[MUSIC] >> You're listening to the CyberWire Network, powered by N2K. [MUSIC] >> Quick question. Do your end users always work on company-owned devices and IT-approved apps? If the answer is no, then my next question is, how do you keep company data safe on all those unmanaged apps and devices? >> One password has an answer to this question, extended access management. One password, extended access management, helps you secure every sign-in for every app on every device, because it solves the problem traditional IAM and MDM can't touch. Check it out at onepassword.com/xam. That's onepassword.com/xam. [MUSIC] >> This episode is brought to you by Shopify. Forget the frustration of picking commerce platforms when you switch your business to Shopify. The global commerce platform that supercharges you're selling wherever you sell. With Shopify, you'll harness the same intuitive features, trusted apps, and powerful analytics used by the world's leading brands. Sign up today for your $1 per month trial period at Shopify.com/tech. All lowercase, that's Shopify.com/tech. >> Hey everybody, Rick here. Let's start with this. Cybersecurity is radically asymmetrically distributed. I first heard of this idea from an unusual source, Malcolm Gladwell, the famous author and podcast host. He gave one of the keynotes at the 2023 Google Mandiant NYU's conference in Washington DC. You may be rightfully asking yourself, what does a world renowned author and podcast host whose expertise is in the ballpark of the social sciences know about the world of cybersecurity, and why was he presenting the keynote at one of the implicit professions flagship conferences? I'm glad you asked. I think mostly it was because Google paid him to do it. >> Oh yeah. >> That said, he brought an original idea that I had never considered or at least he crystallized an idea that had been bouncing around in my head since we started writing our first principles book back in 2022. His idea was that most of us believe that the problems we all are trying to solve in our daily lives are normally distributed to everyone. That things like climate change, nuclear accidents, and the most effective ways to water our lawns impact everybody equally. When he suspects that some problems are asymmetrically distributed. In many cases, they are radically asymmetrically distributed. He said that he appreciated the hubris of a non-cyber security expert like him coming into a room filled with cybersecurity experts like us and suggesting not only a new idea, but perhaps a revolutionary way to approach the problem of cybersecurity. With that big caveat, he said that he thought cybersecurity was a radically asymmetrically distributed problem. Well now, that seems interesting. Since the entire purpose of our first principles book was to talk about cybersecurity strategies and tactics, does understanding and believing that cybersecurity is a radically asymmetrically distributed problem change the strategies that we might choose. Gladwell seems to think so. Let's find out. So, hold on to your butts. >> Hold on to your butts, butts, butts. >> This is going to be fun. [MUSIC] >> My name is Rick Howard and I'm broadcasting from the N2K CyberWires Secret Sanctum St. Torm Studios located underwater somewhere along the Patapsco River near Baltimore Harbor, Maryland, in the Good Old U.S. of A. And you're listening to CSO Perspectives, my podcast about the ideas, strategies and technologies that senior security executives wrestle with on a daily basis. [MUSIC] For those that don't know, I'm a huge fanboy of Malcolm Gladwell. He's the best-selling author of books like The Tipping Point, Blink, Outliers, Talking to Strangers, and The Bomber Mafia, which is my all-time favorite. It's about the U.S. Army Air Corps' glorious quest to make warfare less murderous in the transition between World War I and World War II. The men behind the effort spectacularly failed, but boy, did they give it a try. Gladwell is also the co-founder of Pushkin, an audio production company similar to N2K CyberWire, in that Pushkin hosts a network of podcasts. Out of the 44 that Pushkin publishes, my favorites are Against the Rules, hosted by Michael Lewis of Moneyball Theme, Medal of Honor Stories of Courage, hosted by Gladwell, and Revisionist History, also hosted by Gladwell. And I'm a little bit envious that Gladwell thought of the Medal of Honor podcast before we did. Those kinds of stories are like catnip to me. Oh, yeah. There have been over 3,500 recipients since President Lincoln signed the Medal into existence in 1861, and there are 61 living recipients as of this summer, 2024. All other stories are in the public domain, and each one is inspiring and jaw-dropping heroic. They are perfect for a podcast. But I've been listening to Revisionist History for years. Whenever a new episode drops, that's the first thing that I'm listening to that day. He takes a subject that everybody thinks they know, revisits it, and completely blows your mind with another version of the story. His rant about how taxpayers fund private golf courses on city land that the public can't use will make you think twice about the late great comedian Bob Hope. His creed about college rankings and how elite schools with large endowments have no interest in public education and diversity will make you weep for the country. His six-part series on gun control will make you realize that all the efforts to restrict automatic weapons and magazine sizes