--:-- Host: It's time to hand over cybersecurity to computers. Entropy is increasing. They have more apps, more entitlements, and more actors. Every single year, it's exponential growth in the number of public breaches, the size of the breaches, the damage in the breaches, vendors still exploding. How can they watch out for a bank run that's orchestrated by a deepfake campaign? If this is indeed state-backed, this is probably not the only thing they did in that two-year period. In 2022, $8.8 billion was lost by consumers alone in the US. How can we build compound businesses from day one? How can you actually build a platform from day one even though you're a startup? Who does security? Nobody does security. The cost to launch a disinformation campaign that's AI generated is quickly approaching zero.
--:-- Host: Now that the cybersecurity industry commands a market of hundreds of billions of dollars, it's easy to forget how this industry once ceased to exist. And in its few decades of rapid growth, things have changed a whole lot. So in today's episode, we'll take you on a tour through the history of security, which can't be disentangled from the history of the internet and culture. This episode was actually recorded at A16Z's Campfire Sessions event this April, where our infrastructure team brought in some of the top security minds in the industry. And just like any good Campfire Session, today you'll hear four people talk candidly about what's really keeping them up at night. From what really happened with the XZ Utils attack, to new AI threat factors that are already impacting companies, to empowering overworked developers, and a lot more.
--:-- Host: For those both inside and outside the security community, I hope this episode is a helpful reminder of just how much has changed throughout the years for both offenders and defenders of trustworthy computing. So with that, we'll start with Travis McPeak, co-founder and CEO of Resourcely, who will walk us through how we really got here. Let's kick things off in 1995.
--:-- Host: As a reminder, the content here is for informational purposes only, should not be taken as legal, business, tax, or investment advice, or be used to evaluate any investment or security, and is not directed at any investors or potential investors in any A16Z fund. Please note that A16Z and its affiliates may also maintain investments in the companies discussed in this podcast. For more details, including a link to our investments, please see A16Z.com slash disclosures.
--:-- Travis McPeak: Okay, phase zero, the Dark Ages. The year is 1995. Billboard number one song, Gangster's Paradise. The box office number one was Batman Forever. Nostalgia for the old people here. Who does security? Nobody does security. It was a totally different world. You have to realize that we didn't have much internet connectivity. Patching wasn't really much of a thing. Vendors were basically just antivirus and the start of firewalls.
--:-- Travis McPeak: Milestones of this dark age's time: we had the first DEF CON. We had the first CISO, Stephen Katz at Citicorp. That year, they actually had a breach where somebody stole money. And they said, "This can never happen again without us having someone to go chop their head off when it happens." So this is the first CISO. We have the first word macro virus. The first bug bounty came from Netscape. As we'll get to, Netscape did a lot of cool things that moved forward security. And of course, the hackers movie.
--:-- Travis McPeak: It was web 1.0. It wasn't an app that you went and dealt with. It was a site that you came to. This is Apple's site from '97. Hackers are like these dingy people. It's not like an actual job. One of the things that really moved from this to the next phase was web browsers went from that Apple thing that I just showed you to a place that you go do business. Netscape made a lot of those things possible. They brought forward SSL, they had the first bug bounty. They were putting forward a standard of how we're going to build apps on the internet, and that standard was JavaScript. At the same time we had Java, which was one of the first ways of building apps on the internet from an old company called Sun, today known as Facebook. Checkpoint was founded in 1993 from somebody that came directly out of IDF and used all of the stuff that they learned to productize the web application firewall.
--:-- Travis McPeak: Okay, phase two. Security is an actual thing, but it's a function of IT. So the year is 2001. Billboard number one is "Hanging by a Moment." Box office number one is Harry Potter and the Sorcerer's Stone. Who does security? IT does security. Context here: this is the start of when we get big hacking. It's not just a thing that happens once in a while. Businesses have all either moved online or are rapidly moving online. Vendors now are antivirus, firewalls, systems management.
--:-- Travis McPeak: Milestones here: Microsoft engineers coined the term SQL injection in '98. The first big internet worm that made it bad for business was Code Red. The first Patch Tuesday was in 2003. And for anybody that's old like me, we had this Y2K thing, which was actually a complete nothing burger. But what was interesting about it is we cared enough about computers and what they do that we thought it might be a thing.
