Even if you're owned.

• 59:06Speaker 00

  Yeah, yeah, it's, it's, it's the safe way to go, but it is not the best thing for the company. It is not, uh, it is not forward facing. It is, I think it's being naive in regards to the, the type of attacks that are coming.

• 59:18Shane Parrish?

  So if you're a customer and you don't know a lot about this, what are the questions you should ask to sort of reveal the type of solution you're getting for real instead of sort of like checking the box?

• 59:31Speaker 00

  You know, right off the bat, I would say, how are you protecting my company? Just tell me how you're protecting my company, like full stop. What happens when something goes wrong? And, and you'll probably get a whole bunch of, you know, sales jargon.

• 59:46Shane Parrish?

  What's the difference between a good answer and a bad answer to that question?

• 59:49Speaker 00

  Oh God, if, if somebody uses the word next generation, seamless, um, we'll, we'll stop everything. Yeah. AI, we've got machine learning, any of that, if any of that comes up, big red flags. So if, if somebody can give you a good answer to what happens when your system fails, that gives you comfort, then I think that is a, that is a good position to move beyond. When I said earlier that, you know, the cybersecurity industry is like a, a bunch of unethical, used car salesman, uh, it's, it's because there's so much jargon and salesmanship that goes into this. For example, the, the process of buying a car, um, what do you expect when you go to

• 1:00:34Speaker 00

  a dealership to buy a car? What, what, what do you want to walk away, assuming you really like a car or a brand? What do you expect to walk away after a transaction occurs?

• 1:00:42Shane Parrish?

  The car?

• 1:00:43Speaker 00

  Yeah. Unfortunately, with the current cybersecurity industry, there are sales persons all over the place that will say, you know, what you need is you need some wheels. And then another salesperson will say, I can sell you the engine. And another salesperson will say, I'll sell you the steering wheel. You probably only need the steering wheel, but I can sell you that. It's gonna, it's gonna be great.

• 1:01:04Shane Parrish?

  I got some rims over here too.

• 1:01:06Speaker 00

  And it is up to you as a, as a, as a company to put those things together and make use of that.

• 1:01:11Shane Parrish?

  So you're cobbling together the solution yourself and each vendor, like no vendor is responsible then because it's like, oh, this person, there's a lot of finger pointing.

• 1:01:19Speaker 00

  Yeah. And ultimately, the, the only working cyber solution, and I don't care what the, the, the sales point is, the only true working cybersecurity solution is one that looks at it from where's your data? How are you going to be attacked across the board? So it needs to include an endpoint component, a network monitoring component, a cloud component, potentially an IOT component, an XYZ for things that we don't even need to know it exists yet. This is where this whole concept of next generation drives me nuts because people will say, we have this next generation thing. And what I'm seeing right now is the exact same thing I've been seeing 20 years ago, regardless of whether it has a machine learning component or not.

• 1:02:01Shane Parrish?

  Like, what does that mean next generation? Like, if you knew the next generation of exploits, you'd be?

• 1:02:06Speaker 00

  Well, well, ultimately, it doesn't mean anything. A, a good solution should be iterative. A good solution should be engineered to handle the future without needing to put a sales tag around a, you know, this is what we have now. We call it the next generation thing that the world's never seen. PS, it's got machine learning, AI, blah, blah, blah, blah, blah, which ultimately doesn't mean anything if you're a buyer. All it does is confuse you. Drives me nuts.

• 1:02:33Shane Parrish?

  There's so much jargon in this industry in particular, right? And a lot of it is salesy, like it's created by the

• 1:02:40Speaker 00

  Yeah.

• 1:02:40Shane Parrish?

  sales teams, the sales force, the

• 1:02:43Speaker 00

  Yeah. The, the number of times I have had to worry about this, you know, these features that are sold to businesses around the world, being on the other side of the coin just years ago. Never, I've never had to worry about machine learning. And by the way, the existing machine learning implementations and a lot of solutions out there is the exact same thing that, you know, I've seen in antiviruses back in 2005. They just didn't call it machine learning. It was just training analytics to, to look for anomalies and.

