This is KZSU Stanford.
Welcome to entitled opinions.
My name is Robert Harrison.
We're coming to you from the Stanford campus.
When I got together with him last week to discuss our upcoming show,
the guest who joins me in the studio today remarked to me that in title opinions
is the most idiosyncratic podcast he's ever listened to.
And I like the sound of that.
If it's not idiosyncratic, it's not entitled opinions.
And if it's not entitled opinions, well, it's not entitled opinions.
Adiosincacy suits the brigade just fine.
Those who listen to this show come in all varieties of weirdness.
The outcasts, the outsized, the outlived, the out of mind.
The brigade knows its own.
Lovers, hermits, pagans, saints, lepers, fugitives, misfits, contortionists,
and possibilities.
The perturbed, the persecuted, the pensive, the pinnheaded, the palpitators.
They all tune in.
I wonder by my trough, what would happen if we ever
got all of you together in a room or on a hillside one day?
It would be a surreal, great awakening for sure.
So be warned, this show is for those who feed on another kind of bread and another kind
of mushroom, then you'll find at the deli next door.
Stay tuned friends, another episode of entitled opinions coming up.
[Music]
The topic of our show is cyber security.
That's something I know very little about and I'm going to sit back and learn about it
from the special guests who joins me in the studios of KZSU.
Today I want to be like one of the sea men in Conrad's Lord Jim, who I quote, "wallow
in their good chairs and think to themselves, hang exertion, let that Marlow talk."
Our Marlow today is Donnie Hassell-Tine, not our usual kind of guest on entitled opinions.
Donnie Hassell-Tine is a marine officer and veteran of the Kosovo, Iraq and Afghanistan
campaigns, a graduate of Virginia Military Institute, Joint Military Intelligence College and Naval
War College. He was a military advisor for Stanford University's hacking for defense courses.
He has recently completed Brown University's Executive Master in Cyber Security Program.
Donnie, welcome to the program.
Thanks Robert, it's great to be here.
So the first thing I should point out to our listeners is that you're still on active
duty and that any opinions you may express on this show called entitled opinions are your
own and do not reflect the policy or position of the U.S. government.
That is correct, and I appreciate that, Robert.
All right, good.
So I actually looked up the word cyber security today just to orient myself and then I told
myself, "Why am I going to go and read through this stuff when I have you, Donnie,
here to tell me and our listeners to start off with what is cyber security exactly?"
Well, it's probably fitting you started with the Lord Jim quote Robert because it actually
comes from the Greek Kubernetes, which is Steersman and it grew about in the 1940s actually
in the term cybernetics grew out of Kubernetes.
It was really a study of how systems, both living in machine, kind of communicate.
And over time, that shortened a cyber and eventually gave rise to terms like cyber or
cyber work, which came from cyber organism.
And now really, well, we see, virtually there's a cyber, everything it seems nowadays.
So Steersman.
Wow.
I knew I was going to learn a lot today.
It's off to a good start.
Yeah, so that's the etymology of the word, the history of the word.
And where do we stand now in this brave new world that we've entered into in the past decade
or two where almost everything about the organization of our society seems dependent
upon not only the computer, but the internet connections.
And when there's a malfunction with bar trains, you're listening to that traffic report
and they've been down for an hour, it's a disaster.
Absolutely.
So we are so completely dependent on an invisible cyber connectivity.
Absolutely.
And I think that, well, you really need to look at it at the very base level, is it's
really a transfer of information from place to place.
And when you talk about information, the three, or we call the triad and cyber security,
we call the CIA triad, different CIA confidentiality, integrity, and availability.
And that is, can you take information and can you, can I pass information from me to you
confidentially so no one else can read it or see it or steal it?
Is there integrity to that data?
In other words, once you receive that data, can you verify that the data that I sent is
the same data you received?
And then the availability of it is that that information in those pathways that connect
them are constantly available for the information to move across that superhighway.
So cyber security is really ensuring that that information is that trades, places, and spaces
and time moves about in a secure and available fashion for both the consumers and the
providers of that information.
And that's really the essence of how it all works.
So cyber security is also a response to cyber attacks.
Absolutely.
And if one were to take the example, which just because last week I happened here that
the bar trains for one whole, but that's not necessarily a security issue or is the CIA
pertinent to an example like that?
Yeah, absolutely.
So I would say that cyber security is fairly broad.
And I think that when you, when you use a term like security, you immediately kind of jump
to the offense defense warfare type analogies.
And there's certainly a huge application for that in cyber security, but that's why I want
to go back down to that basis of information flow.
I mean, when you really even break apart a computer network, you're really talking about
just a database of information that you're finding a way to query and extract and then
compute that information in a way that can be managed.
So if you think about the bar example, they're all the timelines of when those trains
are supposed to be moving.