--:-- Travis McPeak: One of the changes here was bugtraq and full disclosure. Back in the day, we had mailing lists, bugtraq. People would send security vulnerability reports and vendors would basically do nothing with it. They'd just sit on it forever. There was this big moment at the time, full disclosure, where it's like, "Okay, well, we're just going to put the full gory details of this thing and force action from vendors." And that led to regular patching cycles. Microsoft quickly copied that. We also had the first web application security tool. This is Nikto, an old one from 2001. It was kind of open source. But this is the beginning of these tools being broadly available.
--:-- Travis McPeak: This is the beginning of what I call the tail wagging the dog when it comes to vendors and security. From some of the folks I talked to, we basically have these new attack paths. And the buyers, in this case IT, were very uneducated about how this works. It's like you need to have your web port open. It needs to be legit open. And I can get in and compromise you through that. IT didn't understand it very well. So vendors had to do their part to come and educate the IT buyers that this was possible. What this looked like was basically, "I just completely compromised all your systems." And they said, "How did you do that?" And then you explain why web application security is an actual thing and why they need a vendor solution for it.
--:-- Travis McPeak: All right, phase two is the risk sign-off function. The year is 2004. Billboard number one is "Yeah" by Usher and Lil Jon. Box office is Shrek 2. This is what phones looked like. By the way, these phones will last longer than you will. These things were basically indestructible. Who does security? Now we have a security team that does it. This isn't just a thing that IT does with some of their time. This is when we start to get the beginning of traditional security activities. We have Microsoft basically getting popped in the mouth and they need to do some stuff differently. Tech companies start hiring people that are actually called security. Vendors now is exploding. We have antivirus, firewall still, email security, web application firewall, DAST and SAST.
--:-- Travis McPeak: Milestones here: we had the first use of the term cross-site scripting, again, by Microsoft engineers. OWASP was founded in 2001. The first use of the term shift left, I actually thought it was much more recent, but this is a very old term. And then SOX regulation was, I think, the first compliance standard that actually mandated some security activities. There was a growing community of folks that were really interested in web security and all of what's possible here. And Mark Curphey started this group called OWASP to basically make this knowledge more socialized so that people knew about it. One of the first projects in OWASP was the OWASP Top 10. And that immediately became, "How can I get my vendor stuff to be one of the top 10 things that people are buying?" So this is yet more tail wagging the dog. It's like, "Oh, my thing should be in the top five for sure because it's going to help us sell a lot more of it."
--:-- Travis McPeak: Now we have the beginning of the big internet worms. At the time, Windows basically didn't come with any firewall. You start it up, it would get immediately compromised by stuff. The worms here were costing a lot of money. We had attacks like Mafiaboy's DDoS in 2000. It took down more than 1 million of the 5 million IIS servers and cost an estimated $2.6 billion in damages. For part of this, Microsoft had these big customers that were saying, "Hey, we're just getting killed because we're using Windows." And this led, in part, to trustworthy computing. Basically, "We need to see the light. We can't just keep doing business as is." Bill Gates saw a very early version of a book that Microsoft folks were writing on these security practices. And that led him to say, "We need to completely change what we're doing. We're losing trust with customers." And that was the beginning of what we consider traditional security activities today. We have threat modeling, STRIDE, all of these things are being birthed around this time.
--:-- Travis McPeak: We also get more compliance. PCI DSS version one was written in 2004. This mandated security activities. Again, vendors are trying to get themselves into the standards so that they can sell more product. It's like, "Okay, well, if you're going to deal with payment card data, then you need to do web scanning, for example." Proofpoint was an example of one of the companies here. This was founded in 2002, still around today, very successful in email security. As soon as you have email being used as widely as it is today, and we also have email viruses, it's, "Okay, we're going to need something to filter out spam and viruses." So Proofpoint started that. And also Imperva, a big web application firewall that's also still around today.
--:-- Travis McPeak: Okay, phase three is DevSecOps. The year is 2013. Billboard number one is "Thrift Shop." Box office number one is Iron Man. Who does security? It's everybody's job. We've collectively decided that security doesn't scale. We've been this sign-off function that you have to do with security before you ship your product for the year. And now we're moving to cloud and we're doing continuous deployment and security is like, "I don't know when I do these assessments anymore." So what we do is we basically take every single developer and tell them, "And guess what? Good news, you're a security person now."