• 1:03:14Shane Parrish?

  So when you were an attacker, what did you worry about?

• 1:03:18Speaker 00

  Oh, that's an intimate question.

• 1:03:22Speaker 00

  Getting caught, I mean, ultimately, uh, yeah, I mean, so as an attacker, it is a continuous balance between risk and losing a capability. And this is

• 1:03:36Shane Parrish?

  What does that mean?

• 1:03:37Speaker 00

  And I'm speaking from, um, you know, back when I, uh, you know, was at CSE. It means that, you know, when I said earlier that on the, you know, that first pillar of cybersecurity, if you want to call it a pillar, there's an economy behind it. So there's a cost to building, uh, capabilities to, to go after a particular target. If you lose that capability, that immediately is an expectation of, okay, find a new one. And it's difficult. There's, there's cost to that. There's labor and, and that, that is a very big component that goes into the, the, I guess, the risk equation as to how you're going to approach an operation, how aggressive you're going to be.

• 1:04:20Speaker 00

  And different, different, you know, agencies around the world will do different things. I mean, you look at China and Russia, they're remarkably aggressive with a lot of, I don't want to say disregard to their own intellectual property and what they're using, but they're certainly not quiet about what they're doing.

• 1:04:35Shane Parrish?

  It's like spray and pray, right?

• 1:04:37Speaker 00

  Yeah, I find, I find it really intriguing. It makes, it makes me wonder a little bit, like, do they have a, an army of thousands of people in warehouses cranking the stuff out, which they probably do, which is really scary.

• 1:04:50Shane Parrish?

  Yeah, one of the things that I always found really fascinating about intelligence problems was there's always a country with more people, uh, who are just as smart, if not smarter than you, and just as good, if not better, technology than you. And yet your task was sort of defending or in some cases, acquiring information against these people. And the hubris that sort of like goes into, oh, we know best and

• 1:05:17Speaker 00

  Yeah, that, that was always an intriguing calculation, um, back, uh, back at CSE.

• 1:05:24Speaker 00

  It's a good debate to have, I guess, if you've got something that took a lot of time to build, do you throw it down a hill and hope for the best? Or do you protect it? Do you put shoulder pads and knee pads on it and try to make it last as long as possible?

• 1:05:40Shane Parrish?

  So talk me through that, though. Like, how do you see that? Because allied governments, friendly governments, whatever you want to call them, have exploits that are zero days that they don't release, that have huge national security implications. Like, we've seen some of those become public and have massive implications. Wasn't the NHS hack in Great Britain the result of a stolen zero day from an allied government?

• 1:06:05Speaker 00

  That one's tough.

• 1:06:08Shane Parrish?

  Like, should they disclose them? What's your, like, how do you think about that?

• 1:06:11Speaker 00

  So, so from what I, so full disclosure, I don't have as much exposure to what the internal debate is on that. I'm aware that it happens. I think a lot of it comes down to what the perceived value is gained versus lost. If you just, if you, if you don't disclose something and you use it operationally, is there more good for the mission, the country, its people by not disclosing it versus disclosing it and losing a capability? Yeah, it's a tough one, because, you know, the adversaries of allied governments aren't going to disclose. They're not going to care. If they have something they can weaponize, they will use it. And I think, unfortunately, that is probably the tone that is set globally

• 1:06:55Speaker 00

  that underpins a lot of these, the decision making. Like, if you're being attacked constantly and having your intellectual, your nation's intellectual property stolen, I mean, you could disclose all the vulnerabilities you have and you know about as a nation. It's not going to stop them. It's just not going to. There, there, you know, going back to the VUPEN example of, there are more out there.

• 1:07:18Shane Parrish?

  There's a backlog, apparently.

• 1:07:20Speaker 00

  Yeah, yeah.

• 1:07:22Shane Parrish?

