Welcome back everyone to another episode of Tomorrow News. We've got a lot coming up today, information around B1059, some delays around Virgin Galactic and, after winning some more contracts so, stick around as this is your Tomorrow News for the week of February 28th, 2021. We're starting off this week's show with some information on the sad end of life of B1059, which as you remember, was lost in a strange incident when coming in for landing. The short story is, heat damage caused the engine issue. The long story is, we can't know yet. To quote Hans Konigsman, a senior advisor for SpaceX, it's related to heat damage, and that's all I can say at this point in time. Let's switch it up a bit then to something that we are allowed to know, or at least something we can see for our own eyes. This is Hailey Arseneau, and the second member of the Inspiration 4 mission. When she was just 10 years old, she suffered from osteosarcoma, which was a type of bone cancer, which was affecting her knees. Because of this, her family went to the St Jude Children's Research Hospital for her treatment and her care. In 2014, she got an undergraduate degree in Spanish, and in 2016, she got her physician assistant degree. She is now an employee at St Jude Hospital, and she has said that this seat represents the hope that St Jude gave me. That is a quote very fitting for what this mission is aiming to achieve, and I, along with many others, believe that she is a very good choice for this position. She has also appropriately taken the seat's hope. The two remaining seats have been named Generosity and Prosperity, and the former being given to a donate to St Jude, and the latter being given to an entrepreneur who has started a shop using Shift for Shop. And updates about a public mission to space aren't the only big thing that happened this week. No, our friends over at Rocket Lab, they sure dropped a doozy on all of us. Currently, Rocket Lab has their patch of the small sat market cornered, but in an industry on the cusp of unleashing the full fury of satellite mega constellations for better, for worse, sticking with just a small lift launcher isn't going to cut it. Enter Neutron, just announced by Rocket Lab, a reusable medium lift launch vehicle that will be human-rated and capable of putting 8,000 kilograms to low Earth orbit. That's in a gap that presently exists in the launcher market. You've got Rocket Lab's own electron capable of delivering 300 kilograms to low Earth orbit and SpaceX's Falcon 9, able to lift a little over 15,000 kilograms to low Earth orbit in its reusable mode. I am expecting some of you rocket aficionados to be like, well, actually, what about Antares? It's in that same payload category, isn't it? And I say to all of you, when was the last time Antares lifted anything other than the Cygnus freighter on the way to the International Space Station? Oh, that's right, never. However, we do see the respected and long-lived Soyuz sitting squarely in this realm being able to chuck 8,200 kilograms to low Earth orbit. If Neutron is to grab the lion's share of this market, that's your Royal currently sitting upon the throne, having sat there for the last half a century. Neutron will use a launch pad at the Mid-Atlantic Regional Spaceport on the east coast of the United States, burn a mix of rocket propellant 1 and liquid oxygen, and has a first flight sometime around 2024. Now, a critical portion of Rocket Lab making Neutron possible has occurred. They have gotten about $745 million in venture funding and that's quite a bit of money, especially when you look at something like the development of SpaceX's Falcon 9, which costs about $300 million, but you really should include the Falcon 1 development cost in that total cost as well, which puts it at about $400 million. There's also another really good thing that came out of this, which is accountability. And yes, that is right, Peter Beck held himself accountable for some things that he said. Specifically, it was that he would eat his hat if they made Electron reusable and also if they would ever fly meat. And here we are in 2021 with Rocket Lab flying reusable electrons and now working on a new rocket that'll fly meat. So rightfully so, Peter chowed down on that hat. Well done, sir. Well done. That reminds me, I still have an RS-25 to eat after losing that bet about Starship with Jamie. Does anybody have a spare RS-25? However, someone not eating non-edible things presently is Blue Origin. They are chugging away on their new Glenn rocket at their factory in Cape Canaveral Florida. They've announced that the first flight of new Glenn originally scheduled for some time this year will be slipping to fourth quarter 2022 at the earliest. Their reasoning losing out on the national security space launch phase two launch services procurement, which was won by United Launch Alliance and SpaceX last year and the extra financial sting of a $500 million launch service agreement signed with the United States Air Force in 2018 being terminated early after only receiving $255 million. Their new launch pad at LC 36 has cost a billion dollars just in case you forgot that ground support equipment and infrastructure is ridiculously expensive and another $2.5 billion spread around facilities, factories, and the development of the new Glenn rocket, which Blue Origin notes that not winning the procurement contract cost them about $3 billion in revenues that could have helped. Yowza! I mean, I don't know about you, but I have a hard time thinking Blue Origin looked at that procurement competition as a make or break for them, but here we are. Although they're certainly still moving forward with new Glenn, but dang, $3 billion not accounting for that. That's just not very Blue Origin like. I'm going to wrap up by talking about something that is very much at the core of what we believe here tomorrow, which is that space is for everyone. It should not be a place that is secluded just to an elite number of humans somewhere under 600 currently that have actually made it off of the earth and into space. No, we believe that space is truly for everyone, and the European Space Agency is about