There's the data coming in on how fast they're moving and what tracks they're on.
And there's computing going on in that.
So any disruption in that can cause an accident, can cause trains to be delayed, can cause
a wide variety of things.
And that is all presupposes that the information is secure in a moving about in a secure
fashion.
So I think I always bring that up as just the basic thing of where you understand.
And then from there, you get in the point of, you know, a cyber attack could be an
accident, right?
You could have a computer go down in the case of the bar example where that broke down
an entire system, but no one actually tried to make it happen.
But you can also take the point out from the human side of it as can a human then use knowledge
skills or vulnerabilities to exploit that to cause an incident that they can benefit
from.
Right.
Well, so the real pressing question we could have waited until the end, but I'm going
to write away.
How vulnerable are we in general, given that if I go to my ATM and it's not working,
I, you know, I don't have access to cash, they can't do anything at the teller.
The supermarket will not check you out if their system isn't working.
My sense is that the vulnerability is truly extreme.
On the other hand, I don't know anything about security.
Yeah.
Well, you're both extremely vulnerable and not vulnerable at the same time.
And I know that's kind of an interesting way to put it, but the vast majority of cyber
attacks occur due to human error.
And I think that's the first thing to recognize is we think of computers as kind of like this.
We make them almost this godlike infallible thing, but we got to realize that the start
that computers are made by humans and they're used by humans.
And the vulnerability is that that human computer interface.
It's your point about you personally and like talking about how vulnerable are we.
I think you have to be very careful about that we are you talking about like you and I as
private citizens and visuals, we talking about larger organizations and governments.
And I think there was a great example a few years ago at DEF CON, which is the big hacker
convention in Las Vegas every year where a reporter hired a hacker to hack into him and
see how badly he can mess up his life and did a pretty good job of it to cut to the
chase.
But there was someone in that video interview from one of the media organizations who
was a hacker himself.
And I can get the name for your listeners.
But he basically said, hey, are you concerned about getting beat up by a martial arts
expert like when you walk through campus at Stanford?
And the answers will probably know is like, but you know that if a temporary black belt
jumped out of the bushes like you would have no chance, right?
And absolutely.
Well, there are people like that on the internet and the odds are like if you start going
down dark alleys and visiting places you shouldn't go in the internet, you're going to
interface with these individuals.
But if you stay on the main, lighted thoroughfares and stick to the basics, you're probably
going to be okay.
So there's a difference between knowing the threat.
You're talking about the individual.
Right.
I'm talking about the individual just just right now.
And I would say just to briefly hit that is what we call cyber hygiene.
Don't click a link that sent you.
You know, validate the address.
Look at the URL.
If you get an update email from Apple or Google, instead of clicking the link, go to the actual
website.
And it may be worth a side point here.
I mean, as an example with the recent elections and the WikiLeaks hack of the Democrat
National Committee, you know, the John Podesta emails is a perfect example of there where he received
a spear phishing email trying to get him to click the link to reset his password.
So the hacker could then get his credentials and access it.
And he recognized that it didn't look right and talked to an IT person who said, Hey,
yeah, that's legitimate.
The IT person man, it was a legitimate spear fish.
I go reset your password now.
But it sounds like the reporting job best took like that was legitimate email and he clicked
the link and reset his password that way.
And that's what opened up that entire line of events.
So even someone who actually knew, hey, that doesn't look right.
Sometimes miscommunications the human level allow access to do that.
So the first thing is like, are you a big target?
Do you have a lot of money?
Are you a public figure?
You someone that someone wants to go after?
And the second piece, if you're not, you just do the basics right.
Have decent passwords, update your computers and regular basis.
Don't click things.
You're probably going to be safe.
Yeah.
Well, I'm not a big target at all.
But whenever I get it emails like that, I never click.
That's if they really wanted, they'll come back to me.
Or they'll call you, which is even better.
So yeah, for the individual, I understand that if you navigate carefully or sensibly,
you can be fine.
But it's the larger system, systemic issues.
The Vernor Heritage Log, the filmmaker had a documentary come up a few years ago called
Low and Behold.
Absolutely.
Yeah.
You've seen that.
And there he just imagines, like solar flares or something that can affect the internet
and communications.
And these are our other nations trying to disable an entire society of entire enemy.
Anyway, that's the systemic thing is what worries me the most, because that's where I feel
most helpless.
Because I has nothing to do with my decisions, nothing to do with my agents.
No, you're absolutely right.
In real history, like if the biggest threat, maybe due to this individual, is to have
someone take your credit card, which case you can cancel.
You have very specific actions you can take.
But if we're someone to take down the electric grid, there's really nothing you can do
about that.
And I think there's a lot of concerns about the things that could potentially take down
things.
And it's an increasing fear in a network society.
I mean, everything we have is connected.
