From Boston, Massachusetts, it's theCUBE. Covering AWS Reinforce 2019. Brought to you by Amazon Web Services and its ecosystem partners. Hey, welcome back everyone to theCUBE's live coverage of AWS Reinforce in Boston, Massachusetts. I'm John Furrier with Dave Vellante. This is Reinforce. This is the inaugural conference for AWS around the security and cloud security market. A new category being formed from an event standpoint around cloud security. Our next guest is CUBE alumni guest analyst, Corey Quinn, cloud economist with the Duckbill Group. Good to see you again. Great to have you on. Love to have you come back because you're out in the hallways. You're out getting all the data and bringing it back and reporting. But this event, unlike the other ones you had great commentary and analysis on, you were mentioned on stage during the keynote from Stephen Smith. Congratulations. Thank you. I'm still not quite sure who is getting fired over that one, but somehow it happened. And I didn't know it was coming. It was incredibly flattering to have that happen. But it was first, huh, awesome. He knows who I am. Followed quickly by, oh dear, he knows who I am. And at this point, I'm not quite sure what to make of that. We'll see. It's good news, it's good business. All press is good press, as they say. But let's get down to it. Obviously, security, it's a security conference. This is the inaugural event. We always love to go to inaugural events because in case there's no second event, we were there for one event. So that's always the case. Been there since the beginning is often great bragging rights. And if there isn't a second one, well, you don't need to bring it up ever again. So if they've already announced there's another one coming to Houston next year, so that'll be entertaining. So a lot of people were saying to us, reinforce security event. Some skepticism, some bullish on the sector. Obviously cloud is hot, but the commentary was, oh, no one's really going to be there. It's going to be more of an educational event. So yeah, so more of an educational event for sure. They're talking about stuff that they can't have time to do at re-invent. But there's a lot of investment going on. There are players here from the companies, McAfee, you name the big name companies here. They're sending real people a lot of biz dev folks, trying to understand how to build out the sector. A lot of technical technologists here as well, digging into some of the deep conversations. Do you agree? What's your thoughts of the event? I'm surprised. I was expecting this to be a whole bunch of people trying to sell things to other people who are trying to sell them things in return. And it's not. There are people who are using the cloud for interesting things, walking around. And that's fantastic. One thing that has always struck me as being sort of strange and why I guess I feel spiritually aligned here with nothing else is cost and security are always going to be trailing functions. No company is excited to invest in those things until immediately after, they really should have been investing in those things and weren't. So at time to market, velocity are always going to be something much more valuable and important to any company strategically. But we're seeing people start to get ahead of the curve in some ways. And that's, it's refreshing and frankly surprising. What's the top story in your mind? Top three stories coming out of reinforcement, industry standpoint or from a product standpoint that you think need to be told or amplified or if not being told, be told. Well, there's been the stuff that we've seen on the stage and that's terrific. And I think that you probably rehash those a fair bit with other guests. For me, what I'm seeing, that the story that resonates as I walk around the expo hall here is we're seeing a bunch of companies that have deep roots in data center environments. And now they're trying to come up with stories that resonate with cloud. And if they don't, this is a transformational moment. They're going to effectively likely find themselves in decline. But they're not differentiating themselves from one another particularly well. There are a few very key things that we're seeing people operate within such as with the new port mirroring stuff coming out of VPC traffic. You have a bunch of companies that are able to consume those or flow logs if you want to go back in time a little bit and spit out analysis on this. But you're not seeing a lot of differentiation around this or, hey, we'll take all your security events and spit out the useful things. Okay, that is valuable and you need to be able to do that. How many vendors do you need in one company doing the exact same thing? You know, we had a lot of sites, CISOs on here and practitioners. And one of the comments that's on that point is, yeah, he's like, look it, I don't need more alerts. I need things fixed. Don't just tell me what's going on, fix it. So the automation story is also a pretty big one. The VCP traffic mirror, I think it's going to be just great for analytics, great for just for getting that data out. But what does it actually impact? And the automation piece and the, okay, there's an alert, pay attention to it or ignore it or fix it, seems to be kind of the next level conversations, your thoughts around that piece. I think that as we take a look at this space and we see companies continuing to look at things like auto remediation, automations terrific until the first time it does something you didn't want it to do and take something down, at which point no one trusts it ever again. And that becomes something hard to tend to. I also think we're starting to see a bit of a new chapter as a alliance with this from AWS and its relationship with partners. I mean, historically, you look at who to reinvent and you're sitting on the expo hall and watching the keynote. And it feels like it's AWS red wedding where you're trying to see who's about to get killed by a feature that just comes out. And now we're seeing that they've largely left aspects of the security space