to take a very, very big step to making that happen. Putting out their first call for applicants since 2009, if you would like to become an astronaut for ESA, you've got to be under the age of 50. You have to have fluency in English with additional languages spoken considered a bonus. You'll also need a master's degree plus three years of professional experience in your STEM field, or you can have experience as a test pilot. You also need a second class pilot medical certificate, and you need to be a citizen of any ESA member or associate member state. Now that all sounds very much like the expected requirements on an application to become an astronaut. So you're probably asking yourself, what's the big deal here? Well, the European Space Agency have said it themselves, which is that in this next round, they are looking to recruit an astronaut with a physical disability. Spaceflight is incredibly demanding on the human body, which means that astronauts aren't just brainy smarts. They're also expected to be in near perfect physical condition, meaning people who have physical disabilities were immediately disqualified from being able to join in. But it's not just some footnote on the application. Nope, ESA is explicitly saying that they're intending to recruit an astronaut with a physical disability. All I can say about this is that it is about time. This has been such a long time coming, and I'm glad that the European Space Agency is finally taking that step to move this forward because space brings out the best in humanity. And just because you may be physically disabled does not mean that you can't be a part of the best of humanity. So finally, going to space as we are, that is exactly what we should be doing. And I'm really looking forward to this future that this is going to bring, and opening up space to more people. Because that's what it's all about, right? We want to bring humanity along with us into space. And that's not just the peak of people, it is everyone that we can take with us.  NASA have handed over $7.95 million worth of cash to Astra, which will cover three launches of their Rocket 3 vehicle. The time-resolved observations of precipitation structure and storm intensity with the constellation of Small Sats mission, or tropics for short, trust me the shorter name is easier to say, will be launching between the 8th of January and 31st of July next year. The previous flight of Rocket 3 very nearly made it to orbit, so if they stick it on Flight 3, they may be set to launch the time-resolved tropics to space. Now sadly, this story is a bit sad as it involves delaying space tourism aboard a Virgin Galactic vehicle until 2022. An aborted test flight of Spaceship 2 on December 12th last year was caused by electromagnetic interference, which caused a flight computer to reboot just as the vehicle ignited its hybrid engine. That, as you can probably tell, was extremely inconvenient. The president of Virgin Galactic, Mike Moses, has said that a new flight control computer system is the likely source of the increased levels of interference, so they shielded components and prepared for a flight on February 13th where, alas, the issue cropped up again just before they got into the sky. The method now is to actually fix the flight computer itself. Now this will take a while, but once it is noticeably fixed enough in the lab and onboard the vehicle, they should be all good to resume power with test flights. The company expects this to happen in time for a flight in May. Last December is creeping up again as that is when Orbex raised 24 million US dollars, which is being used to pay AMCM or additive manufacturing customized machines to make the largest 3D printer in Europe to manufacture their rocket engines. These engines will power the Prime launch vehicle, which is composed of two stages with six biopropaid engines on the first stage and one on the second. The printer will be able to produce around 35 engines a year and it will be based around the four laser AMCM M4K4 metal printing platform. Launcher, another aspiring small-sat launcher, is also using AMCM to 3D print prototypes of their E2 engine, which will power their vehicle, creatively named Rocket 1. I'm rooting for Orbex now because I really want to see an orbital launch out of the UK for the first time ever and I especially can't wait to see how those 3D printed engines hold up. SkyAura, which is another launch company based out of Scotland, also looks to be making good progress as they've been conducting some tests recently. Talking of launches, we've had a few in the past week starting with a launch out of China. Lifting off a top along March 4C out of Site 9401 at the Jiquan Satellite Launch Centre at 0222 UTC on February 24th, the third launch of a set of YARGAN 31 satellites made their way to low Earth orbit around 1100 km above sea level. As always with Chinese spy satellites, we don't know what's actually going on up there. All we know is that 70 have been launched. February 28th saw the launch of Amazonia 1, a top-list PSLVDL or Polar Satellite Launch Vehicle. Lifting off at 0454 UTC, the satellite and 18 others all started their journeys towards Polar orbit. Amazonia 1 is an Earth observation satellite developed by Brazil's National Institute for Space Research and it is equipped with a camera that can take pictures of any place in the world every five days. This high rate of revisiting the same place is very useful for tracking things like deforestation in the Amazon rainforest and other environmental damages around the globe. Arctica M, a meteorology and emergency communication satellite also took to the skies on February 28th, exactly two hours and one minute later at 0655 UTC atop this, Soyuz 2.1B. Lifting off out of launch complex 316 at the Baikonur Cosmodrome in Kazakhstan, the second launch of Roscosmos in 2021 got off to a good start, as the first of 10 Arctica satellites is looking good in Earth orbit. And here is your space weather with Dr. Timothy Sco. We are in a wait and see mode with space weather this week. As we take a look at our Earth-facing sun, we do see a couple new bright regions on the Earth-facing disk