--:-- Travis McPeak: We're also getting more and more mega breaches. If you look at the numbers from this time, every single year it's exponential growth in the number of public breaches, the size of the breaches, the damage in the breaches. Vendors still exploding. So EDR, next-gen firewall detection, all the posture management, dev training, bug bounty. Milestones: the first use of the term DevSecOps was actually in 2013. And we had the first CSPM, which gave birth to this massive posture management industry that we have today. We start to see "no before," right? It's like we're going to train developers continuously. Developers are going to learn about all of the types of cross-site scripting and SQL injection with one day, once per year of training, where they learn it and then they immediately forget it the next day. We also have big bug bounties, crowdsourcing more and more vulnerabilities in the hopes that the attackers aren't going to use these things to cause massive breaches for us.
--:-- Travis McPeak: So much posture management. The first was cloud security posture management. Evident was the first company here. At Netflix, they had also created Security Monkey, which is basically open source posture management. And since then, posture management just exploding all over the place. We have AppSec posture management, data security posture management, identity posture management, SSPM, whatever that bottom posture management is. Just so much posture management everywhere. And what these things are really good at doing is going and finding problems after they're already deployed. And then you have to go do something about it because just knowing about risk, you can't just tell your boss, "Hey, okay, well, here's all the risk that we have." They're going to want you to reduce it somehow. So what we moved to, since this is now developers owning security, is we rip a bunch of Jira tickets for them and we call it a day.
--:-- Travis McPeak: We also are getting at this time a job shortage. The first time the job shortage news articles was in 2015, early 2016. We're short a million jobs already in 2016. This is just piling up more and more. We don't have enough security people to actually do the work that we need them to do.
--:-- Travis McPeak: So where does this leave us? I think that we're entering a new phase, phase four of security. We're basically telling developers it's your job, you fix security all the time. Didn't particularly scale well. I think that that's becoming very evident today. So years 2020, "Blinding Lights" is number one. Box office is Bad Boys for Life. Who does security? I think systems do security. What we're doing doesn't scale. We have developer fatigue. I hear people tell me all the time, "Oh, we take the posture management and then we just filter out everything that's not high or critical. And then we ship those Jira tickets to developers." Training relentlessly, obviously, it doesn't matter how many times we've trained developers on all the SQL injection types. They still don't remember it. And really, they shouldn't have to.
--:-- Travis McPeak: Milestones: one of the projects that really informed how I see this is Lemur, that Netflix released in 2015. Google launched the Identity Aware Proxy in 2017. Chrome added a password manager by default back in 2018. And Clint Gibler, one of my friends and somebody that has done a lot of work in the space, did his talk in 2021 called "How to Eradicate Vulnerability Classes."
--:-- Travis McPeak: Lemur, when I got to Netflix, it was in 2017, and I remember just being blown away at how easy it was for our developers to just get things like certificates without having to select a cipher suite and pick crypto parameters and rotate it and store your private key securely. It just made it dead simple. The benefit of this is that developers never have to learn about crypto anything. They just get it for free. Google has done probably more work than anybody here. They upscale people to HTTPS automatically. Chrome updates itself, which became standard for many other pieces of software. We have these basically impossible to mess up Go libraries to handle a lot of security things.
--:-- Travis McPeak: Actually, my mom sent me this article recently. Mom's so funny. She knows that I work in security and sends me everything that has security in it out of the Wall Street Journal. Usually it's something that either happened three months ago or it's got nothing to do with me. But this one was written by Larry Ellison, and it's not very old. His point is it's time to hand over cybersecurity to computers. Basically, just relentlessly hounding the users and trying to get the users to be smarter, it doesn't work anymore. What we want to get is developers back to just writing app code, working on the business and not having to be security people all the time.
--:-- Travis McPeak: Today, if you think about it, devs have to burn down this never-ending pile of Jira tickets. This causes annoyance with the security team. If you had a friend that only showed up when they wanted you to do something, you're probably going to start avoiding that friend, and we're getting a ton of that. What if instead, they just used systems that made good security choices on their behalf and forget about all of this, like training relentlessly all the time?
--:-- Travis McPeak: Conclusions: I was part of this move from waterfall to continuous and then saw this, we just heap stuff onto our developers' plate and then saw developers learn to resent and avoid security more and more. I think what we should do instead is help them out. They're very, very busy people. We should build a system that makes it fast and easy for them to go do something they want to do and then has security baked in as a side effect. It's like when you want your dog to take vitamins, you don't just put vitamins in your hand and offer them to the dog. You put the vitamins in the peanut butter and the dog wants the peanut butter and the dog gets the vitamins too. I think this is what we should be doing for our developer users.