And we start looking at the future, the very near future, with things like 5G, you're
going to see even more things be connected.
In fact, things like autonomous vehicles and other things that really work in the future
require this type of very high speed, low latency network.
But when you have that, that offers a lot of openings.
And I think the way to look at it too is every time you touch the internet, I mean, where
you touch the internet is an endpoint and that's a vulnerability.
I mean, another anecdotal story.
There was an example of hackers getting a new casino through the aquarium, because the aquarium
was connected to the internet and wasn't protected.
So you need to think of anything that touches the internet is a window or a door.
And if you're in your house, do you lock or close it?
But I mean, to get in that broader point, I think you're absolutely right.
It brings a lot of fear out there because of the potential, but at the same time, it's
really hard sometimes to quantify and understand whether that fear is well placed.
I mean, you're right.
A solar flare could generate something akin to an electromagnetic pulse that could shut down
electricity in the internet for a period of time.
But how likely is it?
What are the potentials of?
And that's the whole thing where you're trying to balance that risk.
I think that the other thing just to be aware of is just recognizing just in that network
point, what are the fail safes?
There have been examples where we start looking at like cyber physical attacks or the
ones you're talking about.
Where can I use the network to access a physical thing?
And the most famous example, that is the Aurora exercise put on my Homeland Security
in 2007 where they were able to put a generator out and connect to the internet and then
explode the generator just by sending incorrect information to get it to run out of cycle.
And that's kind of the great fear of that is how do we kind of protect ourselves against
that.
And in some cases, it's as simple as like, hey, do you have a physical off switch?
You know, some of these systems, they're all electronic when it goes haywire.
It's all electronic.
You can't actually twinning about it.
It's almost like old cars I can repair new cars.
I lift the hood.
It's plastic.
There's no way to get in there and get behind it.
So having some type of physical human interface that can bypass or pull yourself off the
network is generally, once you've disconnected from the network, you may have lost that
service, but it also has prevented continued damage until you can diagnose it.
Yeah, I've reached in my mind, Battlestar Galactico, which is a television series where
the horrible apocalyptic destruction of all of humanity or the only people surviving are the
ones aboard us, a starship that was not connected to the mainframe.
So, Donny, the brave new world that we're entering, you mentioned AI, but let's go through
some of these technologies that many of my listeners might have only a vague idea about.
So cloud technologies.
Yeah, so I mean, simply put, cloud technology is really still just a standard type of computing
thing.
It's a computer, right?
It's just the data is not on your physical terminal.
So I have my laptop up.
There's data that is physically on my computer, but there's also stuff stored in the cloud.
And what that does is they distribute that information over servers all over the world,
which gives you some type of redundant access.
So as you save information, it's stored in multiple servers that are all network together.
So the cloud isn't still a physical computer that is connected to the internet.
It's just not yours.
But that allows you to do is, if your terminal becomes disconnected or lost, you can still
eventually access that information or you can access it from effectively any point on the
internet.
So you're basically throwing the information up into the center of that network's group
of computers, knowing that if you have the right username, password, authentication,
information, you can access it wherever you go.
So it allows you to use, maximize scale.
And it allows you to basically, instead of having to keep buying memory, you can rent memory
on larger computers.
So it's a very efficient way to manage businesses.
It's a very efficient way to manage information.
And it's a way to basically ensure that availability of that CIA trial.
So if I want to see a cloud in the physical machine of it, is there any place I can go around
here?
Yeah.
There's probably servers here on the Stanford campus where it's going to be a--
That's what it is.
So if you're in a dark warehouse room that's going to have lights of aisles, like a supermarket
and every aisles going to have a set of probably Cisco or other computers switches with
instead of one ethernet cable, 50 to 100 of them sticking out, and it's all tied together
and it's connected to the internet so that when you save your Word document, it's actually
going through the internet and saving on a memory chip somewhere in one of those points.
So this is an immense service, which we all avail ourselves of.
And it sounds like we really should be quite grateful for something which for many of us
comes for free, you know?
Absolutely.
And I think that it's, you don't realize, but you have Gmail.
I mean, all your data is saved up on a cloud somewhere.
And the real big providers are Amazon Web Services, Google Cloud, and Microsoft ads.
Why do they provide those services if I can introduce my suspicion?
Oh, well, yeah, because they're getting information that they can sell to be quite
Machiavellian about it, right?
I mean, there's no one-- as we say in the cybersecurity world, if you're not paying
for the product, you're the product, right?
So in some ways, if you see something, you have a free option, one that's $5 a month.
Sometimes a $5 a month is the safe one because you're buying the ability to control your
information, whereas the free version, they're going to monetize, otherwise.
That's why I like Netflix.
I know that I'm paying for it every month.
Absolutely.
I'm not the product.
Well put, yeah, great.