and these are boosting the solar flux just a little bit, which is good news to amateur radio operators and emergency responders. In fact, a couple of these regions are actually even firing off little solar flares and one of them even launched a solar storm that's going to go west of Earth, so we don't have to worry about it hitting us. Meanwhile, we also have a coronal hole. It's actually a large hole that's going to be rotating into the Earth strike zone over the next couple of days and it's going to be followed by yet another coronal hole and both of these are going to give us some fast solar wind and give us more chances for aurora, which is definitely good news considering that solar storm fizzle we had the other day. So aurora photographers keep your fingers crossed because you're going to get some more chances. Now as we switch to our far-sided sun, this is Stereo A and it's looking at the sun pretty much from the side. You can see those bright regions beginning to exit the west limb in Stereo's view and you can also see those two coronal holes. They're pretty well formed. So what that means is that we're going to have chances for aurora easily over this next week for an extended period kind of off and on. So that's really good news. The sad thing though is that if you look just to the west of that or the east of that, you're not going to see any bright regions in Stereo's view. So sadly what this means is that once these bright regions that are in Earth view rotate to the sun's far side, we're going to be back to a spotless sun. For more details on this week's space weather, including when and where you can see aurora and how the recent bright regions on the earth-facing disc might affect radio comms, come check out my channel or see me at spaceweatherwoman.com. And just before the last February episode is over, I want to thank all of the citizens of tomorrow for their continued support. The escape velocity, orbital, sub-orbital and ground support citizens all help out the show and keep us on the air. So if you would like to join them and support the show financially, head over to youtube.com forward slash tmro forward slash join. That's it for today again. Thank you for watching and I'll see you next time. Goodbye.


This is the opening keynote from Black Hat that Niko would all ask me to repeat here. So it's a pretty corporate topic if you are, Bruce is across the hall and is always an amazing speaker. So what I want to talk about today is the way that enterprises and security folks misunderstand each other. I started my career at the Rand Corporation as a security researcher and engineer for various agencies. After that I became a consultant for a few years. Then I went to run security at Charles Schwab. While I was at Schwab I changed careers from focusing on security to focusing on broader areas of technology. I left Schwab to become the CIO of Google and I was there for a long time. About a year ago I left Google to go to EMI Records as president of New Music. So I sort of have done a pretty broad career arc from a pretty classical engineer to the CEO of a Fortune 500 company. EMI Records is several billion a year in turnover. So what I have learned over those years is that we all talk to each other wrong. Security guys talk to executives and executives don't understand. Executives talk to security guys and security guys don't understand. And we end up wasting a lot of money and doing a lot of the wrong things. What I want to talk about today is why that happens in terms of incentives, psychology and structure.  Is that you baby or Subridge in the Sky? Hang on while I need two hands. So the good news, bad news story of security and corporations today is that CEOs are listening to us. On average, 80% of... Sorry, one more thing before I start. I'm going to quote a bunch of statistics in this talk. The statistics come from a bunch of different sources. The research scientist in me thinks that each one of those statistics is somewhat wrong. Some are very wrong, some are slightly wrong. There's bad research methodology. In one case, the math was done wrong. But generally, instead of worrying about the specific number I quote, I want you to think directionally around what it suggests. Caveat. And 80% of CEOs surveyed believe they have been the victim of a security breach. 8-0. That can't possibly be right. If you look at the privacy watch data for the last few years, even if you add them all up and multiply by 10, you still don't get 80% of major companies. So CEOs think they're in incredible danger, even though the math doesn't suggest they are. There's a famous decision-making study done by a guy named Tachanaman and Tversky. That's Danny Kahneman and Amy Tversky. They studied decision-making biases, they called heuristics. And there's a whole bunch of them. Basically, systematically things that you do wrong when you think you're doing something right. In this case, there's one called the availability heuristic. The availability heuristic works like this. If I ask you to say, tell me when you went to a restaurant, ordered your food, and got something else, did not get what you ordered. Some number of you will come up with a story of, oh right, that happened to me at that Chinese restaurant in Evanston. If after that I ask you, how likely is it that you will go to a restaurant, order food, and get something you did not order? For those of you who come up with a story, you will estimate the likelihood of that happening vastly higher than it actually is. Because you have a story available to you, you will think that it happens more often into more people than it actually does. CEOs spend all their lives being told by people, oh, security is incredibly bad, oh, security in the world, you're in trouble. So they have lots of stories that are available to them. So they compute the risk, the 80% number, vastly higher than it actually should be. So basically they're terrified of us. And as a result, they're writing us bigger checks. About 30% of all companies in the Fortune 1000 have security budgets growing by 5% or more this year. When concomitantly, IT budgets are going down by something on the