(upbeat music) >> Live from San Francisco,
it's theCUBE, covering RSA Conference 2020, San Francisco,
brought to you by Silicon Angle Media.
>> Hello, welcome to theCUBE's coverage here in Moscone,
in San Francisco, for RSA Conference 2020.
I'm John Furrier, host of theCUBE,
and you know, cyber security's the hottest thing,
transforming businesses and old IT has to transform into,
not only playing defense, but playing offense
and understand the threats, how to organize around it,
and that's been a big part of this new, next generation
architecture, operations, and just mindset.
We've got a great guest here to share his perspective.
Luke Wilson, who's the Vice President of Intelligence
for 4IQ, hot start up,
but also former FBI counter terrorism,
a variety of other DOD State Department,
tons of experience on both sides,
now on the commercial side.
Luke, thanks for coming on.
>> Thanks for having me.
So obviously, your background gives you a unique perspective
and I've been in the commercial side.
I haven't done any government service like you have
but I can tell you, IT and the enterprise, it's been boring.
>> Luke: Oh yeah.
>> We got storage,
we're provisioning storage, business servers.
Cloud comes in, it gets exciting.
>> Luke: Yeah.
>> Startups are doing cloud native, a lot more robust scale
and you start to see the new applications.
With that, the security perimeter is gone.
It's now a huge surface area,
so the enterprise has to get more FBI-like
or more smarter around how they organize, how they hire.
>> Yeah.
>> This is this is your world.
>> Yes, it is.
>> What's your take on this?
What's your view of the industry right now?
>> Well, I think right now what you're seeing is this change
from, I hate to be cliche about it,
but for years we've been playing whack-a-mole
against the bad guys.
I've seen that at my time at the FBI
and various government different agencies there.
We're starting to see a shift of all right,
they want to know, okay, how is this happening to them.
So it's just not just the what's happened,
it's like who's behind it
and in today's arena, with cyber security,
you have to start figuring out
what entity is behind these attacks,
what they're going after,
so you can start protecting that,
but then also using that information
and intelligence from there,
sharing it with other business sectors
and then also turning that big back inside
so you can have some kind of preventive maintenance as well.
>> I mean you got a lot going on there.
You used to be a nice little neat little industry
in a box, security you, buy some software
you got the servers you got firewalls, all that nice stuff.
Now you're talking about collaboration,
operating models are changing,
a whole new dimension and Open Source.
>> Luke: Yeah.
>> Has given an ability to cloak
whether it's nation-states
can now be operating under stealth mode.
>> Luke: Oh, yeah.
>> You have all kinds of new dynamics.
What does a company do?
What do you do? >> Ah, you know--
How do people solve this problem?
>> There is no one answer for that.
It's got it's going to take a community,
the community of protectors and groups
that want to help solve these issues.
In law enforcement we always say
it's a cat-and-mouse game.
We catch up to them and then they change a little you know
maybe a little bit here there
and then we catch up to them again
and we're just going to keep playing that game
but you know businesses, commercial businesses
are starting to get into that mode as well,
of hey, just because I defeated something today,
it doesn't mean it's going to be right back
at my door tomorrow.
>> You know you and I saw each other last night
at General Alexander's talk
and he's always been all about offense/defense
and understanding visibility and signals.
There's a lot to do there.
You got to know where things are coming from.
There's a lot of shared responsibility,
shared work right there.
>> Luke: Yeah.
>> There's a lot of redundancy going on in security now.
>> Luke: Oh, yeah.
>> Within companies and without companies.
So the collaboration you mentions a big part.
>> Yeah.
>> How do you see that evolving?
You work with the FBI counter terrorism.
You kind of see how this kind of thinking renders itself.
How does that work in a commercial world?
How do you see that evolving?
>> Well, you have certain cyber centers
that are built for that kind of model
for helping commercial industries deal with that threat.
There's no one tool, one company that can protect itself
from a nation-state attack.
We've seen that and so the best thing
that's happening right now
is people are starting to understand.
In order to get the entire, I would say,
typology of the attack that's affecting you,
you're going to have to share this information,
you're going to have to learn from other groups.
Law enforcement intelligence agencies are sharing
and quite frankly, we're kind of late in the game of sharing
which the criminals have been doing this now for years,
you know sharing that information
and understanding who to attack and when to attack.
>> Yeah, and they've been winning.