alone. They've had VPC flow logs for a long time but sorting through those yourself was always like straining raw sewage with your teeth. You had to find a partner solution or build something yourself out of open source tooling from spit and duct tape. There's never been a great tool there. And it almost feels like they're leaving that area for example, alone. And leaving that as an area right for partners. Now, how do you partner with something like AWS? That's a hard question to answer. Well, so one of the other things we heard from practitioners is they don't want incrementalism. They're kind of sick of that. They want step functions that do as John said, remediate. So, you called the red wedding at the main stage. What does a partner have to do to stay viable in this ecosystem? Historically, the answer to that has always been to continue innovating ahead of the bow wave of AWS's own innovation. The problem is you see that slide that they put on at every event that everyone who doesn't work at AWS sees that shows the geometric increase in number of feature and service releases. And we all feel the sinking sensation of not even the partner side but the they're releasing so much that I know some of that is going to fix things for my company but I'll never hear it because it's drowned in the sheer volume of what they're releasing. AWS is rapidly increasing their pace of innovation to the point where companies that are not able to at least match that are going to be in for a bad time as they find themselves outpaced by the vendor they're partnering with. Well, and you heard Liberty Mutual say that number one challenge was actually the pace of cloud being able to absorb all these new features. Yes. And so, and you imagine the partner ecosystem. I mean, so it's not just the partners, it's the customers as well that bow is coming faster than they can move. I can sit here now and talk very convincingly about services that don't exist and not get called out on them by an AWS employee who happens to be sitting here because no one person can have all of this in their head anymore. It's outpaced most people's ability to wrap their heads around that and contextualize it. So people specialize, people focus. And I think to some extent that might be an aspect of why we're seeing reinforces its own conference. So we talked a lot of CISOs this trip, a lot of one-on-ones. We had some interviews. Some private meetings. I'm going to read you a list of key areas that they brought up as concerned. I want to get your reaction to. Pick the ones out that you think are very relevant. Sure. Just speedily, it's very fast. Vendor lock-in, spend, security-native, service provider, supplier, relationship, metrics, cloud security is different, integration, identity, automation, workforce talent, coding security, and the human equation. These are all kind of key areas that seem to glob and be categorically formed. Your thoughts to those, which ones do you think jump out as criticalities on the market? Sure, I think right now people talking about lock-in are basically wasting their time and spinning their wheels. If you, for example, you go with two cloud providers because you don't want to be locked into one, well now there's a rife partner ecosystem because translating things like IAM into another provider's environment is completely foreign. You have to build an entire new security model on top of things in order to do that effectively. That's great. In security we're seeing less of an aversion to lock-in than we are in other aspects of the business, and I think that is probably the right answer. Again, I'm not partisan in this battle. If someone wants to go with a different cloud provider than AWS, great, awesome, pick the one that makes sense for your business. I don't think that it necessarily matters, but pick one and go all in on that. Well, this came up too in a couple of ways. One was the general consensus was who doesn't like multicloud? If you could seamlessly move stuff between clouds without having to do the modification on all this code that has to be developed, who wouldn't love that? But the reality is it doesn't exist. To your point, this came up again as that workforce talent is. One CISO said, I'm with AWS. I have a little bit of Google. I probably could go Azure. Maybe I bought a company, we'd deal with some stuff over there, but for the most part, all my talent is peaked on AWS. Why would I want to have three separate security teams peaking on different things when I want everyone on our stack? They're building their own stacks, then outsourcing or using suppliers where it supports it. But the focus of building their own stacks, their own security, coding up was critical and having a split competency on code basis just to make it multicloud wasn't non-starting. And I think multicloud has been a symptom. I mean, it's more than a strategy. I think it's in a large part, it's a somewhat desperate attempt by a number of vendors who don't have their own cloud to say, hey, you need to have a multicloud strategy, but multicloud has been really an outcome of multiple projects, as you say, M&A, Horses for Courses, Lines of Business. So my question is, I think you just answered it. Multicloud is more complex, less secure and probably more costly, but is it a viable strategy for things other than lock-in? To a point, there are stories about durability, there's business reasons. If you have a customer who does not want their data living on one particular cloud provider, those are strategic reasons to get away from it. And to be clear, I would love the exact same thing that you just mentioned, where I could take what I've built and run that seamlessly on other providers. But I don't just want that to be a pile of VMs and maybe some disk. I want those to be the higher-level services that take care of massive amounts of my business for me and I want to flow those seamlessly between providers. And there's just no story around that for anything reasonable or modern. And history would say there won't really ever be without some kind of open source