(Upbeat music)
>> Welcome back to the Aria in Las Vegas
Dave Valante with Dave Nicholson, FAL.CON 22
the Cube's continuous coverage.
Shawn Henry is here,
he's the president of the services division
and he's the Chief Security Officer at CrowdStrike.
And he's joined by Kevin Mandia, CEO of Mandiant.
Now part of Google.
Gents, welcome to the Cube.
>> Thank you.
>> Congrats on closing the Google deal.
>> Thank you.
>> That's great. New chapter
>> New chapter
>> Coming fresh off the keynote, you and George,
I really en enjoyed that.
Let's start there.
One of the things you talked about
was the changes, you've been in this business for a while.
I think you were talking about, you know
doing some of these early stuff in the 90s.
Wow. Things have changed a lot, the Queen.
>> Right.
>> Right. You used to put the perimeter around the Queen?
>> Yeah.
>> Build the Moat, the Queen's left her castle, new ballgame.
But you were talking about the board level knowledge
of security in the organization.
Talk about that change.
That's occurred in the last decade.
>> You know, boards are all about governance, right?
Making sure everybody's doing the right things.
And they've kind of had a hall pass
on cyber security for a long time.
Like we expect them to be great at financial diligence
they understand the financials of an organization.
You're going to see a maturity, I think in cyber security
where I think board members all know:
hey, there's risk out there.
And we're on our own to kind of defend ourselves from it,
but they don't know how to quantify it,
and they don't know how to express it.
So bottom line, boards are interested in cyber
and we just have to mature as an industry to
give them the tools they need to measure it appropriately.
>> Shawn, one of the things I wanted to ask you,
so Steven Schmidt, I noticed changed his title
from CISOs Chief Information Security Officer
to Chief Security Officer,
your title is Chief Security Officer.
Is that a nuance that has meaning
to you or is it just less acronym?
>> It depends on the organization
that you're in, in our organization
the chief security officer owns all risks.
So I have a CISO that comes underneath me.
>> Yep.
>> And I've got a security folks that are
handling our facilities, our personnel,
those sorts of things,
all of our offices around the globe.
So it's all things security.
One of the things that we found,
and Kevin and I were actually talking about this earlier,
is this intersection
between the physical world and the virtual world.
And if you've got adversaries that want to gain access
to your organization, they might do it remotely
by trying to hack into your network.
But they also might try to get one
of your employees to take an action on their behalf
or they might try to get somebody hired
into your company to take some nefarious acts.
So from a security perspective, it's
about building an envelope around all things valuable
and then working it in a collaborative way.
So there's a lot of interface, a lot of interaction
and a lot of value in putting those things together.
>> And, and you're also president of the Services Division.
Is that a P and L role or?
>> It is, we have a, yeah.
It's a P and L.
And we have an entire organization that's
doing incident response and it's a lot
of the work that we're doing with, with Kevin's folks now.
So I've got both of those hats today.
>> Okay. So self-funded so in a way, okay.
Where are companies most at risk today?
>> Huh? You want to go on that one first Shawn?
You talk faster than me, so it's bigger bang for the buck.
>> OK
>> Yeah, you know, when I, when I think about
about companies in terms of, of their risk, it's a lot
of it has to do with the expansion of the network.
Companies are adding new applications, new devices
they're expanding into new areas.
There are new technologies that are being
developed every day and that are being embraced every day.
And all of those technologies, all of those applications
all of that hardware is susceptible to attack.
Adversaries are looking
for the vulnerabilities they can exploit.
And I think just kind of that sprawl is something that is
disconcerting to me, from a security perspective,
we need to know where our assets are,
where the vulnerabilities lie, how do we plug the holes?
And having that visibility is really critical to ensure
that you're, you're involved in mitigating that,
that new architecture.
>> Anything you'd add?
>> Yeah, I would like when I,
so I can just tell you what I'm hearing
from CISOs out there.
They're worried about identity, the lateral movement
that's been kind of part of every impactful breach.
So in identity's kind of top three of mind
I would say zero trust, whatever that means.
And we all have our own definitions
of migration to zero trust and supply chain risk.
You know, whether they're the supplier
they want to make sure they can prove to their customers
they have great security practices.
Or if they're a consumer of a supply chain
they need to understand who's in their supply chain.
What are their dependencies?