order of 7% to 10% on average. So security spending is going up markedly as a percentage of IT spending. So apparently our fear is working. We're scaring the CEOs and they're writing us checks. The problem is they don't have any idea why they're writing us checks. CEOs were asked to list some combination of the following. What's a security vulnerability, give an example. What's a breach that you've experienced, give us an example. Basically just tell us anything you know about security. More than 35% of CEOs could not say anything about what security actually means. What's a vulnerability, anything. They have no idea why they're writing us checks. When I first read that number, it scared me a lot. How can one in three not know what they're doing? There's a group called FINDLaw, which studies legal understanding in the United States. They did a survey recently of general people in the U.S. asking them to name one Supreme Court justice. 45% of respondees couldn't name a single Supreme Court justice. The number one answer was, the modal answer, judge Judy. Turns out she's not actually on the court in case any of you are wondering. The problem with scaring the heck out of our CEOs and having not understand it is that fear is a bad long-term motivator. Ask Louis XVI. That was a joke. Time to laugh. Well done. So we decided that we needed to learn to speak CEO better. The fear wasn't going to work, so we learned to speak ROI, return on investment. The problem is we can't compute it. We're quite bad at it, as a matter of fact. We're bad at it for two reasons. One, we measure return on investment only in terms of downside protection. And second, we don't compute downside protection very well anyway. So if you look at the best practices out there for computing security ROI, they list a whole bunch of things that you should count. One of the very, very top ones they list is avoidance of reputational damage. What is reputational damage? What does that mean? Who does that hurt? Let me give you an example. There's a company that made children's clothing called Carters. In the 1970s, they released an advertising campaign that was targeted at the time the people who normally bought children's furniture, which at the time was women between 35 and 50. Their ad was very soft color, slight focus, really pretty music, and a picture of a mother watching her child play on a playground. And the tagline was, if they only stay little, tell their carters wore out. The idea being, don't care about the kid, care about the clothes. Guess what? Everyone hated it. They did a survey of those target people, the 35 to 50-year-old women, and they found that an incredibly substantial number of them had a very much worse impression of the carters brand and a hugely large number of them said they would never buy carters again. Guess what happened to their sales? They went up by almost 30%. I don't know what this reputational damage thing is. Second of our second component of ROIs is, oh my God, you're going to have lost productivity. The systems go down and the world ends. I used to be responsible for a NAISI trading system, a trading system that executed trades in the New York Stock Exchange. It is a big, complicated system and lots of moving parts, and it broke sometimes. If it broke at 2 in the morning New York time, did it matter? No, nobody cared. If it broke at 9.30 a.m. New York time, which is market open, did it hurt anything?  The problem is actually it didn't.  And they start pulling paper tickets and they talk to their customer who says, I want to buy a thousand shares of Google. They say, right, I got that. They write a piece of paper out and they set it on the side of their desk. Exactly the way the NAISI ran until the early 1980s. So what happened when we lost that system? It was annoying. The whole process was far less efficient, but it didn't actually hurt anything. Lots and lots of systems turn out to be able to run just fine without the technology, they just run less efficiently. So then the ROI of taking the annual revenue for a system, dividing it up by hours and then multiplying that cost times the number of hours to compute downtime, doesn't make any sense, doesn't work. And finally we compute ROI not counting sales that are enabled by security. Let me give you an example. When I was at Google, some engineers that are really interesting study, they looked at online retail, particularly small store online retail. And they tried to track through what happened through the sales process. So some arbitrary web server finds a site. They look around the marketing material and say, oh right, I want that bright green Adidas shirt. Thank you very much. I'm going to pick on you the whole talk. I want that bright green Adidas shirt. And they go through and they figure out how to add it to their cart and see how much it's going to cost. And then two out of every three bail out. Two out of every three carts with at least one thing in it was abandoned. That's of course the worst of all possible worlds for small retailers, right? They've spent all the time getting you to their site. They've spent all the time getting the marketing material up. They've convinced you to buy and then you go buy at Amazon. All the cost, none of the revenue. There's a whole bunch of reasons why they're adding emergency exit signs. In case there's fire, please find the red sign. In the event that when customers dropped their carts, we went off and said, why do you do that? There's all kinds of reasons as you'd expect. But the number one reason was, I don't want to create another account. I don't want to have to re-enter my shipping information again. I don't want you to send me emails later. I don't want to give you my credit card information. I've got a thousand accounts. I don't want a thousand in one. So this group of engineers came up with a product called Google Checkout. Google Checkout allows you to enter your credit card data, you know, your shipping information, et cetera, once into Google. And then with about ten lines of JavaScript, the retailer can use checkout as a checkout provider. So from the user perspective, they click on one button. They