--:-- Host: Speaking of needing to make things easier for our developers, let's get a sense of what these hacks can really look like in 2024. Now, usually in this talk, I like to talk about SolarWinds, but we actually have a better example that was gifted to us, the XZ Utils attack. So everybody here has heard about this by now, but this was some group likely, I think, backed by a state that infiltrated an open source data compression project called XZ Utils.
--:-- Feross Aboukhadijeh: That was Feross Aboukhadijeh, founder and CEO of Socket. So XZ Utils has taken the security industry by storm since it introduced a backdoor via OpenSSH, which is a critical piece of infrastructure used by millions of servers around the world. Let's hear from Feross regarding what really happened there to get a sense of the kind of security offenders we're now dealing with in 2024 that can involve multiple years, multiple contributors, social engineering, the potential for state actors, and more.
--:-- Feross Aboukhadijeh: The way that they did this was just so interesting. And it's something, look, I'm sad that it happened, but I'm also like, I've been telling you guys about this for so long. I'm sort of satisfied in a way that finally there's an example that's really caught the imaginations of folks. So what happened here was we had a group, like I said, probably state-backed, winning over the contributor of the project over several years of work. That's a scale of time invested in this that we haven't seen in other attempts like this. And then they introduced a sophisticated, though not flawless, backdoor that was aimed at compromising SSH servers. It's a pretty multi-layered vulnerability.
--:-- Feross Aboukhadijeh: There were multiple personas involved from identities that hadn't been seen anywhere on the internet before. That kind of is another indication that probably this was someone relatively sophisticated. This wasn't just someone doing it for the lulz. So probably suggesting state-backed actors here. And just the way the timeline and some of the stuff that they did also seems to indicate that it might be the same people behind SolarWinds, probably. But again, this is all just speculation. I want to go into a little bit so you can see just the character of what this attack looks like.
--:-- Feross Aboukhadijeh: This is the individual who ended up committing and releasing the malicious code. And this is his first email patch to the mailing list where they do the development for this project, XZ Utils. It's interesting. This is just a totally pointless patch. This is the kind of thing that as a maintainer you get all the time, someone just drive-by dropping in an editor config file, which basically does nothing. It's a no-op in terms of the functionality of the project. Oftentimes you'll see these from people who just want to be able to say that they're a contributor to a project. It doesn't require any understanding of the project. It's just noise. But you can see their first attempt to get involved in the project.
--:-- Feross Aboukhadijeh: Then they sent another patch a month later, fixing some kind of build problem. They also sent a couple more patches after this one, all totally ignored by the maintainer, who at this point has been maintaining this project for about 15, maybe 20 years. This is a long-time project. The guy running it is just, at this point, it's in maintenance mode. He's sort of burned out. He's sort of half maintaining it, checking the mailing list once in a while, but really not actively working on this anymore. It's something that a lot of maintainers go through.
--:-- Feross Aboukhadijeh: Then finally, the maintainer, this is like three more months after the last email, we see that the maintainer just randomly comes by and merges a couple line change to the project that is the first code from this Jia Tan individual that's actually included in the project. What I think is interesting about this is all of his other patches were ignored. The patch that was merged is this trivial two-line patch that you can just look at and, as an overloaded maintainer, you can look at this and sort of figure out what it's doing, and "Oh, it fixes a bug, cool, let me just merge it and move on." The bigger, multi-hundred line patches were ignored. Typical behavior for an overloaded maintainer.
--:-- Feross Aboukhadijeh: Then a couple months go by, and now we see a new character enter the picture. This guy, Jigar Kumar, sends a few emails complaining that some of Jia Tan's patches weren't landing. This is often used to pressure maintainers to include code in projects. "Patches spend years on this mailing list. There's no reason to think anything is coming soon." So aggressive. At this point, remember, he's already landed a few of the patches, but the pressure is building here.
--:-- Feross Aboukhadijeh: Then this is "Insert project name still maintained." That is the bane of a maintainer's existence. It's the meanest kind of issue you can open up on a project, in my opinion. This has happened to me many times. I have a couple screenshots here. "Is this still being developed?" And on a perfectly active project because their PR wasn't looked at for a little while. Here's another one on one of my projects. "Is this project dead?" It's not nice. Don't do this, people.