So I got to ask you,
as someone who's been in the industry now
and again both sides, you look the RSA this year
besides the headline of the Coronavirus,
it's got a backdrop to all this,
there's still a huge show here and the trends are changing.
It seems to be the same game, whack-a-mole on steroids
but now you got cloud.
What's new out there that's getting you excited?
What do you think people should be paying attention to?
>> Well, I think what people should be paying attention to
is now a lot of the, I would say the products
and the tools that are coming out
are actually being developed
by people who are practitioners,
have been in that space and understand what it takes
in order to defeat the types of criminals
that you're facing every day.
I see a lot of products getting into the who
and for me, I think that's a very, very strong point
now that you can't just keep saying,
"I closed this port and that port
"and this port and we're good."
No, they're just going to change one little thing
and come right back in.
So I see a lot of tools--
>> Actor identification. >> Actor identification.
>> Big time. >> Attribution.
People are trying to get to the who in this space now
in order to turn that back around for prevention as well.
So something where normally, this is an FBI,
a federal government agency
trying to figure out the who.
A lot of the tools
and some of the data today is helping out
with that poor private industry.
>> So now, a great point, great insight by the way.
I love that, I love that angle on that.
What about real time because now real time is a big one
and people are overworked.
It's a pile of threat detection out there like hey,
there's some stuff happening in another company
so people are buying feeds I get it.
>> Luke: Right
>> Now you need a data processing perspective.
>> Luke: Yes.
>> We got to get the data,
visualized. >> Yeah, you got
to get it right.
>> How is that?
How do you see that whole challenge become an opportunity?
>> Well, you know we're a data-driven society now all right,
so everything has data connected to it.
And you're getting that amount of data stream float
into your commercial entity.
First of all, it needs to be automated.
You're going to have you know a lot of data
to sift and sort through to understand
what's actually happening here.
So I think that live feed going real-time.
>> Yeah.
>> It's very helpful but also put some contacts' context
behind that and having that that information fully digested
so you can understand what's the threat,
how's it coming at you and then using that for prevention.
>> Super exciting time.
I want to get into your experience
of how that translates into maybe your advice for people
that are kind of waking up from whack-a-mole
to kind of being more of a kind
of a versatile athlete, if you will.
>> Luke: (chuckles) Cyber athlete.
>> But I got to ask you about the idea of threats
that are coming in, that you seen in the FBI
that enterprises should be paying attention to
because I'll give you an example.
I'll say, "Luke, I'm good.
"My IT department covering this for years.
"I don't really have anything that's valuable, so I'm good.
"I got my patches done so I don't really
"need to buy anything from you or I'm good.
>> Right.
>> Not everyone's saying that
but that could be the mentality a different spectrum level.
>> Right.
>> So what do you say that?
>> Well, you know-- >> Besides I'm an idiot
(laughing)
We see that a lot and I think
that's a very big naive approach about it.
You also have to start thinking about
are you good with your insider threat?
Are you good with your third-party risk threats?
So there's so many things going down the line
when you look at what it takes for
let's say a large financial institution to run,
what it takes for a large company
like an Uber or Lyft to run.
There's threats there
and if you're saying you don't have any threats,
you're okay then I would say that's another extreme.
>> You're being polite, you're being polite.
What you're saying is no, you're not okay.
>> Yeah.
>> Well, I mean because you think about it,
if you're just running
a main small little manufacturing operation
I don't have any IP but your operations is your IP,
you might be exposed to ransomware.
>> Exactly. >> You know what I'm saying?
There's always disruption.
>> Yeah.
>> This has been kind of an interesting mindset.
It's not just what you think you have.
>> Luke: Yeah.
>> There's a holistic view,
what's your take and reaction to that?
>> Yeah, It isn't the holistic view.
You have to take that approach.
You've seen what's happening nowadays
especially within the ransomware.
It may come from a third party
that basically didn't secure their systems
but they knew exactly what they were
cyber comes along exactly what they were doing
because they solely wanted to attack you.
>> Yeah. >> They knew the weakest link
was three steps down from you
and so that's exactly where they went to--
>> You know, I love these conversations on that.
I'm a patriot and I love to help our country,
I do my best.
I don't really serve in the government
but one of things I feel strongly about
and people know I rant about this all the time
when I'm on theCUBE is that digital war is happening
and I really believe that we're a free society,
we can't lock every door in this country,
we got borders, physical borders, so digital borders.