enter their Google password. Their credit card gets billed once. They can have their shipping information entered once. They can choose whether it gets, you know, spam from the retailer or not. So, not a bad product. So what do you think happened to cart abandonment rates? Went from two out of every three carts abandoned to less than one out of every three. So the retailers simply by getting rid of the need to make accounts doubled their sales. Well, or doubled, halved their failure rate depending on how you count. So that's an example where a little tiny bit of security, namely the creation of Google Checkout, created a vast quantity of additional revenue. That's also never computed in ROI. We're computing ROI to speak executive and we're doing a very bad job of it. And then of course, when the CEOs are done being scared of us and our made up ROI doesn't work anymore, we pull out the tactical nuclear weapon of information security. We say, but we're going to have a security breach. And then of course everyone quakes in their shoes and runs to the hallways. So it's interesting, if you look at Verizon's study of security breaches, they counted breaches pretty generously and even so more than 90, 90% of all breaches were pretty trivial things. So incredibly cool security we're teaching and telling and selling to try and avoid security breaches by and large doesn't really matter. If you look at the Privacy Watch numbers for 2009, it's obviously a partial data sec because it turns out 2009 is not over yet. But if you look at the data to date from 2009, 16%, 16% of all security breaches are from stolen laptops. 11% are from people putting paper copies of user data on the curb.  So by buying your employee's shredder, you could eliminate 10% of all vulnerabilities. By doing something cute with laptops, you could eliminate another 15%. So a quarter of all breaches could be fixed trivially. Again, we're using this data to suggest that hugely expensive projects get run and lots of compliance work gets done when in fact we could make a hugely material decrease in our breach risk by buying shredders. We're trying to scare our executives into spending money and they shouldn't spend it on us. And to some extent they agree. So do y'all recognize the reference? This one goes to 11. Spinal tap. The funny thing about this slide, which you can't see because the resolution's not high enough, this one's labeled in a thousand-point font. This one goes to 11. You know what's interesting? The dials only go to 10. Seriously, anyway. So even though we're scaring our executives and they're writing us bigger checks and we were pretty able to scare them even more by bad security breach numbers, we're unhappy with the amount of money they're giving us. Security officers are about one-half as likely to believe or to say that security spending is adequate at their company. CEOs are twice as likely to say security spending is adequate at my company. That seems odd. Doesn't the CEO get to decide what adequate is? I don't know. So why are we so different? We're so different because we're trying to spend money on things the CEO doesn't care about. CEOs are three times as likely to say that they want the biggest focus of security to be on business continuity planning. They want our systems to stay alive because of course, you know, fires happen. In one of my data centers, one time a car drove through the wall. I mean, stuff happens. I'm not kidding. That's actually a real story. Note to self, armor your walls. So the CEO is worried about keeping the business alive. We're worried about what? Compliance. We believe that the number one spending opportunity for security is on compliance. It's interesting that he barely makes the CEO's list because the CEO's criminally liable for compliance. And they don't care. Yet we care. Interesting problem. I had a friend who made a very, very, very healthy living selling HIPAA compliance for a while. He would show up at customers, give him a sheet of paper, his gilded list from above, that said here you must buy these pieces of technology to be HIPAA compliant. And it was a pretty expensive list. The problem? It's not right. If you look at the health and human services statement of the security rule, the final statement of the rule, part of what they do is they list comments. So people can arbitrary say, can write in and say, hey, you know what? I think this rule should have this or that, et cetera. And the committee responds to each of those comments. And the HSS comments on the security rule, there were several thousand pages of it. Very, very high on their list is a set of comments that they summarized as saying, the U.S. government has no interest in specifying technology to create HIPAA compliance. So my friend was selling a list of technology to become HIPAA compliant, which is explicitly ruled out by the standard. After he convinced them to buy all this technology, he came back and said, hey, by the way, you need two-factor authentication. It turns out I'm an extra on smart cards and PKIs. So here, please write me another check for a couple of million dollars. If you look at the NIST standard itself, section 4.4.2, I think, directionally, includes the statement, systems must be able to authenticate themselves either at the user level, the process level, or the role level, which means HIPAA compliance could be achieved with a shared password. The compliance rules don't actually tell that we need to spend the money or the focus that we're convinced we need to spend. CEOs don't agree with us because they think we're wasting money on compliance. The theory of corporations. Corporations exist primarily to create value for their users or clients and take some of that value back as revenue and do so in a way which is respectful to your employees and your shareholders. Companies exist fundamentally to make revenue and profit. We can argue about the morality of that, but that is sort of ground truth. We like our corporations to make money and profit because it means we have jobs and it means we get bonuses and our stock options go up. We would like to do, like anyone else in the company, we'd like