--:-- Feross Aboukhadijeh: I think one of the interesting things about this whole situation is that this is another one of the things I've seen change in the way that open source is done. Traditionally you think of a project like Linux or WordPress or these big foundation-backed projects. They have this structure up here at the top where you have one project, one entity with many, many maintainers that are participating in the project. A lot of times they're paid by their employer to even work on the project and to submit patches as part of their day job. But what we see a lot more of as we've shifted into this world of many, many, many dependencies, a lot of tiny dependencies, is more of a structure like this, where you have an individual with hundreds, potentially hundreds of projects that they take care of. And that was the case here with Lasse Collin. He had multiple projects that he was managing as an individual maintainer.
--:-- Feross Aboukhadijeh: Okay, so let's continue on. Three months have gone by. He replies, he apologizes for the slowness, and he also adds in a bit about how Jia Tan has helped him off-list with XZ Utils. So probably they have some kind of chat conversation going off list now, and they're collaborating more closely, building up the trust. And he says he might have a bigger role in the future, at least with XZ Utils. "It's clear that my resources are too limited and something has to change in the long term." The idea has now been planted in his mind that he probably should give access to somebody else to help maintain the project. Again, this all sounds nefarious because I'm doing it in a talk and I have slides up here, but this is also open source working correctly. This is thinking about, "Oh, hey, maybe I'm not the best maintainer. Maybe I should hand this off to somebody." That's pretty normal as well. At this point, nothing actually nefarious has happened. There's no bad code that's been included. This is just laying the foundation.
--:-- Feross Aboukhadijeh: Okay, so a couple weeks go by. Now we have this character, Jigar Kumar, who enters. And this person's much more aggressive and really starts to apply more pressure. "One month and no closer to being merged. Not a surprise." So dropping into threads to just neg the maintainer and kind of make him feel like he's not doing a good job. "Progress will not happen until there is a new maintainer." And then the maintainer finally replies and pushes back and says, "Hey, I haven't completely lost my interest here, but I've been having some mental health issues, and I have a lot of things going on in my life. But again, maybe Jia Tan will have a bigger role in the project."
--:-- Feross Aboukhadijeh: A few months after that, Lasse Collin merges the first commit with Jia Tan as the author, you can see here, and they actually are listed as an author. This is a pretty innocuous change. And then again, the pressure continues from Jia and Dennis, who's this other persona that are both there to really just support the idea that Jia should be made a maintainer. And you can see here, "You ignore the patches that are rotting away on this mailing list. Right now you choke your repo. Why wait until 5 to change maintainer? Why delay what your repo needs?" Applying the pressure. And then again, the last one here is great. "Why can't you commit this yourself, Jia? I see you have recent commits." Just pushing more and more.
--:-- Feross Aboukhadijeh: And then finally, Lasse says, again, "Jia Tan has been really helpful off list. He's practically a co-maintainer already." And then finally, this is the first email about two years after the very first interaction with the mailing list where Jia Tan is actually now doing the release notes for the project. He's been made a maintainer and this is the first release going out. So a two-year effort here. If this is indeed state-backed, this is probably not the only thing they did in that two-year period. They probably have other things going at the same time. So we shouldn't overreact and assume that Linux is totally backdoored or anything like that, but also probably this isn't the only thing that these folks were working on. The truth is somewhere in the middle here.
--:-- Host: Sophisticated software supply chain attacks are not the only ones on our hands in 2024. In fact, the XZ Utils attack was performed really without AI. So let's hear from Kevin Tian, founder and CEO of Doppel, around the ways that AI is introducing new threat vectors and already impacting real-world businesses.
--:-- Kevin Tian: In 2022, $8.8 billion was lost by consumers alone in the U.S. We've had 39 billion credentials stolen by bad actors that same year. And the cost to launch a disinformation campaign that's AI generated is quickly approaching zero. If you've seen a lot of the startups that are currently pitching about how we can make it easy to generate AI videos or how we can make it easy to generate AI voices, that same sort of stuff is going to the bad guys as well.
--:-- Kevin Tian: How are we seeing this manifest today with real world people and real world businesses? One common scheme that has grown super quickly just in these past couple months has been the emergence of a lot of deepfake videos, specifically deepfake videos of individual personas. It could be Taylor Swift, could be Travis Kelce, could also be your CEO and could be your financial institution's chief technology officer. What we've quickly been seeing in terms of the landscape is more and more deepfake videos being produced in the exact same way, models being trained in a very similar way, the voice being generated in a very similar way, and the intention of the tech being operated in a very similar way all across different platforms, whether it's YouTube, TikTok, any sort of video platform out there.
--:-- Kevin Tian: We're already seeing deepfakes emerge, and this impacts a whole bunch of different individuals, whether it's business, whether it's celebrities, or even political campaigns. Of course, big federal election this year, it's top of mind for everyone. The good news, bad news is that it's already happening and we're seeing it happen across a lot of different platforms.