  Speaking of, I'm gonna probably push some of your buttons here, so you might want to take a drink. Talk to me a little bit about... Huawei. I'm just gonna leave it there. Expand on Huawei.

• 1:07:35Speaker 00

  So.

• 1:07:36Shane Parrish?

  We've had many conversations.

• 1:07:37Speaker 00

  What a chestnut that situation is. So Huawei's had a bit of an interesting, less than smooth ride, I would say.

• 1:07:46Shane Parrish?

  They came out of nowhere with all this tech.

• 1:07:48Speaker 00

  Yeah, which miraculously happened right after a Cisco leak, a giant Cisco source code leak.

• 1:07:54Shane Parrish?

  It's a coincidence.

• 1:07:55Speaker 00

  Yeah, so you know, there's documented ties to the Chinese federal government with that company existing. There is, I don't know if they were ever convicted, it was back in 2003, 2004, but there was a very clear cut case that Huawei was using conveniently leaked intellectual property. This is back to, you know, if I was going to steal your intellectual property, it is much more deniable if I leak it out into the internet and then use it and come out six months later and say, oh, look, I just found this out there and I used it. Really convenient.

• 1:08:33Shane Parrish?

  Coincidence.

• 1:08:34Speaker 00

  Yeah. And, you know, where we are today, Huawei basically, you know, price undercuts other vendors. And, you know, I ask, how did they get to that point? That sounds like they have a lower R and D budget. And how do you have a lower R and D budget? You get intellectual property via creative means. You know, today with them being banned from the US, I don't disagree with that. I have different thoughts about the whole TikTok situation, but.

• 1:09:03Shane Parrish?

  Wait, dive into the Huawei thing. Why don't you disagree with that?

• 1:09:06Speaker 00

  Why don't I disagree with them being banned?

• 1:09:08Shane Parrish?

  Yeah, I mean, I agree with them being banned.

• 1:09:10Speaker 00

  Yeah, so I don't think there is a framework to build trust. I don't think they have earned that trust. And given, you know, if a nation is going to re-kit their entire country with a new type of wireless gear, especially with the complexities of 5G, you'd need to trust that vendor. You need to be sure that the interests of that vendor are at the very least not opposed to the interests of the country that you're in. And I don't know how anybody could possibly say that about Huawei.

• 1:09:43Shane Parrish?

  I remember when the Brits did this whole thing, like, we're gonna set up this accredited lab, we're gonna test it. So we're gonna allow British Telecom to use it. But we'll test everything that's deployed. I remember just like that would fall apart in a second because the minute there's a zero day, you're going to deploy it right away, especially if it's leaked on the internet. And then you've deployed code that you haven't code reviewed and then the whole thing just falls apart. And I'm like, okay, well.

• 1:10:07Speaker 00

  Well, it doesn't scale to the realistic pace of software development.

• 1:10:11Shane Parrish?

  Right.

• 1:10:12Speaker 00

  So let's, let's imagine that a government does have a program in place where every iteration of source code, and these aren't small systems, we're talking millions of lines of source code. Let's assume you have a crack team of amazing source reviewers that can say with confidence, yep, this looks great. Or better yet, they have a set of automated tools to be able to derive that answer, which is challenging, probably possible, extremely challenging. The realistic outcome is the time for, say Huawei releases a new iteration, the time from that release, because if they are a vendor that actually believes in securing their product

• 1:10:53Speaker 00

  and that new release of the firmware has, you know, fixes, time matters. You're, you're against the clock before, you know, vulnerabilities could be discovered and put out. Cause all it takes is for them to release that firmware once, have somebody rip that firmware apart and identify differences between the old and new. So you're immediately up against the clock. And if this ideal analysis process is being slowed down in any way, you're immediately compromising the vendor and giving them the, the argument that this system doesn't work. Because what they, and I don't necessarily disagree with that. If I was the vendor and my releases were being slowed down by a month, I would get pretty cheesed because.