How secure are they?
Those are just three topics that come up all the time.
>> As we extend, you know
talking about XDR the X being extend.
Do you see physical security
as something that's being extended into?
Or is it, or is it already, kind of readily accepted
that physical security goes
hand in hand with information security?
>> I don't think a lot
of people think that way there certainly are some
and Dave mentions Amazon and Steve Schmidt is a CSO,
>> Right.
>> There's a CISO that works for him as well,
there's clear integration,
there's an intelligence component to that.
And I think that there are certain organizations
that are starting to recognize and understand
that when we say there's no real perimeter,
it expands the network expands into the physical space.
And if you're not protecting that, you know
if you don't protect the, the server room
and somebody can actually walk in the doors unlocked
you've got a vulnerability that might be exploited.
So I think to, to recognize the value of that integration
from a security perspective, to be holistic
and for organizations to adopt the security-first philosophy
that all the employees recognize
they're the first line of defense
often times, not just from a fish,
but by somebody catching up with them
and handing 'em a thumb drive,
"Hey can you take a look at this document for me?",
that's a potential vulnerability as well.
So those things need to be integrated.
>> I thought the most interesting part of the keynote
this morning is when George asked you about
election security and you immediately went to
the election infrastructure.
And I was like, yeah, okay.
>> Right, yeah.
>> But then I was so happy to hear you
went to the disinformation, I learned something there
about your monitoring, the network effects.
>> [Shawn} Sure.
>> And actually there's a career stream around that.
>> Right.
>> The reason I had, so years ago I interviewed, it was like,
this was 2016, Robert Gates.
>> Okay.
>> Former Security of Defense.
And I, I said, yeah, but don't we have the best cyber, can't
we go on the offense.
He said, wait a minute, we have the most to lose.
>> Right.
>> But, but you gave an example where you
can identify the bots.
Like let's say there's disinformation out there.
You could actually use bots in a positive way to
disseminate the truth, in theory.
>> Could.
>> Is that something that's actually
happening out there?
>> So. Well, I think we're all still learning.
You know, you can have deep fakes
both audible files or visual files, and images.
And there's no question the next generation
you do have to professionalize the news that you consume.
And we're probably going to have to professionalize
the other side, critical thinking
because we are a marketplace of ideas in an open society.
And it's hard to tell where's the line between
someone's opinion and intentional deception, you know
and sometimes it could be the source, a foreign threat
trying to influence the hearts and minds of citizens
but there's going to be an internal threat
or domestic threat as well to people that have certain ideas
and concepts that they're zealots about.
>> Is it enough to, is it enough to simply expose where
the information is coming from?
Because, you know, look, I, I could make the case
that the Red Sox,
>> Right.
>> Are a horrible baseball team
and you should never go to Fenway.
>> In your Yankees Jersey.
>> Right. Right.
So is that disinformation, is that misinformation?
He'd say yes.
Someone else would say no, but it would be good to know
that a thousand bots from some troll farm, are behind us.
>> There's, it's helpful to know if something can be tied
to identity or is totally anonymous.
Start just there.
>> Yeah. Yeah.
>> You can still protect the identity over time.
I think all of us, if you're going to trust the source
you actually know the source.
Right? So I do believe, and by the way,
much longer conversation about anonymity
versus privacy and then trust, alright.
And all three, you could spend this whole interview on
but we have to have a trustworthy internet as well.
And that's not just in the tech and the security of it, but
over time it could very well be how we're being manipulated
as citizens and people.
>> When you guys talk to customers and peers
when somebody gets breached
what's the number one thing that you hear
that they wished they'd done that they didn't.
>> I think we talked about this earlier, and I
think identity is something that we're talking about here.
How are you, how are you protecting your assets?
How do you know who's authorized to have access?
How do you contain the, the access that they have?
And the, the area we see with these malware free attacks
where adversaries are using the existing capabilities,
the operating system to move laterally through the network.
I mean, Kevin's folks, my folks
when we respond to an incident,
it's about looking at that lateral movement to try
and get a full understanding of where the adversary's been
where they're going, what they're doing, and to try to
find a root cause analysis.
And it really is a, a critical part.
>> So part of the reason I was asking you about,
was it a P and L, cause you, you wear two hats, right?
You've got revenue generation on one side
and then you've got, you protect, you know
the company and you got peer relationships.