--:-- Kevin Tian: The biggest thing here though is that this is not necessarily an entirely novel attack surface or entirely new threat. We've always had social media, we've always had video platforms, and we've had bad guys try to create fake content to achieve certain means. The main lesson in terms of what we're seeing is that it's just become a lot easier to do. There are entire markets around phishing kits and entire markets around cybercrime in general. We're going to start seeing, and we're already seeing, that same sort of stuff come around with deepfake technology, impersonation technology, and just how do you personalize attacks more and more for your target victim.
--:-- Kevin Tian: The biggest thing too is that we're seeing this not only to run scams, but ultimately this stuff is impacting businesses at large. I actually just on a talk this morning, chatting with some big banks out there, and one of the biggest concerns for them is how can they watch out for a bank run that's orchestrated by a deepfake campaign?
--:-- Kevin Tian: Or we've even seen this affect companies outside the financial sector where a pharmaceutical company had an impersonator talk about how Viagra is going to be free now and saw that impact the stock price very, very quickly. It's, again, stuff that has happened before, but what we're seeing in 2024 and what we're expecting in 2025 and beyond is that this just gets easier and easier to do. And it gets to the point where it makes it really hard to tell what's real or not online.
--:-- Kevin Tian: And it's not just deepfakes. Here's a completely different approach. This one is an SEO poisoning case. Specifically, something we've seen out there a lot for the airline industry, finance industry, any industry that has customer support phone numbers, things like that. We've got the traditional SEO poisoning attack where people find a way to get content upranked for any given company.
--:-- Kevin Tian: What's interesting is how well people can do this in 2024. What we're seeing a lot of today is that they're putting it on these third-party sites that do have great domain ranks—things like Microsoft, LinkedIn. We've seen a lot with Hub as well, and Webflow, other platforms like that. They're taking advantage of the fact that these are legitimate third-party sites with great domain health, stuff that Google or any other search engine will quickly uprank. And they're generating content and conversations in forums. For example, "How do I speak to a live agent at United?" "How do I speak to a live agent at Uber?" What we see happen here is they're able to generate a bunch of spam content across these different third-party forums, get them all upranked, get them all to dominate that first page of search results. Again, it's a classic case of—well, they would have to script this and generate the content. Now they can make it more dynamic with AI and generative AI specifically.
--:-- Kevin Tian: Of course, it's not all doom and gloom. With every opening on offense, there's equal opportunity for defense. Here is Andres Afunzine, founder and CEO of Lumos, taking us back to where we started in this episode, through a historical arc that brings us to a digital era of autonomy. So what do we do now that we're in this new era? And if you happen to be a company hiring security professionals, should you be thinking about things any differently?
--:-- Andres Afunzine: I just want to take you a little bit on a historical journey. The funny thing is, if you look 60 years back, we are all ideas. There are two types of factories: a product factory and an idea factory. The product factory is where the cars are born, or where windows are made. The idea factory is where we create and design those cars. The idea factory changed in recent years, and changed again like two years ago.
--:-- Andres Afunzine: The idea factory looked something like the office in the 60s. In the 60s and 50s, there were no computers. It was really interesting. We mostly used typewriters and pen and paper. Then the computers came about and we digitized the office. That was the first step. IBM, SAP, Oracle, Microsoft—all those big companies came about and digitized it. Step two is we cloudified the office. Salesforce kicked it off, then Workday and Atlassian. Those were the first cloud companies. Suddenly we were in the cloud. That's also where AWS was born, I think 2004, 2005. That's when we cloudified it.
--:-- Andres Afunzine: Then something interesting happened: we made it collaborative. Workday is not really collaborative, neither is Salesforce. But then suddenly Zoom, Slack, Figma, Airtable—all those great companies came about in the 2010s. Suddenly it became very collaborative. That was the third change that happened in software, which is pretty cool.
--:-- Andres Afunzine: Now, what changed in the last two years is we moved from digitizing, to cloud, to collaboration, to autonomy. We're creating more and more autonomous software. It started for the first time with something like Grammarly, where they are more like co-pilots that help you do a job better. Even GitHub Copilot is in the middle. They're not fully autonomous, but they help you do your job better. The big trend we're seeing right now is OpenAI bringing out reasoning models at the end of the year that can reason and literally talk with themselves and do certain things. Really spooky. We've seen this as well with Devin, a new kind of AI software engineer that basically codes itself. We're moving from GitHub Copilot or Grammarly to systems and services that build things themselves. That is a whole new paradigm that's changing. We're like, "Okay, shoot, how do we equip ourselves for that?"