to do things that help our company to be more successful. So if you look at what makes companies more successful, there's been some interesting research over the years, like probably 500,000 papers on it. There was a study not very long ago done about returns to companies that were on the Fortune Best Places to Work list. Have you all seen this list? They do it once a year. It's like the top 40 places to work or best place to work or something. It's a pretty good study, but a lot of things go into being on the top 40 list. A really big one is employee satisfaction. A recent study of the companies that made the top 40 list showed that if you were on the list, you made about twice the returns as a matched company that wasn't on the list. So if there's a company like yours that's not on the best places to work, you are and are likely to make twice the return. Sounds like a nice thing to do. How do you generate employee satisfaction? There's a long series of studies that show that employee satisfaction is largely driven by their ability to innovate, which is often described as their work flexibility. So if you allow your employees to innovate more, then you're materially more likely to be able to make twice the return. It's a nice problem, right? However, the CLC did a study last year asking more questions on what employee flexibility looks like. And what's interesting is they found that for a large number of companies, employees would say, yes, I have the room to innovate. However, when I innovate, I feel like I'm breaking the rules. I feel as if I'm acting irresponsibly, okay? In those cases where employees have the freedom to innovate, but perceive themselves as being irresponsible as a result, there was no additional return. Those companies looked exactly like the companies where no innovation is possible. So if you make your employees feel like thieves for innovating, you lose all the benefit of it. Interesting. So that suggests we should find a way to make our employees able to innovate, do cool things and do it in a way which makes them feel like they're breaking the rules, i.e., we should provide flexibility, particular around security, except that breaks all the rules we understand, that pushes all of our buttons. It pushes all of our buttons because we're fighting the last war. We all grew up in a world where people would drive to their offices, open their office doors, turn on their computers, and they're suddenly at work. And at night, they turn off their computers, they get back in their car, they go home, and they're suddenly at home. So that's the notion of work-life split, primarily around showing up to an office to work. This notion of work-life separation is actually a pretty new notion. It first appeared in Taylorism, which was the scientific management guy from the early 1900s. Before that, the notion that work and life were separate didn't really exist. You still had this work-life balance, but it was done differently. Work and life were far more integrated. This view that work and life are separated isn't supported by anything today, either. 50% of employees report having used their personal IM accounts to do work. That's kind of the worst of all possible worlds, right? They're using some third-party system that we don't understand and insecure manner to talk about work. Why are they doing that? They're doing it because our systems stink. When I was at EMI, we used Exchange as our calendaring system, which is a great system, obviously, but we used a particularly horrific remote access methodology. Horrific in the sense that I couldn't get on a large material number of times. And I spent a lot of time on planes. I wanted to be able to check my calendar from the Singapore airport. So what did I do? I had my admin copy every single work appointment I had into my private GCAL. Yes, since I was accountable for security policies, I needed to censure myself for doing that. But all of a sudden, by doing that, I spent a little bit of money and salary for my admin to yield a vast improvement in my ability to work. I found a way to be flexible by breaking my own rules. Not surprising EMI is not doing all that well, but then on the other hand, EMI is a record company. The reason that people like to use consumer software, they like to use Google Calendar, they like to use versions of Gmail, to do work, as I said, is because enterprise software hasn't been that great lately. Twenty years ago, the best and brightest engineers went to work for enterprise software companies. The availability of an enterprise software was hugely greater than the availability of any consumer software. The functionality of enterprise software was great. You could do anything you wanted all the time. It was great. Over the last ten years, a large amount of innovation has moved from enterprise software to consumer software. The availability and security of consumer software has spiked. I mean, if you look at Google.com, the availability of G.com is pretty high, certainly higher than my exchange instance was at EMI. People want to get their work done there. They want to get their work done in a way that makes them feel good. And increasingly, consumer software makes that easier to happen. Easier to happen. That's not even English, is it? We don't really want that to happen. We really don't really want people to merge work and life. We all grew up in a world where what you're trying to do is build a ring of security around our systems. We're trying to build great boundary security. So we try to build firewalls. We do all this trying to keep that people from the outside in. However, we don't believe in our boundary security. If we did, we wouldn't spend millions of dollars on intrusion detection systems. Our employees don't believe in or like our boundary security model. If they did, we wouldn't be hunting for rogue Wi-Fi outlets all the time. No one believes in the system we're at, and yet we're still doing it. If you look at some of the best practices of security controls that are flowing around out there, the one best practice security control, turn off wireless networks. That's clearly not the right answer. Another in