that had thus far failed to get through when the U.S. Congress would probably have little effect on reducing the damage caused anyway. And his current series on the run-up of the United States participation in the 1936 Olympics in Nazi Germany may provide some insight into America's modern-day flirtation with its own version of fascism, former President Trump's version of how he wants to run the government. See what I did there? I slyly threw in my opinion about the upcoming United States presidential election, hoping you wouldn't notice. I guess you know where I stand now. I'm not supposed to talk about politics in this podcast, but allow me this one tiny digression. As Craig Ferguson, the former late-night talk show host, used to say, "I look forward to your IP letters." For the U.S. listeners specifically, and maybe international listeners with a passing interest in the state of democracy in the world, I'm recording this on the morning after President Biden dropped out of the 2024 U.S. presidential election. Regardless of who replaces him as the Democratic nominee, this election is unique. Normally, presidential elections are about which politician you hate or love, or about this policy or that. But in this election, those things pale to what it's really about. In this election, citizens will decide if the United States will continue to be a liberal democracy or transition to a fascist state. When you strip away everything else, that's the choice. For the American listener then, choose wisely, Grasshopper, whichever way it goes, the result will impact generations of Americans. The reason I'm a big Gladwell fan is that he excels at blending storytelling with scientific research in an effort to make complex ideas accessible to a wide audience. He tells the executive summary so that we mere mortals can get a glimpse, however shallow, of the underlying issues of the topping. His critics say that he oversimplifies and lacks scientific rigor. Oh no! I find that puzzling and quite amusing when, for example, he summarizes a 15-page peer-reviewed research paper on the threshold models of diffusion and collective behavior from the Journal of Mathematical Sociology. Of course, he's going to shave off some of the details and round off the corners of some of the math. That's what happens when you summarize. I think his critics are mostly bitter that Gladwell's books regularly land on best-seller lists while their deeply researched academic books and papers do not. In his keynote, Gladwell described two problems that most people think are normally distributed when in fact, they are radically asymmetrically distributed. U.S. automobile pollution and COVID-19 infection causes. Let's start with car pollution. In 1966, in an effort to improve air quality, California passed the first statewide law to mandate frequent automobile emissions tests. By 2024, at least 30 states have similar laws on the books mandating that their citizens get their cars checked at least annually to ensure that they aren't spewing dangerous toxic chemicals at unacceptable levels into the environment. According to Gladwell, these laws assume that every citizen's car is likely to do that, that every car is moments away from being a heavy polluter. But he points out that in 2024, almost 60 years after the California law went into effect, car emissions technology has improved. Back in the 1960s, manufacturers didn't even worry about pollution. The 1963 Porsche 911, for example, only had a simple blow-by device to return unburned gases from the crankcase back to the combustion chamber. Catalytic converters weren't a universal thing yet, but in 2024, they are. Modern cars produce significantly fewer emissions due to advanced technology and stricter regulations. The chances that a modern car is spewing exhaust at unacceptable toxic levels is much smaller than the cars made in the 1960s. The problem is no longer universally distributed. According to Gladwell, that means the strategy that worked back in the 1960s, annual exhaust checks for all cars is probably not the most effective. He suggested that you could have the same effect by deploying exhaust detectors in conjunction with traffic light cameras deployed at key intersections, designed to identify malfunctioning technology. The strategy transforms from making everybody do something, to discovering the outliers and making them do something. The outliers, in this case, are the asymmetric distribution. [Music] Gladwell made a similar observation about COVID-19 transmissions. I know that nobody really wants to relive the over three years of COVID-19 pandemic lockdown that we all did from March of 2020 to May of 2024. But Gladwell was interested in the first days when everybody was confused about what COVID-19 was and whether or not it was dangerous. I remember back in February of 2020, I had just joined the CyberWire, and my first official act was to represent the company at the annual RSA Security Conference in San Francisco. The World Health Organization had just declared COVID-19 as a public health emergency of international concern just before we all arrived. All of my friends and colleagues were walking around San Francisco asking ourselves if we should really be there, mingling with the 35,000 attendees who would immediately get on planes afterward, traveling back to the four corners of the world and spreading whatever diseases they came into contact with. Gladwell's example came a month later. The