• 1:11:33Shane Parrish?

  It's not my fault.

• 1:11:34Speaker 00

  Yeah, you're slowing down fixes and, and, oh, I'm sorry, your, your routers just got hacked? That's on you. That's, that's not on the vendor at that point. So I don't think that concept is one that actually works.

• 1:11:45Shane Parrish?

  And the way to avoid that is sort of like just not allow that in your critical infrastructure? Or do you think it should be not allowed in any infrastructure? Your personal take.

• 1:11:54Speaker 00

  Oh, my personal take, I, I, I'm, again, I'm completely fine with the ban.

• 1:11:59Speaker 00

  I mean, they're still allowed to sell into Canada. I'm not aware of what the

• 1:12:06Shane Parrish?

  I think it's not allowed in the, I mean, my knowledge is out of date, so we'll have to like fact check this, but I think it's not allowed in the critical components of Canadian telcos, but it's allowed in the periphery. But that's like silly when you think about it, right? Because you don't want to ever be held hostage to somebody who can, who can turn that off. And somebody who's more patient than you, right? Because you could just go 25 years with no incident. And then all of a sudden, there's an incident, but you've built up 25 years of trust and credibility. So the story you tell yourself is we haven't had an incident. It's cheaper because it's likely subsidized and not only R and D, but subsidized by the government.

• 1:12:45Speaker 00

  Yeah. So I mean, ultimately this is, I don't have any problem with Huawei being banned in the US. I would not, I would not argue about that. By the way, the, the name of the vendor is Xerodium. Vupin started, sorry, Vupin started Xerodium.

• 1:12:59Shane Parrish?

  Okay. And they're the ones that bought the Xerodys.

• 1:13:01Speaker 00

  Yeah, I always lump them together, just, you know.

• 1:13:03Shane Parrish?

  Well, same parent company, I would imagine.

• 1:13:05Speaker 00

  Yeah.

• 1:13:06Shane Parrish?

  Yeah. What do you think of Snowden?

• 1:13:10Speaker 00

  Yeah. I feel like you're asking questions that is slowly taking years off my life. So.

• 1:13:16Shane Parrish?

  I've been doing that since I met you.

• 1:13:18Speaker 00

  Uh, no, you're great, bud. I do not agree with what Snowden did in any way.

• 1:13:24Speaker 00

  And that is, that is putting it very, very kindly. Regardless of, you know, at this point, there's been things that he brought to light that has been declared illegal. The, the unfortunate assumption is that agencies, security agencies, intel agencies are, you know, these devious groups that are like, let's do whatever we can. And I don't think the average person actually realizes how difficult that job is, how normal the people are who do that job. They have families. They come in, they want to, you know, solve a mission or solve a problem, make things better.

• 1:14:01Speaker 00

  And the way he went out with this giant trove of information, which I'm going to come back to, completely ignores the, the, the way that technical implementations get approved. It's not like developers are sitting at their desk and say, I have this great idea, let's go do it. And all of a sudden it's running in operations without any, you know, accountability or review. There is a team of lawyers, depending on the size of the country, that will look at that and say, this is okay, this is bad. I remember being at CSE and arguing for something for I don't know how many years, but there was, there was a problem legally and it didn't

• 1:14:40Speaker 00

  get through. And that, that vetting process, people take extremely serious. And if something goes through that process, there is a measure of legality to it. There are a group of lawyers who honestly like to say no to ideas that have said, yeah, this is okay. So the idea that anything that has been deemed illegal, you know, I'm not in a position to say that's right or wrong, but what I can say is the process that those things would have gone through.

• 1:15:08Shane Parrish?

  People underestimate the sheer size of the bureaucracy to get anything implemented.

• 1:15:14Speaker 00

  It is absolutely crazy. So, so that whole side of things, I find unfortunate because the, the byproduct of that is distrust for agencies that are working extremely hard to keep countries safe. And it is extremely disheartening for those people to, you know, get dragged through the mud publicly when the public doesn't actually have an awareness as to how much they sacrifice on a day-to-day basis. Like, I couldn't count the number of long nights that I've seen people work. You know, it, it can break families, it can break relationships and.