So an artificial intelligence is something that I've done a show on.
And every year it seems that it's becoming more of a reality.
I mean, the cyberbolic imaginations that we used to have about it.
But the Android is not far off.
The autonomous vehicle is already becoming a reality.
Where do things stand with artificial intelligence?
What challenges does that represent?
Yeah, I think that artificial intelligence is-- you've got to look at it in a family or
a field, a wider field.
And I think when people hear artificial intelligence, a lot of times they jump to generalized
AI, which is what we think of as the terminator, something that can kind of think and act
fully on its own.
I still think we're pretty far away from that.
I think if you talked to some of the experts here at Stanford, they would back that up.
I think I told you in the act at one time where a study had kind of looked at how many
effectively on-off switches are in a neuron.
And when you figure that out, the human brain effectively has more computing power than
every computer in the planet tied together.
So I think we're a long way off to getting a point where we can create computers that
can move that fast.
Okay, hold on, can interrupt.
Then how is it that no human grandmaster of chess can even stand a chance to beat either
the-- what do they call it?
The stock fish or the new one would get a deep mind stuff.
The alpha zero or something.
Is that just because it's computational?
That's speed and computation and also what is the real field of AI that we're pretty
good at or getting good at is specialized AI.
Like we can build something that can do some very specific tasks much, much faster than
a human.
And I think that that's the difference is that the thing that AI and machine learning
bring, it allows you to move at machine speed, which is a factually light speed as opposed
to human speed, which is significantly slower.
So in some cases, the human brain may have the computing power, but it is not organized
and designed for that level of precision and speed.
And I think that's the real piece out there.
But the challenge really that we're struggling with AI is you still have to teach the system.
There's no-- there's not really one that can really completely learn on its own.
So what that really ties into is the machine learning aspect where you build a series of
algorithms.
And those algorithms try to read, for example, an image.
You still have to humans go in and look and correct those images to say, yes, that's a
cat or yes, that's a dog.
And eventually the computer gets fast enough to learn and it can recognize that.
And you see that, and what you can do on Google today.
Eventually we're getting to now and again, there's some projects on Stanford that do
this, trying to do what's called unsupervised learning, where I can build a set of algorithms,
I can feed in information, the computer can start to learn that information itself and
have a human kind of check it on the backside.
So that is really what's going to lead us to a level where that AI really catapults a
to point work in maneuver and operate and think on its own.
But again, I think we'll find it stills in me, a fairly defined lane, like autonomous
car, it's going to do great at driving a car.
It's not going to make you espresso.
You know, like it's not going to be able to jump from one task to another very easily.
Although I did read this, what for me was a fascinating account in this science section
of the New York Times, I think I know exactly when it was because it was right at the beginning
of a course I was teaching on Jumbatista, Vico, and I brought it in as an example of this
Alpha Zero chess AI, which apparently taught itself by playing itself, and it took only
like 20 minutes to play itself, millions of times.
And having done that millions of times, it learned kind of on its own, unlike the stockfish
which it crushed in a competition, which was the kind of AI that you were describing, where
human beings have to supervise, have to input the principles and get it to do the thing
that humans have to think for it.
Whereas apparently this new one kind of was thinking for itself and had moves that at least
looked very intuitive and surprising.
And yeah, I think you're referring to Alpha Go, which was the now the Google project that
did the Chinese go game, which is I know fascinating.
I know about the Alpha Go as well, but this is called Alpha Zero.
And the mathematician from Cornell who was the author of this article was speaking about
how that will soon be an Alpha Infinity.
Anyway, the idea was that it did not play chess like a brute machine.
It played chess like so much.
Yeah, you want some finesse.
finesse and even engaged in this what is known as romantic chess, which is intuitive.
There's such an actual thing in the history of chess called romantic chess.
Anyway that author then goes on to imagine a kind of Alpha Infinity where humans will turn
to that new form of intelligence for all the knowledge that we ourselves would never be
able to arrive at on our own.
And anyway, it was interesting to me because this guy I was teaching Vico said that we
can only know that which we make.
That making is kind of conditioned for knowing.
But how we can make something that we ourselves can't know what it knows if you extrapolate
to that kind of Alpha Infinity future, that is a dilemma, a conundrum that that that
is a paradox.
And I think you're absolutely right.
I think that's something I think we're struggling with.
I mean, you see things where you have these computers and these AI now that do their own
art and some of its bizarre, some of its interesting, and then others where they had the
one example not too long ago where they started having computers kind of connect.
These artificial intelligence talked to each other and eventually they invented their
own language and no one really knew what they were saying or what whether it's gibberish
what was going on eventually they just shut it down and you're right.
We are making things now that kind of hit that paradox where we're making things that
make things that we can't understand which is kind of fascinating and human history I think.
So you mentioned 5G just very briefly in passing and this is another kind of specter that
is looming.