So the reason I bring this up is
I felt like when Stuxnet occurred
there was a lot of lip service around,
"Hey, we as an industry going to work together."
And then what you saw was a lot of attempts to monetize
you know, private data, sell private reports
and things of that nature you were referencing today, Kevin
that you think the industry's doing a much better job of
collaboration.
Is it, can you talk about that and maybe give some examples?
>> Absolutely. I mean, you know, I lived
through it as a victim of a breach couple years ago.
If you see something new and novel, I, I just
can't imagine you getting away with keeping it a secret.
I mean, I would even go,
"What are you doing, harboring that?"
If you have it that doesn't mean you tell the whole world
you don't come on your show and say,
"Hey we got something new and novel, everybody panic."
You start contacting the people that are most
germane to fixing the problem before you tell the world.
So if I see something that's new and novel
certainly calling Shawn and the team at CrowdStrike
saying, "Hey there's",
because they protect so many endpoints
and they defend nations and you got to get to Microsoft.
You have to talk to Pan.
You have to get to the companies that have a
large capability to do shields up.
And I think you do that immediately.
You can't sit on new and novel.
You get to the vendor where the vulnerability is
all these things have to happen at a great rate of speed.
>> So you guys probably won't comment
but I'm betting dollars to donuts.
This Uber Lapsus hack, you guys knew about.
>> I turn to you.
>> No comment. I'm guessing.
I'm guessing that the, that wasn't novel.
My point being, let me, let me ask it in a more
generic fashion that you can maybe comment.
You, you're, I think you're my
my inference is we're, the industry is
compressing the time between a zero day and a fix.
>> Absolutely.
>> Like dramatically.
>> Yes. Oh, awareness of it and a fix. Yes.
>> Yeah. Okay.
And a lot of the hacks that we see as lay people
in the media you've known about for quite some time
is that fair or no, not necessarily.
>> It's, you know, it's harder to handle an intrusion quietly
and discreetly these days, especially
with what you're up against and, and most CEOs
by the way, their intent isn't, let's handle it quietly
and discreetly it's what do we do about it?
And what's the right way to handle it.
And they want to inform their customers
and they want to inform people that might be impacted.
I wouldn't say we know it all that far ahead
of time, it depends.
>> And, and I, I think companies don't know it.
>> Yeah.
>> Companies don't know they've been breached for weeks
or months or years in some cases.
>> Yeah. Right.
>> Which talks about a couple things, first of all, some
of the sophistication of the adversaries, but it also talks
about the inability of companies to often detect this type
of activity.
When we're brought in is typically very quickly
after the company finds out because they recognize
they've got to take action.
They've got liability, they've got brand protection,
there's whole sorts of, of things they need to take care of
and we're brought in. It may or may not become public.
>> But CrowdStrike was founded on the premise
that the unstoppable breach is a myth.
Now that's a, that's a bold sort of vision.
We're not there yet, obviously and a CISO can't,
you know, accept that, right?
You've got to always be vigilant
but is that something that is
that we're going to actually see manifest, you know,
in any time in the near term?
I mean, thinking about the FAL.CON platform
you guys are users of that.
I don't know if that is part of the answer
but part of it's technology
but without the cultural aspects, the people side of things
you're never going to get there.
>> I can tell you, I started Mandiant
in 2004, the premise; security breaches are inevitable,
far less marketable.
Yeah. You know, stop breaches. So.
>> I, I think you have to learn how to manage this, right?
It's like healthcare, you're not going to stop every disease
but there's a lot of things that you can do to
mitigate the consequences of those things.
The same thing with network security, there's a lot
of actions that organizations can take to help protect them
in a way that allows them to live and, and operate
in a strong position.
If companies are lackadaisical, they're irresponsible,
they don't care.
Those are companies that are going to suffer.
But I think you can manage this if you're using
the right technology, the right people
you've got the right philosophy, security first.
>> In the culture.
>> Well, I can tell you very quickly,
three reasons why people think, 'why is there an intrusion?
It should just go away.'
Well, wherever money goes, crime follows.
We still have crime.
So you're still going to have intrusions
whether it has to be someone on the inside
or faulty software
and people being paid to write faulty software
you're going to have war.
That's going to create war in the cyber domain.
So information warriors are going to try to have
intrusions to get the command and control.