• 1:15:47Shane Parrish?

  It has, yeah, definitely.

• 1:15:49Speaker 00

  So, the other side of it is, you know, trusting his intentions. So, he, he had gripes about, you know, those types of illegal, you know, mass monitoring or mass surveillance programs in the US. Why did he go public with such a large archive that had nothing to do with that? Why did he, you know, expose completely legitimate legal intelligence gathering programs that have a ton of people's names associated with that? Why did he go out the door with that? And that, I think, is what I have a much larger problem with in that, you know, there was no thought process. I, you know, it sounded, to me, it seemed like more, he was just giving the intelligence community the middle finger.

• 1:16:34Shane Parrish?

  Yeah, I mean, I sort of took away the same thing from that whole thing, which was.

• 1:16:40Shane Parrish?

  Even if he felt just in what he was doing, it would have had a different sort of feel to it when it came out. And you don't need to reveal the techniques. You can just reveal the details of the programs, but the actual techniques that he revealed, the software techniques, the exploitation techniques, that, I mean, that definitely cost people lives, that had a huge impact on people working there.

• 1:17:02Speaker 00

  Yeah. And how far back did he set programs? How much did, you know, entire agencies need to go into damage control because some Yahoo decided that this thing over here was illegal? And then, oh, PS, here's a whole bunch of other interesting stuff, unredacted, being released?

• 1:17:19Shane Parrish?

  Yeah, I think people think, oh, there's no names associated with it. But like on the original documents, there's definitely names. And I think we both assume that every intelligence agency worth their salt in the world has unredacted copies of all of those documents.

• 1:17:33Speaker 00

  Yeah, to the best of my knowledge, WikiLeaks doesn't receive redacted versions of things. I mean, that's largely my opinion on him if he's-

• 1:17:39Shane Parrish?

  So you don't think he should be pardoned?

• 1:17:41Speaker 00

  A little part of me will die if he's pardoned.

• 1:17:43Shane Parrish?

  Why do you think he's in Russia? Is there something to that story?

• 1:17:48Speaker 00

  I mean, where's the safe place to go when you've burned, you know, a particular group, like right into the-

• 1:17:55Shane Parrish?

  It's pretty bad when your safe place is Russia.

• 1:17:58Speaker 00

  Yeah, I mean, yeah, I'd be really curious to actually know what his living conditions are like right now. And, you know, hopefully they're not comfortable. But I mean, he brought it upon himself. There's other ways he could have done that and come forward with-

• 1:18:12Shane Parrish?

  How could he have done that differently? What do you think? Well, like internally, there's lots of outlets for that stuff. He said he followed that. There was no documentation released that I can remember that he did follow those.

• 1:18:24Speaker 00

  Yeah. I mean, you look at the whistleblower protection that's in place now.

• 1:18:29Shane Parrish?

  Was that post Snowden or pre-

• 1:18:30Speaker 00

  Yeah, you know, I was just thinking that. I don't know whether it was post Snowden. I mean, maybe his decision to do that would have actually improved the protections for whistleblowers. And, you know, that's probably important to acknowledge, but it's-

• 1:18:43Shane Parrish?

  I thought he was the best thing to happen to Lynchpin, though. I remember, like, and I don't mean that in a negative way. I just remember, like, what happened in the immediate aftermath of that was they locked down the process by which people get hired. So like, I don't think you or I would make it through today. From start to finish because of our backgrounds and sort of different quirks of our personality. And so what happens is like post Snowden, you end up hiring, I call it the stormtrooper problem, which is like you end up basically hiring the same type of person, right? They're they're sort of like never had a problem in their life. They get straight A's. They do all the right things. They tie their shoelaces the right

• 1:19:25Shane Parrish?

  way. And they come into the organization and they get promoted. And the process for promotion now is sort of like, here are the 10 things you need to do to get promoted. Because it's so sort of like laid out and so bureaucratic that you end up, you're 30 and all of a sudden, you're you're in charge of solving a problem that nobody's ever solved before. But you're in a group of people who all see the problem the exact same way. So you all share the same blind spot. So I remember when that started happening, I was like, oh, man, this is like, great news for Matt, because you're hiring, in a way, the misfits of the the industry, right? The people who don't want to go to meetings, the people who don't want to fill out the forms to go travel, the people who just want to be able to do their job.