movement. Oh yes, a more honest reading of some of the other cloud providers that are talking about multicloud extensively translates that through a slight filter to we believe you should look into multicloud because if you're going all in on a single provider, there is no way in the world it's going to be us. And that's sort of the challenge, is if you take a look at a number of companies out here, if someone goes all in on one provider, they will not have much, if anything, to sell them of differentiated value. And that becomes the larger picture challenge for an awful lot of companies. And I empathize with that, I really do. Amazon's starting to do a lot of channel development. I'll see their emphasis on helping people make some cash. I'll see their vendors and ecosystems afraid, always afraid. So shared responsibility at one level is like, well, we only have one security model. We do stuff and you do stuff. So obviously it's inherently shared. So I think that's really not a surprise for me. The issue is how to get successful monetization in the ecosystem, clearly defining lines of rules of engagement around where the white spaces are. And where the differentiation can occur, your thoughts on how that plays out. Yeah, and that's a great question because I don't think you're ever going to get someone from Amazon sitting in a room and saying, okay, if you build tool that does this, we're never, ever, ever going to build a thing that does that. They just launched a service at Reinvent that talks to satellites in orbit. If they're going to build that, there's nothing that I will say they're never going to get involved with. The product strategy from the outside feels like it's a Post-it note that says yes on it. And how do you wind up successfully building and scaling a business around that? I don't have a clue. Andy Jassy's on the record here on theCUBE and privately with me on my reporting, saying never say never, we will never say never. So that is actually an explicit, same word on that one. And I'm a independent consultant where my first language is sarcasm. So I basically make fun of AWS in the newsletter and podcast and that seems to go reasonably well. But I'm never going to say that they're not going to move into self-deprecation as a business model. Look at some of their service names. They're clearly starting to make inroads in that space. So I have to keep innovating ahead of that bow wave. And for now, okay, I can't fathom trying to build a business model with a 300-person company and being able to continue to innovate at that pace and avoid the rapid shifts as AWS explores new offers. And what I look about, well, we're always kind of goofing on AWS. We're fanboys as well, as you know. But one of the things I love about AWS is that they give the opportunity for their partners and they give them plenty of heads up. It's pretty much the rules of engagement is never say never. But if they're not differentiating, that's their job. Their job is to be better. Now, one thing Amazon does say is, hey, we might have a competing service, but we're always going to favor the customer. So the partner, if a customer wants an Amazon cloud trail, they want cloud trail for a great example. There's been requests for that. So why wouldn't they do it? But they also recognize there's few people in the ecosystem that do similar things. And they're not going to actively try to put them out of business, per se. Oh yeah, one company that's done fantastically well partnering with everyone is PagerDuty. And even if AWS were to announce a service that wakes you up in the middle of the night when something breaks, it's great, awesome. How about you update your status page in a timely fashion first, then talk about me depending on the infrastructure that you run to tell me when the infrastructure that you run is now degraded. The idea of being able to take some function like that and outsource worked well enough for them to go public. So where are the safe points in the ecosystem? So obviously a partner that has a strong on-prem presence that Amazon wants to get access to, that's a short-term, maybe even a mid-term strategy, okay, professional services. If you're Accenture and Ernie Young and Deloitte, PwC, you're probably okay, right? Because that's not a business that Amazon really wants to be in. They might want to automate as much of that as possible, but the world's going to do that anyway. But what's your take? I would also add cost optimization to that. Or not from a basis of technical capability, and I think their current tooling is disappointing. I'd argue that cost explorer and the rest of their billing situation is the asterisk next to customer obsession if we're being perfectly honest. But there's always going to be some value in an external party coming in from that space and what form that takes is going to change, but it is not very defensible internally to say, our cloud spend is optimized because the vendor we're writing those large checks to tells us it is, there's always going to be a need for some third-party validation. And whether that can come through software. How big is that business? It's a great question. We're right now we're seeing that people are spending over $30 billion a year on AWS and climbing. One thing we can say with a certainty in almost every case is that people's cloud bills are not getting smaller month over month, so it's a growing market. It's one that people feel incredibly acutely, and when you get a few drinks into people and they start complaining about various aspects of cloud, one of the first most common points that comes up is the bill. Not that it's too high, but that it is inscrutable.  Is it a 10% factor or more? It depends on the level of effort you're willing to invest. I mean, there's a story for almost environments where you can save 70% in your cloud bill.  