I hear it on news programs and beware of the 5G era is coming that it's everything
is going to change with 5G.
Can you tell us what 5G is about?
It's interesting because I think that a lot of times when you think about the previous
technology which have kind of backwards been termed 1G, 2G, 3G and 4G, when you line things
up a number you think it's the same distance but really 5G is an exponential change from
4G and to put it in more specific terms is it allows you it uses much smaller waves with
radio wavelengths which allows you to send a lot more information.
The problem with smaller wavelengths that get deflected easier but the technology is now
allowed us to shrink the antenna size and make compact like constellations of antennas
that allow you to broadcast and connect in certain ways.
And really what it allows you to do is right now really the fastest internet you're probably
going to get is through a cable modem at your house.
This will allow you to transmit over the air probably something 10 to 20 times faster
than what's currently wired cable internet.
It probably rival optical fiber and the other piece that's not just the speed it's the
latency.
You know when you access a website it's not just you ask one question and the database
spits out the whole website.
There's hundreds of little packets that transfer over and if any one of those packets gets
delayed because they're all taking some kind of different pathways to your device that delays
the reconstruction of the image but this will drop latency by 60 to 120 times what we currently
have.
What that allows you to do is move high fidelity data very quickly across a wide range of
devices and really what that allows you to do is do things like autonomous vehicles because
for autonomous vehicles to work we started out with using cameras and lidar to map what's
around us but the real thing that five G-brings allows the different cars to talk to each
other.
So instead of sensing a car and interpolating what it's speed is and moving around it you
can actually communicate all of the diagnostics for those two vehicles and really time
how you're moving together.
So that really gives us ability to take all of our technology and really exponentially
increase the way it moves because it goes back again the information is everything drives
an information.
If you can move information faster and with less latency it allows you to do things that
previously were unimaginable.
Yeah I see it coming down here.
You know I bought my cars is the last year before they started putting computers into
the cars because I don't like cars that are smarter than me and I don't like the idea that
they have this electronic dependency but I see the day coming where it's going to be
obligatory by law to have a communication system so that your car can communicate with
other cars on the road otherwise you're not going to be allowed on the road.
So it is a brave new world definitely with this five G. So increase speed I never need
any more speed than what I would tell you how primitive I am.
If I call up a Wikipedia you know if my Google cyber security it comes up right away.
I can stream live stream things on a computer but seems perfectly fast enough for me but
I guess people need more speed for these other sorts of operations.
So just another two things quickly before we move into the question of where is it?
Where are the real threats coming from these days?
So you have this thing here on quantum and edge computing?
Yeah and I'll just briefly hit that and honestly I'm by no means an expert in those points
but you know quantum computing is really what we're looking at is taking what we now
think of as physical switches and dropping it down to the quantum level so in other words
can you use the actual movement of atoms as an on/off switch because if you take your computer
and boil it down to the very very bottom all it is is a
millions of on/off switches and that's how they communicate and save and all the data
but right now you're hitting the physical limits of being able to create a chip that
can have that number of switches.
A quantum device allows you to bring those switches down to the atomic level which allows
you to pack even more switches in what can find space which means you can just do a lot
more computing power and then edge computing is kind of working with how they can
manage the data storage like we talked about the cloud and get that computing as close as
it can to the point of where it's actually needed and really that that's being applied
to someone who talks about autonomous vehicles and other things like that.
That's great.
So lastly this category of the Brave New World blockchain and cryptocurrencies.
Yeah and blockchain has a lot of interesting potential.
The biggest thing I would say about this is that I think a lot of people look at blockchain
and cryptocurrencies one and the same and they're very different things.
Cryptocurrencies are based on blockchain technology and concepts but you can do blockchain
for a lot of different things and what blockchain really is is it's a, effectively a
ledger system.
What it allows you to do is I would basically write down say a transaction and I would
write it down and I would show it to other people like for example yourself and friends
and each of you would validate that transaction say yep that's a valid transaction.
At that point there's a way you can cryptographically hash that which is basically to lock
the data so you can anyone can check whether that data has been tamper with.
And as you do that each time you add another chain to that calculation so you end up getting
a series of transactions which prevents anyone from being able to go back and tamper with
a previous transaction.
So there is potential for things like any type of business or financial transactions
or stuff is like real estate for example when you do title insurance and you title research
you could do all that on the blockchain and then you have a irrevocable, unchangeable
ledger system to manage things and that's really what the cryptocurrencies are based on
is that type of technology but they're not, they're kind of two different things.
Great.
So maybe we can now move to this question of where the big threats are coming from we touched
on it at the beginning a little bit but we can get more specific when it comes to for
example the question of nation states is cyber attack going to be a new form of warfare?
Yeah and I think it certainly is and it already on some ways become one.