the top ten commonly is add restrictive proxies so people can't use instant messaging. See earlier point. If you ask employees why they're using instant messaging, the number one reason, the modal reason, is because they want to announce presence across their work and their personal lives. Putting restricted proxies in place to block that means that all those people are annoyed and they're going to find some way around it and they're going to add inside a Gmail window. They're going to find some way around what you want and what you're doing. So we need to change our tactics. We need to be flexible in a way that doesn't make them feel like they're cheating because we want those outsized returns, right? We want our bonus to grow, and that means our tactics need to change. We can't fight the last war anymore. We need to fight the next war. The next war is this mixture of work and life. The next war says that Taylor was wrong and separating work from life isn't the right approach. At this point in the talk, I'd like to use an analogy which is almost certainly apocryphal. There's a long story about building college campuses and it starts by saying, architects build these beautiful buildings and students have to get from one building to the next and so to do that they put concrete sidewalks between this building and that building and plant grass everywhere else and it's lovely and practically bucolic. After a few months, the architects notice that there's dead grass in paths between buildings because the students are walking across the grass rather than walking up and down the sidewalks. So what do the landscaper do? They put like poles and chains to block the grass. You can't walk across the grass. They're trying to force people to walk on the sidewalks and then replant the grass. After a few more months, they find out that it turned out the grass died again. Oh, people must be stepping over the ropes. This is terrible. What should we do? I got it. Let's plant hedges and flower pots and all these other elements to keep people on the sidewalk. Suddenly, you've gone from this nice open bucolic campus to this thing which is chopped up by all these different things. You've got ropes over here, you've got hedges over there and all of a sudden, it no longer looks like what we tried to build and all those things got added because we wanted to convince our students not to do what they wanted to do. That's relatively clearly the wrong thing. Suddenly, you're wasting vast quantities of money rather than simply listening to your users. An alternative way to build campuses is to put up the beautiful buildings and plant grass everywhere. And then in four or five, six months, notice where the grass is dead and put sidewalks there. You accomplish the same goal, right? You have sidewalks to keep you from killing grass. But you go at it entirely differently. You go at it by saying, what do your users want to do and find some way to secure that, find some way to make that work? That is the next battle for us. What do our clients want to do? What do our employees want to do? That is the challenge for the next generation of security.  So let's assume you're a security officer and there's a major breach. You shuffle into the CEO's office and say, hi, boss, how's the coffee? Listen, it's been kind of a bad day. It turns out, well, someone got ahold of all of our credit card records and about half of our users now have credit card fraud and it's really expensive and my day is kind of bad. What do you think is going to happen next? Your CEO is going to say, well, thanks for the information. Your day is about to get a lot worse. Go see HR. We are heavily incented to protect against downside because we're going to get blamed for it. And of course, we have the availability heuristic as well, right? Every day you're walking around going to the bathroom and someone grabs your arm and says, hey, did you hear about this problem or this breach or I don't understand why SMS isn't secure? Reference to talk yesterday, anyway. So every time someone asks us about security, we have all kinds of things available to us. So again, we're going to overestimate the likelihood of a problem. Our incentives are wrong and our psychology is wrong. On top of that, every day you have a call from a vendor who comes into your office and legitimately is trying to sell you a solution. They're not being sleazy. That's their job. Their job is to sell you stuff. So to sell you something, they have to convince you that their solution solves a problem that you have, which may involve convincing you that you have a problem in the first place. This adds to your fear. So basically you live in this miasma of information, of press stories telling you bad things, about people stopping in the hallway telling you bad things, about vendors telling you bad things. So of course, so of course you're going to have something which plays a loud noise in a talk. Of course you're going to overspend on security. You can't help it. So we have to have a different way to think about security. Fundamentally, security needs to no longer be your problem. There are several ways to do this. You can change jobs, change careers, work for a company that's in a different country, and then 10 years later you're not in security anymore. Of course, at that moment you're me giving a security talk 10 years later. So that approach doesn't really work. There is a different approach however. You can stop making yourself solely responsible for security. The security team at Google did a great job of this. I was really, really impressed by what they did. They fundamentally distributed security across the entire organization. Every piece of code that got pushed to production had to be code reviewed. So if someone wrote the code, someone else checked it. Part of what they checked for was common security problems. And so basically when they reviewed, they would say, yep, this isn't a problem, this isn't a problem, looks good to be next. QA did their testing, and they did all the functional testing, the regression testing, et cetera, and they also did security testing. Again, you know, not perfect, but