• 1:20:09Speaker 00

  Yeah, I'm trying to think back of, you know, what was there? Was there an effect? I don't actually know if I could speak to that without violating an NDA, honestly. But

• 1:20:19Shane Parrish?

  Yeah, we don't want to get you in trouble.

• 1:20:20Speaker 00

  Yeah.

• 1:20:21Shane Parrish?

  This year.

• 1:20:22Speaker 00

  Yeah, I think how you characterize the the mindset at these organizations are, it's pretty accurate. I mean, the

• 1:20:31Shane Parrish?

  Well, we both sat in meetings where they're like, oh, we can't hire this person because there's like a flaw in their background. And and there's some legitimacy to that, too, right? Like, you're trying to manage top secret information. You're trying to manage risk and manage an organization. But the flip side of that is like, you're hiring effectively the same person.

• 1:20:49Speaker 00

  Yeah, you're not wrong. I definitely don't disagree. I think from one, one benefit to lynchpin from that was definitely it pushed people out the door. Absolutely. And I think that's a trend that that continues to this day. I mean, I'm still

• 1:21:07Speaker 00

  You know, full disclosure, actively recruiting from intelligence agencies. The people that are excited to leave and do something more and, you know, for the lack of better, better terms, be unleashed to solve technical problems. Like there's that, there's that hunger there. Uh, and it's, uh,

• 1:21:25Shane Parrish?

  I love that perspective of unleashing people that have sort of like had handcuffs before. And it's like, now your ceiling is not bureaucracy. Your ceiling is your own ability.

• 1:21:38Speaker 00

  Yeah. Uh, I've been, I've been doing this for 15 years almost as an entrepreneur in, you know, two companies and I've gotten to witness people going, go through that unleashing process. And it is really cool to see, um, how, you know, one month after they're, they're just blown away with what they are now afforded to do and what, what, what, what, you know, I'm not saying, don't do this. It is just, here's the goal. Here's the problem. Solve it. Let me know what you need. We'll catch up every once in a while. In Canada, people typically join, join the company with, you know, one year leave of absence or a five year sabbatical component. And I always, I always laugh about that because yeah, I mean,

• 1:22:19Shane Parrish?

  Nobody's ever gone back.

• 1:22:20Speaker 00

  Well, yeah. So, yeah. So from a risk standpoint, uh, that makes sense. So I never, I never argue with that. Uh, but from a practical standpoint, nobody's ever gone back. And it's become something that I've seen weaponized against the employee, you know, oh, you're, you're going to this company. We're not going to give you your one year leave of absence. And it's like, okay, that is extremely bad decision. And you're showing some really unfortunate true colors. Um, you know, in that, in that.

• 1:22:48Shane Parrish?

  Does that ever make somebody stay? Or does it like push them out the door faster?

• 1:22:51Speaker 00

  Pushes them out the door.

• 1:22:52Shane Parrish?

  And motivates them.

• 1:22:53Speaker 00

  Yeah.

• 1:22:54Shane Parrish?

  Chips on shoulders, man. There's something to the motivation that comes from that, that just drives people.

• 1:23:00Speaker 00

  I mean, Google's project zero is largely built from people who have exited the, um, intelligence industry with a chip on their shoulder. I don't know if that's worked, worked out so well.

• 1:23:10Shane Parrish?