If we're open society,
you can't really be defensive all the time.
>> Luke: Yes, very true.
>> So if someone does strike us, our answer
has just been counter strike back right with a vengeance.
>> Luke: Exactly.
>> Which is how the deterrent is
but digitally where's that line?
I mean you drop troops in Manhattan
you know you're being attacked.
>> Yeah.
>> What's the digital line your opinion
because this is something that no one's talking about
but it's kind of paper cuts is that
there's a line of knowing is, are we being attacked
it's the who, what's your view on this?
I know it's an emerging area.
>> I think a little bit on both sides here.
I want to do something back
but I don't think most, especially commercial businesses
understand what that means to actually
find some attribution
and then say you know it is this entity
or this country that's doing that
and it's kind of a slippery slope
when you start
getting into that. >> It's kind of
a cutting edge societal issue
because I mean the government
has a military to protect me.
>> Right.
>> But if I'm a cyber company,
I got to build my own military, digital military.
What are we talking about here?
It's interesting.
>> Again, that's why I start seeing a lot
if you look at the place you know around here
you start looking at some of these tools.
They are offensive weapons when you look at them.
These are weapons to understand well not weapons
but tools to understand who
and you already know what happened
and so now you get the Who and the why right.
Yeah, you can't really strike back
but what you could do is turn that back inward and say,
okay, I'm going to start preventing this stuff.
>> Yeah, yeah, right.
>> But then also, hey I can go to the FBI
and say here's a nice, neat packet of information
on what happened to me and who we believe it to be.
>> Yeah.
And that's where that conversation starts to happen.
>> I'm really excited by the digital twin
and the simulation environments
where you can start having flex, you can flex scenarios
to do use some of this scenario based planning
so you can protect and plan for scenarios,
which is reacting to it.
>> Yeah, the digital training space we got there you know
and it's just like you stated earlier, right?
The United States military goes out here
and trains for certain scenarios all the time.
Companies have to start doing that
because that's what's happening to them.
>> Luke, you're right on the money.
I love the insight.
Thanks for sharing like ratings.
I love that you got to get the reps in
you got to do the operations, got to nail that.
So just give a quick plug for 4IQ.
Thanks for sharing your awesome insights.
What do you guys do and what do you guys all about,
what's your value proposition?
>> Yeah, great.
We're a identity intelligence company.
What that means is that we have tools and products
that's going to allow our clients get to that "Who?"
and we also have tools that allow them
to get to the what as well.
So we're on both sides of the fence there.
We're trying to get left a boom what they call it
but our data and our intelligence
allows these clients to find the bad guy.
Very simple, we have some AI and machine learning
built into there where it's almost like a click of a button.
I can expand and figure out who these individuals are
and understand their TTP's
And what we want to do is make automation
of these different types of tools
easier and faster for the clients to use.
>> So you want to bring intelligence
into their visibility space or data space or--
>> Yes, AI actionable intelligence ,yeah.
So basically into their digital space
of understanding their attack surface,
understanding what problems that they're having
and then we have a lot of tools
and I would call it--
>> So who calls you up?
Who's the customer, who's the buyer?
Is it the CISCO is it SOC, who's buying your stuff?
So mainly what we're into a lot
of cyber fraud fusion centers
looks like that law enforcement intelligence agencies.
I would say, I know for a fact
that I would use this if I had this tool in the FBI
and a lot of, if you have a large digital footprint,
we have cryptocurrency companies using this as well.
You're seeing some pretty bad guys
attacking your systems, trying to defraud you,
our product helps you out with that.
>> All right.
Luke, great conversation.
Thanks for coming, I appreciate it.
RSA coverage.
Take of the show, what's the hot thing at the show?
What's your favorite moment here?
What's the big story here at RSA?
I would say, for me it's this SentinelOne
Aston Martin sitting out front. (laughs)
Every year, there's something different.
I go to these Bitcoin conferences
and I see they usually have Lamborghinis out front
and now I see this is happening, so yeah.
I don't know if we're trending in that direction now.
>> Get in that car, we're going to race away.
Great.
Luke Wilson, VP of intelligence for 4IQ
here inside theCUBE.
We keep coverage of RSA, I'm John Furrier.
Thanks for watching.
(slow tempo music)