materially raising the bar. We also had a different working structure. We didn't specify the endpoint that our engineers could use. Some used Windows machines, some used Macs like me, some used Linux machines. People used everything they could possibly think of. So we didn't believe we could have endpoint security that worked because we didn't have any endpoint control. So we built security far, far into the infrastructure. We didn't run antivirus on endpoint machines. We ran it on the mail servers, which of course is the primary virus methodology. We ran applications near our routers to say, if some link suddenly has a very strange traffic shape, something's probably wrong, go check that machine. We had automated systems to track for confidential information, et cetera. There's a study recently showed that showed that 50% of our organizations have at least one person largely dedicated to checking employee behavior on the internet. One out of every two of you are paying NARCs to watch your employees. There's no one from the DEA in the room, right? Okay, good. So after you were being arrested for using the word NARC, the point of all this effort was to try and make security spread across the entire organization, but then we did something which spread it beyond the organization. Larry Page came to us and said, you know, I think we should put it in Gmail. We should tell our users who else has logged on to their Gmail account. And we were like, hmm, I'm not sure what that means. So we went round and round and round, and ultimately we ended up with what's done today. If you go on to Gmail and you go all the way to the bottom of the page, you'll see a little tiny ebdy font, a thing that says your account is also being accessed at IP blah, or you have two active sessions from IP blah foo and bar. When we put that out, my comment was this is never going to work. No one knows what IP addresses mean, like what are you supposed to do as a result. This is never going to work. It turns out actually that there's a vast number of people who click on the what's this link associated with that. A lot of people are looking for it. And as a result, you see people killing the other sessions, etc. It turns out that by asking our users to help themselves with security, even though we did it in a way which is not very easy to understand, they would help it. It's sort of akin to the fact that fast food chains have figured out a way to outsource their work to you by giving you an empty cup and having you go fill up your soda yourself. Fundamentally, that's a cost-saving mechanism for their side. But market research shows that you are more likely to spend more money at a fast food restaurant that has outsourced its work to you by giving you an empty cup than in a restaurant where they fill it up for you. Similarly, our users, Google's users I should say, loved the fact that they got to be involved in their own solutions, that they got to be part of the answer. So Google's approach was security isn't the security team's problem. It's all the engineers and all the users' problem. And as a result, the team was able to focus on what mattered. So for example, the team spent all this time focusing on the crown jewels. User login. They built a very good, clean user login system that was super easy to use. So rather than inventing it, inventing anew, people building other products would simply link it in. Make it easy to do the right thing. Most people will do it. We focused on credit card numbers and search logs. We focused on building tight, very hard security around the things that mattered and letting the organization secure the rest. That allowed us to have a much better leverage. How many of you figured out the title of the talk? Anybody? Anyone notice the similarities of the titles of the slides? Okay. The title of the talk was is that you, baby, or just a bridge in the sky. That is a commonly misheard lyric from a Bruce Springsteen song called Brilliant to Skies. The line is, is that you, baby, or just a brilliant disguise? Many, many people misunderstand that lyric. If you play that loudly at a party and people start singing along, the vast majority of them will sing the wrong lyric. Much like the vast majority of us are saying the wrong things and doing the wrong things to our companies. We're not doing them because we're dumb. We're doing them because we don't know the right lyrics. As you change from being a security officer to being an executive to viewing the world differently, it's easy to notice who's singing the wrong lyrics and why. The right lyrics involve recognizing your own incentives, recognizing your own decision biases, recognizing that other people's incentives don't always align with yours, and trying to find a way to fight the next war, not the last war. Trying to find a way to make security actually add value. Not downside protection, but actually add value and do it in a way which allows workers to be flexible and not feel like they're skisballs for doing it. Because fundamentally, fighting the next war turned security from being a roadblock into the good guys. It's much more fun to be the good guys than the bad guys. It's way more pleasant. And it increases the chances that your organizations will succeed, increase the chances your bonus will be nice and your stock price will be up. Getting the lyric right, getting the communication between you and the executives right, getting the understanding of what your users want right is a hugely valuable outcome and it's something we are extremely bad at. As a result of being bad at it, we risk becoming irrelevant. Almost 80% of employees at Fortune 100 companies report at one time or another volitionally breaking a security rule. 8 out of 10 of your employees are breaking your rules at least once, knowing it and not caring. That suggests that we've built sidewalks and maybe even ropes and hedges and flower pots instead of building sidewalks where the users want to go.  Seriously, that's awful. And with that, I'll take questions if there are any. It looks like the question mic is up here and if there aren't any, I'll be across the hall afterwards. Thanks very much.