  I want to just sort of like end on some of the lessons that you've learned growing. Field effect now to 100 people. That's the critical phase for a lot of companies. Like a lot of companies break in this sort of like 40 to 100 people range because you start reaching the ceiling of the processes that you've put in place. But also the ceiling of the people who've got you here. How do you think about that? How do you scale and how do you go beyond that and crack through that sort of ceiling?

• 1:23:42Speaker 00

  Uh, I, I think the, the first component is, is making sure that everybody is going in, in the same direction. You, you have to be very straightforward, frank, honest when, you know, looking internally, but also what the company goals are. And everybody needs to know what the company goals are. I, I don't think that, you know, execution is necessarily something that comes naturally to a lot of people. And, and for me right now, like one of my, one of my biggest concerns as we approach 100, uh, as we go through COVID 19, I mean, when this COVID 19 started, there was, you know, a decision to be made to go aggressive or, or, or cower, I guess, from the scenario. And, you know, in my opinion, it was very clear we go aggressive because, you know,

• 1:24:23Speaker 00

  our competitors are probably going to be category B and damage control.

• 1:24:28Shane Parrish?

  So, yeah. So you can get ahead.

• 1:24:30Speaker 00

  Yeah. So, so execution is, is a big part of that. And it takes a bit of time to, to understand what execution looks like in each particular problem or a given company. So that discovery of, you know, how do we execute as a group has been something that I, I think is, is extremely important and largely the, the company is absolutely doing amazing at it. Uh, and, and that, that I think is, is one thing that, um, you know, always resonates in my head that, you know, everybody has great ideas, but how you push through is execution. You need to, you need to material, materialize those great ideas into things that are reality.

• 1:25:06Shane Parrish?

  Is there anything else you want to say about the state of cyber before we wrap this up?

• 1:25:10Speaker 00

  Have I, have I, am I out of swear jar?

• 1:25:12Shane Parrish?

  No, man. Say whatever you want.

• 1:25:15Speaker 00

  Yes.

• 1:25:15Shane Parrish?

  I think we're already explicit at this point, so.

• 1:25:18Speaker 00

  So I would say, you know, if you are a company looking for help, it can be a challenging thing. I think it's that going to the doctor scenario when you have a pain, you don't want to necessarily find out what it is because, you know, people are naturally averse to bad news. You can't be like that with cybersecurity. If you don't have a cybersecurity vendor, if you don't have a company helping you out with that problem, get on it. Everybody is a target at this point. Your company is not small enough to be off an attacker's radar. I have seen five-person companies, actually, I've seen two-person companies attacked and hit.

• 1:25:59Speaker 00

  So my advice is don't be afraid to ask for help. [email protected]. Yeah, the second thing I would say is anybody out there looking for, you know, a really cool opportunity for a really cool company, you know, the experts of the world, regardless of what company you're working for right now, we're always looking for more people.

• 1:26:16Shane Parrish?

  That's amazing. My kids call you Uncle Matt, but they also, whenever Elon Musk comes out, they say, "We know somebody who's going to do more than Elon," and we're sort of like, and they're pointing to you. So we're looking forward to seeing how this progresses over the next couple of years.

• 1:26:33Speaker 00

  I don't know how to respond to that, but that's very, that's very kind of them.

• 1:26:36Shane Parrish?

  Thanks for chatting, Matt.

• 1:26:37Speaker 00

  Yeah, thanks for having me. It was a good time.

• 1:26:43Shane Parrish?

  Hey, one more thing before we say goodbye. The Knowledge Project is produced by the team at Frontline Street. I want to make this the best podcast you listen to, and I'd love to get your feedback. If you have comments, ideas for future shows or topics, or just feedback in general, you can email me at [email protected] or follow me on Twitter at Shane A. Parrish. You can learn more about the show and find past episodes at fs.blog/podcast. If you want a transcript of this episode, go to fs.blog/tribe and join our learning community. If you found this episode valuable, share it online with the hashtag The Knowledge Project or leave a review. Until the next episode.