Six of those months, you'll be hard down across the board and then wait, where did everyone go? Because no one's going to do that. Yeah, you might be out of business. So it's always a question of effort spent doing optimization versus improving features, speeding time to market, and delivering something that will generate far more revenue. The theoretical upside of cost optimization is 100% of your cloud bill. Launching the right service or product can bring in multiples of that in revenue. I think my theory on differentiation, Dave, is that I think Amazon's basically saying, in so many words, not directly, but it's my interpretation, hold on to the rocket ship of AWS as long as you can. And if you can get stable, hold on. If you fall off, that's just your fault, right? So what that means is, to me, move up the stack. So Amazon's clearly going to continue to grow and create scale. So the benefits of the company is to create a value proposition that can extract rents out of the marketplace from value that they create on the Amazon growth, which means they got a lockstep with Amazon on growth and constantly pivot up to where there's space. And Amazon's just a steamroller will come in, the rocket ship that's going so fast, whatever metaphor. And so people who just say, we made a deal with Amazon, we're in, and then kind of sit idle, we'll probably end up getting spun off. Because it's like they'll fall off on Amazon. All right, so we did that, you didn't differentiate enough, you didn't innovate enough, but they're going to give everyone the opportunity to take a place with the growth. So the strategy management-wise is just constantly pushing the envelope. So that's implicit in the sort of Amazon posture. What's explicit in Amazon's posture is build applications on our platform. And you should be okay, you know, for a while. Yeah, and again, and I think a lot of engineers get stuck in the trap of building something and spending all their time making their code quality as best as possible. But that's not going to lead to a business outcome one way or another. We see stories of companies hitting success with a tire fire of an infrastructure all the time. Twitter used to be played by massive downtime until they were large enough to justify the time and expense of a massive rewrite. And now Twitter is effectively up all the time. Whether that's good or not is a separate argument, but they're there, so there's always going to be time to fix things. Well, the great example is they built it on Rails and they put it in the Amazon cloud. It was just kind of a hack. And then all of a sudden, boom, people loved it. And then that's to me the benefit of cloud. Once you get that escape velocity, the investment to start Twitter was very low given what the success was. And then they had the rewrite because the scale was bursting up. That's called prototyping. Oh yeah. But that's what enterprises have to do. This is the theme of Agile. Get started as a theme. Just dig in, do a hackathon, but don't confuse that with scale. That's where the rubber meets the road. Right. And the, oh cloud isn't for us because we're an exception case. There are very few companies for whom that statement is true in the modern era. And do an honest analysis first before deciding we're going to build our own data centers because we can do it for cheaper. If you're Dropbox putting storage in, great. If otherwise you're going to wind up in this story, we're, oh well, we have 20 instances now so we can do this cheaper in Iraq somewhere. I will bet you a house you're wrong, but okay. People are telling me, okay, final question for you. As you wandered around and been in the sessions, been in the analyst thing, what are some slice of life kind of commentary stories you bumped into that you found either funny, clever, insulting or humorous? What's out on the floor? What are some of the conversations? One of the best ones was a company, I'm not going to name, but the story they told was fantastic. They're primarily on Azure and, but they also have a strong secondary presence with AWS and that's fascinating to me. How does that work internally?  Which is fascinating and there are business reasons behind why they're doing what they're doing but that story was just very humorous. I can't confirm or deny whether it was true or not because it was someone with way too much to drink telling an awesome story but the idea of having to forcibly drag your developers away from a thing in favor of another thing? That's like being at a bad party. It's like, oh the better party's over there. All my friends are over there. They have a commitment, they have a commitment to Microsoft's software estate so that's likely why they're- Or a business deal with Microsoft. And I'm not saying this is necessarily the wrong approach. No, it might be the right business decision but when you ask the developers we see that all the time, John. All the time. I mean I had a developer on the one time company who started like, look we thought it would be great to build on Azure. We were actually being paid. They were running checks to incent us and I had a revolt. Engineers were all revolting because the reverse proxies us they were cobbled together services and they weren't clean native services and primitives so the engineers were revolting so we had to turn down the cash from Microsoft and go back to Amazon. Azure is much better now but they have to outrun that legacy shadow of at first it wasn't great and people try something once and that was terrible. Well would you like to try it again now? Why would I do that? It was terrible. And it takes time to overcome that knee-jerk reaction. Well but to your point about the business decision it might make business sense to do that with Microsoft. It's maybe a little bit more predictable than Amazon is as a partner. Oh the way to optimize your bill on another cloud provider that isn't AWS these days is to call up your account rep and yell at them. They're willing to buy business in most cases. Now that's not specific to any one provider that's most of them. It's challenging to optimize free so we don't see the same level of expensive bill problems in most companies there as well. Well the good news is on Microsoft and I was a real big critic of Azure going back a few years ago is that they absolutely