--:-- Andres Afunzine: To summarize, there are three waves. I just call them two. The first wave is digitization. The second is collaboration. The third is autonomy. Now we're at the third one. The interesting thing I think about on a daily basis is apps and access. Everything you're using are apps. We're on Zoom, then on Slack, then we go and SSH into a server, which is also an app. Then we use GitHub. Everything is apps. Apps are literally our lifeblood. Without apps, we can't do things.
--:-- Andres Afunzine: The question is, I think that we as security professionals need to ask ourselves more and more: how are we going to manage all those apps with more and more service accounts coming up? With software doing the job themselves, how do we deal with that? I love the Metro framework. I really love it. If you think about identities, there are certain identities on different tracks. Marketing has their identities—marketing ops, demand gen, content. Customer success has their tracks. Each station is more or less an application or an entitlement. Some of those overlap. For example, customer success and sales overlap maybe in Salesforce. Design and marketing overlap in Figma. Engineering especially—there are probably multiple engineering departments if we zoom in, and they overlap when it comes to entitlement level, different permissions that they have access to.
--:-- Andres Afunzine: The interesting thing is people—those wagons—they jump from one station to another. Each station is an app or entitlement. Why I think this is interesting is right now, how we think about the world is a world of RBAC. Quick interruption here: for the uninitiated, RBAC means role-based access control. Instead of assigning permissions individually, you're granting them based on a role. RBAC is not moving stations. RBAC basically means you're a marketing person and you have access to everything on this marketing tier, even though probably a lot of that stuff you never use. Sales or engineering is especially spooky. In engineering, you're in DevOps, you have access to all customer data because an incident might happen and you need access to it.
--:-- Andres Afunzine: On top of that, we have all those service accounts coming up, and soon autonomous actors, agents coming up that will also, if we still use RBAC, get access to all of those things even though they don't need it. The concept is: I'm a metro station and I need each permission and entitlement just for a short amount of time. As complexity rises—we're going from 100 actors to 1,000 to 10,000—and the apps become more complicated. Instead of having just one or two or three metro stations, I will have thousands of metro stations because I can have access to 10 EC2 instances. The granularity in the cloud and with Snowflake is going to become more and more granular. The question is, how are we going to manage that? What's the new paradigm to manage that?
--:-- Andres Afunzine: What I believe is we need to rethink things. Security was often seen as analysts. Actually, security started as hackers. Security people were those people that hacked the networks. They were deep in Linux with the sysadmins. Most security people were sysadmins before because there was no security 30 years ago, and they were true hackers. Then suddenly all those great solutions came about, and they said, "Here's an alert, there's an alert, here's an alert. We're going to alert you about all those things, and you can remediate it very easily." I feel like more and more security became an operating department. A similar thing happened to IT. IT used to be the hackers, and slowly they became ticket resolvers. Security became a little bit of alert resolvers. IT became ticket resolvers.
--:-- Andres Afunzine: The new paradigm we need to think about as we're thinking about entitlements and access as a metro station: security and IT need to see themselves as the architects of that metro station. DevOps and infrastructure are to full-stack teams. I think the same thing we need to think about for IT and security. IT and security need to become infrastructure teams to each department. This moves us back to security hiring for engineering rather than analysts, especially as AI will probably automate most of the analyst work. That's a very important insight when it comes to career development, what type of profile you need to hire—especially engineers and analysts—and building on top of solutions that you're buying is very important.
--:-- Andres Afunzine: The premise in this first act is: software is becoming autonomous. It enables us to create more and more. Because of that, entropy is increasing. There are more apps, more entitlements, and more actors. What needs to change is security needs to handle this infrastructure with some type of technology operations or technology infrastructure. That is one important change we need to see as this whole market is changing.
--:-- Andres Afunzine: Now, here's the second thing. This is about startups, by the way. This is an appeal to all my entrepreneurs. I believe that we need to build compound businesses from day one. What does that mean? Security CISOs probably have this problem that they need to use 50 different tools. In the last two years, especially as the economy has gone a little bit down, CISOs ask themselves a lot about how they can consolidate. It kind of sucks for startups at the beginning. They say, "Okay, we're starting solving this unique pain point." But then CISOs are like, "Yeah, but I have 80 vendors to manage." The question I ask myself a ton is: how can we build compound businesses from day one? How can you actually build a platform from day one, even though you're a startup? Counter to people who say "I need to consolidate," your startup actually can consolidate.