I mean if you think about human existence there's always a series of conflict going on
and there's always an aspect of countries and organizations position themselves for
advantage, either on an individual, on a business or a nation state level.
And really when you take a look at it now as we see with military weapons nation states
have been the only real groups organizations that can muster the resources to do large scale
weapons things like nuclear weapons.
So they still have, while some cases you can have individuals now and transnational groups
muster some technologies still in the world stage the most dangerous cyber weapons can
be built and utilized by nation states and you'll often hear the term advanced persistent
threats or APT's reference there because that's really the people that can really get in and
really break apart computers or hack into things at a level that's really hard to see.
So the other options beyond nation states these advanced persistent threats would be cyber
criminals and hacktivists and cyber criminals are what you say people using cyber and hacking
to basically steal money and use for business purposes and then hacktivists generally hacktivists
are individuals who are groups that have largely used it in some cases more of a defacement
or a political movement or a sign they use the hacking and cyber offense and cyber weapons
to basically make a political statement.
Those are the three probably big big groups.
I think the biggest thing to realize is the real large scale types of efforts out there.
I have moved way beyond you know an individual in a garage and it's moved into a organized
business and organized military weapon that can be used to really position yourself in conflict.
Okay so I gather that the threat is mostly human.
You're not too worried about any kind of natural disaster or something.
Well yeah I think that there's certainly an aspect of that and even if you talk on the cyber
security realm there's a whole realm or domain on physical security and physical disaster
response that has to go into everything.
So I mean that's always a whole kind of different ranges if we have an earthquake that
takes out one of those server banks how do we how are we how is the network resilient
enough to kind of move past that.
So I don't mean to move past that and say that's not a concern certainly is but I think
that the thing that captures people's imagination oftentimes is more the nation state hacking
more than the solar flare although you're right both could dramatically affect the
network and connectivity.
So speaking about that kind of malicious intentional attacks so how are these attacks executed?
You talked about fishing earlier but there's probably a lot more to it than that.
Yeah absolutely I mean believe it or not fishing is actually a fairly one of the most commonly
used tactics and I think the first thing to think about is what is known as the cyber
kill chain and that's pulled from a military background and what it is it talks through
what you need to do to get a cyber weapon to work.
And the first point is is reconnaissance which is doing your research on the target and figuring
out something as simple like if we're going to talk an efficient example I want to hack
Robert Harrison Stanford what is what is Stanford's email address it's at Stanford IDD
okay what is what are the names is it first name dot last name is initials doing that type
of research and once you've identified the individuals or the email contracts now you've
got information on how you might be able to access them.
Then you have to weaponize you have to build something that can be packaged into a document
or a link or something else that once I get you to click or download or access it it
gives an opening for me to get into it at that point I email that to you that's your delivery
exploitation is me exploiting you clicking on that link and then that allows me to install
malware on your system then I work command and control to talk back and forth that malware
and then eventually what I try to do is do lateral movement across the network where I pick
the weakest point or the person that has access to the network I need and I use that as a door
to get in and try to escalate my privilege and get further and further and deeper in that
work to find what I want and then actually trade that data or deploy that so I think
that's the first thing to think about it's it's an extended chain if you disrupt any
step in that process that kind of defeats the attack so fishing is often that delivery
method and there's a couple different versions out there and I'll throw some out there
because they get kind of creative but there's the fishing but then there's also what's called
spear fishing where fishing you tend to have the Nigerian prince email that goes out to
a hundred thousand people the spear fishing is is I'm going after the CEO of this or really
any specific individual they call whale fishing is when you go after a big fish a specific
individual so if I'm going to try to specifically engage the CEO or a government official
that would be the whale fishing and then there's two other things out there which are kind
of funny called smishing and fishing and smishing is is getting you to click on a
link or getting you access by SMS texting you and fishing is is just calling you up on
the phone and getting you to give your password over the phone and again at DEF kind
of a year they have a fantastic competition where you can enter the competition and if they
do you get tans to do research on a target and they lock you in a glass booth in front
of the audience and you have a set time limit to try to get as much information out of the
person on the phone and eventually the the winner that gets the most points ultimately
will get them to navigate to a malicious page and open up and open up a document all via
the phone and you can go look online there's some pretty fantastic examples of what people
will just tell you a clean side even just there was one the other day where someone
just walked down the street and started interviewing about computer passwords and they say
like what do you think a good password would be is like oh well like maybe you know
something that's important to me like maybe my favorite color and then maybe you know
my favorite number and then maybe a birthday and there's like oh yeah it's great so
where you from like yeah so what's your favorite color oh it's green or like you know
made my high school mascot oh really what high school did you go to and you'll see them
just literally tell them the framework for the password and the actual password itself
in a five-interview with a stranger on the street so again it kind of goes back to what