have changed their philosophy going back I'd say two, three years ago in the past two years in particular 24 months they've really been cranking. They've been peddling as fast as they can. They're serious, they're committed from the top so I didn't tell them. So there's no doubt they're doing it obviously with the Kubernetes work you're seeing what they're doing is phenomenal. So they've got a great developer job today. They're in for the long game. They're not going to be a fad. No doubt about it. No, and we're not going to see for example the Verizon public cloud the HP public cloud both of which were turned off. The ones that we're seeing today are largely going to be here to stay of the big three, big four we include Alibaba and it's, I'm not worried about the long term viability of any of them. It's just finding their niche, finding their market. To find their lanes. Corey, great to have you on. Good to hear some of those stories. Thanks for the commentary. Thank you. As always great guest analyst, Cube alumni friend analyst, Corey Quinn here in the Cube bringing you all the top action from AWS reinforce their first inaugural security conference around cloud security and cubes initiation of security coverage continues after this break.


Optimal immune resilience, IR, is a trait observed across the age spectrum more common in females and associated with better health outcomes. It is characterized by a balanced immunological state that promotes disease resistance and controls inflammation. This balance is reflected in two distinct peripheral blood metrics. CD8 plus T cells and gene expression signatures tracking longevity associated immunocompetence and mortality associated information. These metrics can be used to measure IR levels and monitor changes over time. Optimal IR is also associated with improved survival during COVID-19 and sepsis and longer life spans. Furthermore, it may be reversible through decreased inflammatory stress. This article was authored by Sunil K. Ahutja, Muthusaravanan Manoran, Grace C. Lee, and others.


Barbara Simons who's the president of verified voting and I'll let everybody get seated really quick And I'll let you guys do just a couple minutes each on Who you are and your organization and so on and Then Dave Forsey with the National Governors Association and Eric with This is center for that security which is the group that runs the MS Isaac as well as the 20 critical cyber security controls So with that I'll actually turn it over to you guys to be able to Talk a little bit about your organization and and yourself. Okay. All right, so hi everybody. I'm Eric Cameron I'll start out. I guess I'm from the Center for Internet Security and CIS. I'm gonna refer to it as CIS CIS produces a number of free things for the larger cyber security community among them being The top 20 security controls, which are a set of technical controls that any organization can use for free to Enhance the cyber security stance of their organization be it private educational government. You name it everyone's free to use them And so that's one half of CIS secure benchmarks top 20 controls a community that we run for the benefit of everybody and the other half of CIS is the MS Isaac, which is a DHS funded program MS Isaac standing for information sharing and analysis center and the MS Isaac has built a relationship with all of the 56 States and territories throughout the u.s. And we run a network called Albert and Albert is Closely related to the federal network called Einstein, which is used to monitor Dot gov space Albert monitors state local tribal and territorial space And we have sensors throughout the United States in almost every single state and territory in the US So you can think of us one half of CIS as an intrusion detection system that covers the entire continental u.s So that's my intro to what I do and over to you Thank you very much. I Help lead cyber our cyber security work at the National Governors Association for those who don't know the National Governors Association Is a special snowflake? Half of it was actually created by statute. So it's not a 501 C3. It's not a corporation. It is a statutory entity It's called the instrumentality of the states. So every state that's a member, which is virtually every state and territory Pays in dues and it pays for certain services for governor's offices. I work at the other arm Which is called the Center for best practices, which is a 501 C3 So we get money from foundations corporate donors and federal grants to help states with policy problems Specifically I help states with cyber security strategy cyber security governance and cyber security Disruption response. We'd like to say that as everyone in this room knows we have in many ways figured out the technical Methods needed to stop cyber attacks a lot of the state CIOs and CISOs who run the state systems know this The hard part is actually getting people to do it and that's where governance comes in We have become much more involved in the election issue And I'm here to talk more about that, but I'll let you ask questions and I'll leave it to Barbara I'm Barbara Simons. I'm president of verified voting. I'm a computer scientist by training and I got into the whole voting issue around 2003 and Because some of us computer scientists were kind of appalled that Silicon Valley was about to buy paperless voting machines and despite our best efforts they went ahead and bought them, but we got sucked into this and Like many of my colleagues who I've observed over the years the more they get the more they learn the more they get Have to get involved because they just can't believe what's going on And I hope that will happen to all of you here if it hasn't already Because we need all the help we can get I'm very concerned And I know many many of you are too about what will happen to our democracy if we don't fix our badly broken voting systems That's what verified voting has worked on for years We've worked on making voting secure. We focus on the technology.  