--:-- Andres Afunzine: In 2023, the top three priorities for CXOs were vendor consolidation and optimizing SaaS licensing, because you don't want to let people go. You'd rather first decrease your software spend. What does it mean for entrepreneurs? The question is: how can I build a compound business from day one? We've seen this done well across many companies. I think Datadog is an awesome company that did it super well, more on the DevOps side. For the longest time, they had one product. Then they switched and became this layered product for anything observability—whether it's security observability, infrastructure observability, application observability. They were able to build a compound product.
--:-- Andres Afunzine: Figma rethought this whole process. Before there was Sketch, there was Zeppelin. Figma said, "What is the underlying concept that's the same across all of those? How can I build a solution that covers that all?" By the way, we had the bundling era first with Microsoft, Oracle, and SAP. People didn't have a lot of applications. They said, "Oracle is doing it all." That was it at the beginning. Then with cloud, especially AWS and Azure, cloud became so approachable by everyone that suddenly we had all those collaboration tools come up. I do think we're changing back to an industry of rebundling, especially as we have this autonomous wave coming up. Wiz is a great example of that. They started with a point solution but spread out very aggressively and built a compound product very quickly.
--:-- Andres Afunzine: How are you going to manage that complexity? And then the question is: how much did I protect my insider threat? Why? Go back to the metro station. If the developer has access to everything, suddenly this intruder can just hop from one station to another and do harm. How can we make sure it's just-in-time, only when you're at the station you actually can have access to it? That gets hard with millions of permissions.
--:-- Andres Afunzine: What I believe is going to happen—and this is something we are really working on right now—with models that come out that reason, I think models will be able to reason better than our security analysts in terms of what a certain role should have access to. An agent on your identity and access management system will look into, "Okay, we had 20 new tickets where these engineers needed access to this type of database that lives in North America." They will automatically update your roles and downgrade your roles, or at least at the beginning be a co-pilot for you and suggest, "Hey, this role should be updated in this way, or those two roles should be merged in that way." This is a case study where agents will have a huge impact.
--:-- Andres Afunzine: The biggest story about security is that there's enormous complexity and risk. You can never reduce risks to zero. The cool thing is if you move more to an engineering mindset, where you actually fine-tune your agents and models on top of your infrastructure, you will be able to solve certain problems that you were never able to solve before. The RAG will look into, "Okay, is this privileged access?" The AI will be able to understand if that permission is sensitive or not. It doesn't always say "read only." It doesn't always say "admin access." The AI will be able to understand if that permission is sensitive or not. So you can reason, "Okay, this person has privileged access or not." Then this person can also reason on role anomalies: "Oh man, you are in sales and you have access to this write access in AWS, and no one else on your team has that access." A RAG will ask itself: how privileged is this permission? What is your usage of that permission? Is anyone else that has similar HR attributes have that access? You can already do this now pretty easily. It's not reasoning themselves, but you kind of guide them to go through those steps. That's what chain of thought means.
--:-- Andres Afunzine: The last thing I want to say is the cool thing about access is it can be preventative. Here's one thing we're already doing. If you create a ticket in Jira, or if you create a Slack message and say, "Hey, can I get this access, please?" in a public channel, our AI can detect that you ask for access. Usually the worst thing that can happen is back-channel access. That means someone gives you access without following processes. You can alert yourself that this happened—"Oh, this person got access without approval"—but the better way is to prevent that from happening in the first place.
--:-- Andres Afunzine: The main takeaway is there will be less and less analysts because agents will take over, and you need to upskill them to become more engineers or even prompt engineers. That's one big thing. The second big thing is think about now. The world is changing so quickly—what you can do and what you can demand from vendors, or what you as an entrepreneur can implement when a system can reason by itself. That's the second thing. The third thing is I believe, because I'm passionate about the industry, that the scope of identity will increase over the next couple of years more and more.
--:-- Host: All right, that is all for now. Obviously, security is always a moving target—a cat and mouse chase through progressively more complex terrain with more complex tools on both sides. If you do have any suggestions for future topics to cover, feel free to reach out to us at
[email protected]. And if you did like these exclusive excerpts from our a16z Campfire Sessions event, make sure to leave us a review at ratethispodcast.com slash a16z. We'll see you next time.