actually said the weaknesses often often human so that that's kind of the fishing social engineering
piece there's there's other things out there not kind of just run through a few of them
there and we can kind of dive deep dive into one is need to there's often called denial
of service and what that effectively allows you to do is if you think of like the internet
is two computers talking to each other if you think about Amazon right Amazon has thousand
hundred thousand millions of people all over and stuff at the same time well if you
figure out how many effectively incoming requests in that website handle and I triple it
and do it all at the same time it can crash the website and so using denial of service or
distributed denial of service allows you to basically use multiple computers and oftentimes
malware will do this they'll get malware on your computer and when you're not using your
computer in the background someone's using that computational power to basically send queries
to a website to basically engage and bring down that website that's kind of a denial
of service and that's again it more of a temporary jamming sort of thing and then other things
people do is ran somewhere that's pretty common for cyber criminals some nation states do
as well where they'll go in and lock down information and then extract a ransom to unencrypted
information and then crypto jacking is no one out there this relates to the cryptocurrencies
where people because it's not tangible money it's all digital right so if I can get
ways to break into that I can extract that information and a lot of times the way cryptocurrencies
reward you new gain money is actually adding to that transaction and computing which
eventually takes more and more computing power and what you'll find is people install
malware to muster millions of computers that people like your own computer not realizing
and when you're at home and not using it again use that computing power to crank and
gain cryptocurrencies for the user so those are some different things that are used out there
as far as the threats so I'm going to assume that nation states are intensely aware of the
threats and are also taking steps to protect themselves from it no absolutely and it's
not just protecting themselves against other nation states or protecting themselves against
the same things cyber criminals hackdivists I mean a while ago when we had a you know
incident with a Chinese pilot I've remember the specifics of it a few years ago is Chinese
hackers not sure who took down some US government websites and defaced them you know
we are constantly working to kind of protect our networks and ensure that they're safe
but it gets very interesting when you think about how different nation states think about
things and when you think about for example in the United States you might have a company
with intellectual property another nation state may want to desire to steal that intellectual property
in some nation states you have a case where the government health protect their companies
in other cases where the United States you have an interesting point where we don't
necessarily protect all of our individual companies we help facilitate that but it's
one of those points where is if you and detect an intrusion you need to call the
FBI to come in and assist and then how do we kind of break that apart and discover who's
out there there's a lot of best practices which our home and security distribute out there's
also what's called a isax were basically different industry verticals gather together
and share information with each other so that if one person's attack you get a little
bit of a herd immunity where you share that very rapidly and try to protect other people
that industry against potential attacks from whoever they might be so don't you about
the issue that gets a lot of attention these say about elections and the hacking or how
you know Russia is is trying to and I believe Russia has successfully I don't want to say
destabilize but it but it certainly seems that with the chaos that it's it has engendered
if not deliberately then they lucked out because our reaction has been you know really
quite hysterical in the last two years and we've gone into a mode of civil war in this
country because we have a president who doesn't come out and openly denounce you know Russia
for what it's been accused of doing by the secret services which is tampering with the
elections even if it was more or less not nearly as bad as one might have imagined the
idea is that we we now have this uneasiness about whether our election process has the
the same kind of integrity that we would have assumed that it had before and are we just
overreacting to this
uh... yes and now and i mean i'm not gonna comment on the any the political aspects there
with the president and and how it works with russia will say though that
there's when you talk about social media in the way social media has the ability to amplify
voices good bad and different
i think there are a lot of potential for what's called influence operations and i think
that um...
there's two ways to look at it's
whether individuals either groups within or without the united states are
stimulating that type of conflict and stoking that conflict
that's one aspect to potentially influence election potentially influence a
government i think the other way to look at is
is the actual hacking of
elections and i think that
in some ways that's kind of interesting is both deal with information and
the fascinating thing about the united states system is is we are so distributed
and this goes into kind of the resilience is when you distribute
systems
it's much harder to hack because you
there's a hundred systems you can only have two of them
you're gonna get that resilience when you take a look in the united states i
think we have something close to
nineteen thousand different
individual local
entities that handle elections
so being able to twist the election process and is normally hard if you're
trying to come at it and they all use
different systems different authentication methods
uh... to that i think that
there's certainly room there
to improve ourselves in election security and
do a better public private partnership there to
find ways to protect the individual vote
and i think that's probably a tainable
the point that you mentioned at the beginning which is
how do we
work with information that may be coming from a bot
or a
foreign entity
or a
disparate group
and how do we
adjust how that
influence works on our fellow citizens
that's much for your problem and i think it's less technical and it more
because it gets in the free speech aspect
i think if you can say you're talking about manipulating social media
and fake news and uh...