We have some attorneys and election officials also who are involved on our board and advisory board But our main focus has been on Making voting technology more secure. We know how to do it. We know it needs to be done. We just have to get it done All right. Thank you everybody. So I guess my first question. I'll go to Eric You mentioned a little bit about the 20 critical critical cyber security controls and I know several of the speakers today I've talked about the need for State and locals to implement basic cyber hygiene. I think that on their networks and their databases Most people in this space would consider basic cyber hygiene to be at least doing the top five critical cyber security controls Do you mind just kind of telling folks what what those are? Okay, sorry So well, let's start by talking about what cyber hygiene is right hygiene meaning Trying to raise the bar for some sort of a system or system of systems to a level where you know It's generally resistant or at least more resistant to epidemiological type threats I that's the way I think of hygiene cyber hygiene and so what are the top five I mentioned the top 20 security controls that CIS produces, but what are the top five? We often tell the top five is the easiest way for any organization to get to that sort of hygienic stance Right where you know that you're taking care of the low-hanging fruit. So the top five CIS controls our asset inventory over what is known or authorized or unauthorized hardware in your environment Asset inventory over what is known or authorized or unauthorized software in your environment secure configuration of that software and that hardware Continual and cyclical vulnerability assessment of that hardware and software of said hardware and software and lastly Figuring out the who should have administrative control and what does administrative control mean in your environment over that hardware and software? So those five topics if everybody let's let's use it since we're talking about elections Those five topics if all election networks are off all election systems were to implement those top five pieces of guidance And the overall hygienic stance of the election system would be enhanced Dustly right so that's that's cyber hygiene or that's the top five for you So I guess Barbara I'll put this to you You know as I think we know you know most state and local governments for various reasons some many of which are out of their control Aren't able today at least to implement those top five controls but a lot of those controls are The actual sensors and so on on the network that can tell you When the bad guys got in what did the bad guys do and so on and so what I think we've seen Reported to Congress and in the media by a lot of folks is like is this term of oh We haven't seen any evidence that votes were tampered with or that the voting registration Databases had deletions or changes or so on but I guess the question is if they're not put doing even these basic five controls and The sensors aren't there to really understand what's going on isn't the more appropriate isn't the more accurate answer Well, we really don't know what happened in the election and have no way of telling what happened until those sensors and so on are in place So Barbara Well actually have a couple of different thoughts Yeah First of all obviously these top five Requirements need to be in place, but frankly They're not adequate. I mean it certainly will not protect against a nation-state attack In fact the top 20 won't it's it's it's much more serious than that I mean the fact that we are here talking about trying to get the top five in place I think is a very sorry reflection on the state of the security of our voting systems in this country I mean I don't mean to take away from what you're doing. It's very important Yeah, so we need much more we need we need a sense of urgency we need sort of like Was it the Chicago project with the bomb was the project for building the bomb was a Chicago Manhattan Yes, but it was a Chicago, but it was called the Manhattan project, right? We need a Manhattan project for our voting systems That's really what we need now in terms of the 2016 election We do know that that at least one voter registration database one Vendor for voter registration databases was hacked and we know for example that that vendor was what was used in Durham, North Carolina where there were major problems on election day As far as I know nobody has gone back to do an analysis of the voter registration database in Durham, North Carolina To see if there were a lot of changes made To people's names or addresses or various information that would send them off to the wrong place to vote and create chaos So we don't know even in that case where we know that the vendor had been hacked In the case of throughout the country on the voting machines Even where there are paper ballots in most cases we did not do an adequate Check to see if any hacking had occurred there and of course where there is where there is no paper It's almost impossible to check I mean we could try impounding the machines and doing a forensic analysis, but it's very hard as I'm sure you guys know It's very hard to do a forensic analysis of a computer And even if you do it and don't find something doesn't mean something wasn't there So the bottom line is we do not know if the 2016 election the votes themselves were hacked or not We don't know if the voter registration database bases were hacked or not And it's unacceptable to be in that state of ignorance We need to make our election such that we know That the correct candidates the candidates who were declared the winners were in fact the winners We do know how to do that, but we're not doing it now Although you were right to hand it to Dave's because my next question is for him but so you know some of this is kind of really technical like the stuff CIS does I think some of the auditing and so on that verified voting talks about obviously really important, but You know oftentimes we hear about what secretaries of state want or County clerks You know suggesting to do this that are the other