Boston, Massachusetts super spreader a bit. Local Boston News reported that 100 people from around the world convene at the Boston Marriott Long Wharf Hotel for a leadership conference led by the Cambridge Space Company called Biogen. When they got home, those 100 people infected more than 330,000 people worldwide with COVID-19. In his keynote, Gladwell cited a preliminary MIT study that theorized many of the 100 attendees to the Biogen Conference were super spreaders, individuals who infect many more people than the average person would. The study further theorized that one quality that made them super spreaders was the size of the water droplets coming out of their mouths when they breathed. Compared to an average human, their water droplets were exponentially larger. Larger water droplets could hold more virus. The bigger the virus load then in the water droplet, the greater the chance that they already infected would infect more people. Gladwell was quick to point out that these were just theories and that more study was required. But if you assume that it's true for a second, how does that impact your pandemic survival strategy? What we did do is assume that all people were equal opportunity infectors. We assumed that the problem was universally distributed. That meant that we adopted tactics that everybody needed to do. Stay at home, wear a mask if you absolutely needed to go out and keep a safe distance from your friends and colleagues, even if you were wearing a mask. But if you assume that infecting other humans is radically asymmetrically distributed to mostly super spreaders, with overly large water droplets for breath, your strategy might be completely different. It might be to locate those super spreaders and lock them down, not everybody on the planet. I'm not saying this would have been easy, but it might have been far easier than what we did do. At the very least, we could identify those super spreaders and ask them nicely not to attend the RSA Security Conference that year. That would have been something. [Music] At this point, you're asking yourself, "How does this apply to cybersecurity?" In our first principles book, I outlined how in 2021, the FBI said that approximately 5,000 US organizations had self-reported that they have been compromised by some kind of hacker. Assume that there exists some five times that number who didn't self-report, call it 25,000 then. But there are roughly 6 million organizations within the United States, like federal state city county governments, academic institutions K through college, non-profits, and public companies. 25,000 divided by 6 million is a really small number. The chances that any US organization will be materially impacted by a cyber attack is tiny. I've been working in cybersecurity for 30 years since the beginning. My peers and I have been treating cybersecurity as if the danger was imminent, that at any moment, we would all be overrun by the hacker whores. That's just not a word. [Music] And that's our show. Well, part of it. There's actually a whole lot more, and if I say so myself, it's all pretty great. So, here's the deal. We need your help so we can keep producing the insights that make you smarter and keep you a step ahead in the rapidly changing world of cybersecurity. If you want the full show, head on over to thecyberware.com/pro and sign up for an account. That's the cyberware, all1word.com/pro. For less than a dollar a day, you can help us keep the lights and the mics on and the insights flowing. Plus, you get a whole bunch of other great stuff, like ad-free podcasts, my favorite, exclusive content, newsletters, and personal level of resources like practice tests. Within 2K Pro, you get to help me and our team put food on the table for our families, and you also get to be smarter and more informed than any of your friends. I'd say that's a win-win. So, head on over to thecyberware.com/pro and sign up today for less than a dollar a day. Now, if that's more than you can muster, that is totally fine. Shoot an email to pro@intuk.com and we'll figure something out. I would love to see you over here at N2K Pro. One last thing, here at N2K we have a wonderful team of talented people doing insanely great things that make me and the show sound good. I think it's only appropriate you know who they are. I'm Liz Stokes. I'm N2K's cyberwires associate producer. I'm Trey Hester, audio editor and sound engineer. I'm Elliot Peltzman, executive director of Sound and Vision. I'm Jennifer Eiben, executive producer. I'm Brandon Karpf, executive editor. I'm Simone Petrella, the president of N2K. I'm Peter Kilffy, the CEO and publisher at N2K. And I'm Rick Howard. Thanks for your support, everybody. And thanks for listening. ♪♪ Identity architects and engineers simplify your identity management with Strata. Securely integrate non-standard apps with any IDP, apply modern MFA and ensure seamless failover during outages. Strata helps you avoid app refactoring and reduces legacy tech debt, making your identity systems more robust and efficient. Strata does it better and at a better price. Experience stress-free identity management and join industry leaders in transforming their identity architecture with Strata. Visit strata.io/cyberwire, share your identity challenge and get a free set of AirPods Pro. Revolutionize your identity infrastructure now. Visit strata.io/cyberwire. And our thanks to Strata for being a longtime friend and supporter of this podcast. ♪♪