finding ways to uh... spread
false stories and and and and and and and and site for the inside all these
uh... in planet well
i mean i'm the passions right i think right now you've seen that if you look
at uh... something called deep fakes which is
the ability now to take
a video of a person
you can record and track the facial movements and you can actually now
replay that
and have like another words i can
take a
a video of a public figure and then videotape you
and you can say whatever you want
and it can actually make the video look like they're speaking so
you have the ability now to actually pick a world leaders face
on
another person effectively and and does that qualify as cyber attack i i i i
i think that
i think it's being certainly looked at from a cyber security standpoint because
one one of the things are looking at is how do we
authenticate those videos how do we encrypt and
effectively do a digital signature you know when i send you an email i can
cryptographically sign it so you know it came from me
is a way to do that in watermark those videos in such a way
that uh...
we can make sure we know because
if you're taking
you know picky maybe a country that's less stable or even country is stable
and you suddenly
put that country's leader up
saying something that can incite violence
you have the ability to really have a pretty profound effect on things i
think that uh...
the challenge there is really can we differentiate between
saying the united states
a fellow citizen exercise in free speech
and a
foreign entity or
machine learning driven
uh... social media voice that is trying to incite conflict
yeah that's
well
it's hard to keep up with
what is possible not possible i think when uh... just before we came on
air you're telling me that now you there's technology that tell
how a person sits and what they're
it's that you can track
yeah and i think that you know as an example i would say that
and this kind of ties into to overall social or overall cybersecurity is
one of the key things we use to help you talk about how normal person can help
them
sells protect on some cybersecurity
one of things we use is called to factor authentication
and you see that in a lot of things and what that really means is
something you know
like you're in password
something you have i a phone or device
and something you are i a biometrics
the fascinating thing is biometrics
as large as you can find a thing's like
a thumbprint
and a retinal scan
but now i get a point of like
what time do you wake up in the morning how do you sit in a chair to to your
example
you know how do you move around
and it can start basically quantifying
your human habits to develop a profile to say
i can identify someone not just by face
or other things but i can identify them by
how they walk how they talk
how they sit
how they move
and that has one fascinating aspect from the fact that
now i can protect the my network because i know that
when someone sits down the chair and logs in if it's there's a disparity between
those two
i can lock down that system
but also as profound locations for like a surveillance type aspect in
what can be done with that information
once it's collected
so i think that's another thing i would always throughout you when you
fill out things and you're
trying to decide what you put into a computer
don't put anything in the you can't change
you know like
you can change your name you can change a password
you can change your hair color right you
you probably can't change a fingerprint you probably can't change some of
these other things of who you are and that's
the old white and why is apple or why are the iPhones
they they all have to have the uh... the thumbprint or now the facial
recognition everyone
finds that such an advantage it's convenient
and i think that's one of those things where you always security is always
balance with convenience so you can make something
completely secure i mean really nothing in the computer you get something the
the ninety-nine percent right
but um... it's terribly inconvenient almost unusual
but you're advised you advise us against that well
i would always advise again is it as a becoming cyber security professional is
you always have to find the balance of
usability and convenience with security
and a lot of times that comes with assessing the risk properly and deciding
it was the likelihood of this because if it's a high likelihood and it's a
high payoff
you probably in a ramp up the security and drop the convenience just like
it's fairly easy for you to log in your Stanford computer but it's probably hard for you to access
the servers
you know directly right
well in the few minutes we have remained on it can i ask it's not a personal
question but it's a question of your biography because you're being a marine
you're you
given a number of years for your life to
defense
does going into this new
realm of cybersecurity is that continuous with your vocation as uh...
as a marine or is it is it something
different do you do you consider it of still part of the national defense or
some other uh... path that you're going to get into the other side i think that
um... yeah i've had a great uh... time in the marine core and i've been very proud of my service and i think
the issue about cybersecurity is is really in some ways you could argue that's
really where the fight is now it's in it's in cyber space
and uh... that's not to say there's opportunities in the military side certainly
but i think you know when you think about it especially during silicon valley
i mean the amount of
research and development and new technologies out here
in this area is is absolutely phenomenal
you've got a real eyes though that intellectual property other people are
trying to take it and that has national security implications so in some ways
if you can
bring cybersecurity a private industry it does i think help the national
security in the nation as a whole
so uh...
what are your plans now that you have your degree from brown university
well i'm i'm right now the process of closed out my career in the marine core and
and then i'm right now working to uh... transition
about to start doing some cybersecurity work
for some uh... software service companies here in silicon valley
and uh... hope and help protect them and give them some of that knowledge
well that's great
thanks for all your service we've been speaking with dony hassell team
who's been our guest here to talk about something that
i've learned a lot about it in the last hour and i know that all my listeners
have learned a lot
from what you have to share with us so thanks again for coming on to entitled
opinions
that's been pleasure thank you for taking care
uh...
[BLANK_AUDIO]