So wherever you have command and control
you'll have a war fighter.
And then wherever you have information, you have espionage.
So you're going to have people trying to break in at all times.
>> And, and to tie that up,
because everything Kevin said is absolutely right.
>> Nice.
And what he just said at the very end was people.
There are human beings that are
on the other side of every single attack.
And think about this, until you physically get,
physically get to the people
that are doing it and stop them.
>> Yes.
>> This will go on forever because you can block them
but they're going to move and you can block 'em again
they're going to move,
their objectives don't change because
the information you have whether it's financial information,
intellectual property, strategic military information,
that's still there.
They will always come at it
which is where that physical component comes in.
If you're able to block well enough
and they can't get you remotely,
they might send somebody in.
>> Well, I, in the keynote, I, I'm not kidding.
I'm looking around the room and I'm thinking,
there's at least one person here, that is here primarily
to gather intelligence, to help them defeat
what's being talked about here.
>> Well, you said it.
>> It's kind of creepy.
>> You said the adversary is
very well equipped and motivated.
You know, why do rob banks?
Well, that's where the money is,
but it's more than that now.
With state sponsored terrorism and, you know
exfiltration of state secrets, I mean, there's,
it's high stakes games.
>> This has become a tool of nation states in terms of,
from a political perspective, from a military perspective
if you look at what happened with Ukraine and Russia
all the work that was done
in advance by the Russians to soften up the Ukrainians,
not just collection of intelligence, not just denial
of services, but then disruptive attacks to
change the entire complexity of the battlefield.
This, this is a, an area that's never going away.
It's become ingrained in our lives.
And it's going to be utilized
for nefarious acts for many, many decades to come.
>> I mean, you're right, Shawn, we're seeing the future
of war right before us.
There is going to be, there is a cyber component now in war.
>> I think it signals, the cyber component, signals the
silent intention of nations period, the silent projection
of power probably before you see kinetics.
>> And this is where Gates says we have a lot more to lose
as a country.
So it's hard for us to go on the offense.
We have to be very careful
about our offensive capabilities because of.
>> One of the things that, that we do need to, to do though
is we need to define what the red lines are to adversaries.
Because when you talk about human beings, you've got to put a
deterrent in place so that if the adversaries know
that if you cross this line, this is what the response
is going to be.
It's the way things were done during nuclear proliferation
right?
During the cold war, here's what the actions are going to be.
It's going to be, it's going to be mutual destruction
and you can't do it.
And we didn't have a nuclear war.
We're at a point now where adversaries are pushing
the envelope constantly, where they're turning off the
lights in certain countries where they're taking
actions that are, are quite detrimental to the
host government.
And those red lines have to be very clear
very clearly defined and acted upon if they're crossed
>> As security experts,
can you always tie that signature back to
say a particular country or a particular group?
>> Absolutely, 100%, no.
>> Every time. No.
Yeah, no, it's, it's a great question.
You, you need to get attribution right to get to deterrence,
right?
And without attribution
where do you proportionately respond
to whatever act you're responding to.
So attribution's critical.
Both our companies work hard at doing it.
And it, that's why I think,
you're not going to see too many false flag
operations in cyberspace.
But when you do, and they're well crafted where
one nation masquerades as another
it it's one of the last rules
of the playground I haven't seen broken yet.
And that'll be an unfortunate day.
>> Yeah, because that mutually assure destruction,
a death spot like Putin can say,
"well, it wasn't, it wasn't me."
>> Right.
>> So...
>> And ironically, it's human intelligence.
>> Right.
>> That ultimately is going to be the only way to uncover that.
>> Human intelligence is a big component.
And, David, like when you go back to, you're referring
to Robert Gates, it's the asymmetry of cyberspace.
>> Right.
>> One person in one nation, that's not a controllable asset
could still do an act.
And it, it just adds to the complexity of
we have attribution, it's from that nation,
but was it in order?
Was it done on behalf of that nation?
Very complicated.
>> So this is an industry of superheroes.
Thank you guys for all you do
and appreciate you coming on the Cube.
>> Wow.
>> I love your Cape.
>> Thank you.
(Men laughing)
>> All right. Keep it right there.
Dave Nicholson and Dave Valante, be right back
from FAL.CON 22 from the Aria, you're watching the Cube.
(Upbeat music)