thing but it seems to me that governors are actually really important to this conversation and I'd really love to hear how NGA or you Dave specifically are thinking About this in terms of the role of governors and so on Okay, so a few caveats Nothing I say here today is in any way Articulating an official position of the National Governors Association or any governor's office Okay, period That being said My team at NGA We're not we don't have technical backgrounds right we're engineers at heart But we do not have degrees in computer science. We're lawyers. We think this is a huge problem We know that governors have a role Because while under many state constitutions the secretary of state is a constitutionally separate branch from the governor the fact is that a lot of the Deployable assets and a lot of the expertise relevant to cyber security resides in state agencies that are under the purview of the governor in Many cases a lot of the back-end systems that are used to run elections like voting registration databases or Actually part of the services that the CIO's office manages. So there's no question that when it comes to actually Preventing attacks and responding to attacks that governors have a role I'd also point out that if you want to make any changes to election law Not necessarily policy, but law you'll need to sign legislation and governors are the ones that sign legislation And if you want them to sign it they need to have buy in I'd also say that the bully pulpit that governors have is Incredibly valuable in terms of raising the profile of this issue at the county level state level and federal level if you want a hava Ahava 2.0, you're going to need governors on your side. So that's why we definitely deserve to be in the conversation So in the same vein I'm wondering from the MS Isaacs perspective if you're seeing governors or other state executives Bringing their CIO or CIS. Oh into the conversation on how to better secure our voting systems both from the back-end database and and network Perspective as well as kind of the front-end stuff the verified voting talks about which is the machines themselves in the ballots So Eric what is MS Isaacs seeing on a CIO and CIS? Oh participation in this So so that's that's actually an interesting question For myself and for my organization because the MS Isaacs interacts daily I would have to say daily with CISOs from all of the states in the US, right? So What are we seeing? Well, we've been seeing since the advent of basically the news cycle with election hacking An uptick in communication from CISOs from state security cybersecurity departments and so forth We're seeing a lot of activity coming from the DHS side at us right regarding setting up committees and so forth and Councils and meetings a lot of activity coming out coming at us from the National Association of Secretaries of State right so we're interacting with an election officials left and right MS Isaacs really plays a middleman role in a Lot of this in terms of we're watching the wire right we're watching what's happening over the internet That's bound for the states and so when stuff like this happens with election cyber hacking Our communication. I'm not sure if this answers your question, but our communication volume basically skyrocketed right regarding this We have been facilitating some meetings I can't necessarily tell you between who but we've been facilitating meetings. We're seeing a big uptick So hopefully that answers your question So then on on top of that I guess my question back to Barbara So, you know if governors are you know showing interest in this than Avi and this CIO and CISO in the state are Are you guys getting more? more traffic from Clerks and secretaries of state asking you guys, you know about best practices and so on and if so You know, what are you hearing? Are you hearing good questions? Are you hearing? Very technical questions or people trying to figure out the right answers to this stuff for or what is the nature of the conversations? Well, I I don't know about traffic to our website and I don't know if we keep tabs on that or not I mean one things that we have on our website is a map of the United States which shows what types of machines are used in every state and Breaking it down to every county and we're really the only resource that provides that so Incidentally, if you want to know what's going on around where you live just check verified voting click on the verifier And you can get that information as far as technical questions coming from election officials and so on Um Individuals involved with verified voting might be getting those questions, but typically we don't get questions sent to the organization itself so Okay, good. So I wanted so that's the end of my questions, but I wanted to get to questions from folks in the audience for the group here, so Sure. Yes, and if you can just yell So I think it's first of all important to know that oh, so I believe your question is What I'm saying makes it sound like we're speaking out of both sides of our mouth And that you're saying that in in the past secretaries of state and governors. This is not a statement from me I'm repeating the question have said that everything's fine I think it's first of all important to remember that Awareness of cyber security as a problem is relatively new at the higher rungs of government in many cases And I think it's important to acknowledge that the National Governors Association rarely makes a policy statement as a Single voice of the governors. So I don't speak for governor's offices. I can't speak for them I do know that the many of the cabinet officials who are in who run state agencies think this is a huge problem and They want resources to deal with it. That is what I can tell you and it is up to us to going forward You know, I came here to DEF CON to see for myself just how vulnerable the systems are and it's clear that they're vulnerable So it is now up to the Center for best practices to do our best job to educate Everybody at the state level that this is a serious problem and then identifying key practical recommendations that we can implement Before 2018 and 2020 that's my job, but I I cannot speak to what governor's offices say An ancillary question to that as I was covering this past election. I Experienced I felt the closer we got to the election the more frequent the response I got from people I was asking about the security the election was we can't question it because if we do people won't vote And I'm concerned as we come to next November and in 2018 It feels like the you know when we get into those final couple of months everybody clams up because there's this fear that Will somehow the electorate will stay home if they don't trust it. I mean, do you think that's going to happen? How can we get past that? So I'll actually take a crack at the first part of that answer if that's okay so in a previous life, I did political campaigns for a living and in fact I was President Obama's national deputy field director in 2008 and We spent an enormous amount of time researching Why people turn out to vote why people don't turn out to vote? What makes people stay home and and so on and we never ever once saw any research that indicated that You know lack of cyber security or something like that Would make people stay home to vote ever in no research not not once And I will say though that it is often Democrats of the party that I'm a part of who make these asinine claims that oh If you say that there's a security issue People will stay home to vote. I will say a group of people that I'm not a Group of which is attorneys are usually the people making that claim on the Democratic side It's our voter protection attorneys who make these ridiculous points and and there's just no evidence to back it up But I'm happy to let somebody else I I've also heard that claim and my my response is We should be truthful with people and we should fix the problem And if we fix the problem then we can say truthfully That you can vote because your vote will be counted correctly what we need our paper ballots and mandatory post-election Manual ballot audits if we put those two things in place throughout the country There's no way to hack our elections because you can't hack paper It's great question three points and I wrote them down to make sure I get them right So the stories the narrative is already out there. So I don't know how pretending I mean that's done cats out of the bag a lot of voters are reading new stories on this every day So we might as well talk about it reasonably and rationally. There's no reason to bury our heads in the sand the concern that I Know that there's a lack of data on that But I think it's a legitimate concern that people won't vote because of this I think that is all the more reason to plan ahead now a lot of the In right before 2016 there were so many questions that were raised and not enough answers And I think the best thing that states can do is to plan ahead have a publicly released plan that shows This is how we are going to deal with any problems that arise and then you're not Forced to make up answers that you might not have questions to Right before an election, right? But I do think that's a good question, but I don't see why we would pretend like people are not already listening To the message, right? That's my answer to that Did that answer your question? Verified voting has done that sort of thing in the past at the state level for example Well, one of the things we've been very involved with is fighting internet voting at the state level Maybe that's a negative, but we've also worked on model language for for for voting But indeed you're right. We do need model language But sometimes one of the things that sometimes happens is that there's there's a piece of legislation that comes along And you think you can stick something in it that'll help your cause I'm sure that happens with the environmental movement too So that's something else that that we do like hopefully there'll be some cyber security legislation coming along And we can say give some money for voting machines because that's a cyber security threat. Hopefully Model language. No, we should have it there That's a very good. I have good suggestion. We should have model language on our website for legislation I'm sorry. I didn't repeat the question. The question was is there model language? As I work at a 501c3 we have to be very careful with lobbying So my particular body doesn't write model legislation. However, we certainly give policy recommendations on a regular basis There are two things you can check out. You can go to meet the threat That you can just Google meet the threat states confront the cyber challenge, which was governor Terry McAuliffe's Cyber security initiative that just ended recently, but we're not going anywhere and then we recently released a governor's guide Governor's guide to cyber security, which is also available online should be accessible through Google by now And we have a whole one pager on election security that includes recommendations that someone might decide to include legislation But we don't have model legislation. No Okay I have not thought of that I'm sure somebody has but it's a very good point and I'm writing it down because I'm going to Go make sure that we think more about it. Oh Yeah, can you repeat the question? Oh the question I think so your question was have we in the context of this discussion We've considered about the census and are you saying that are you saying that the census could be the integrity of the census could Be corrupted. I have heard nor read no one talk about that. So I don't know but I certainly want to look into it I'm not answering that question It's up to states whether they want to So the question is does the National Governors Association believe that states who have not come forward publicly after Being breached whatever breached even means let's recall that often people misuse the term sometimes We're just talking about a port scan and that's not necessarily a breach. Should they come forward? I'm not aware of any law that requires them to do so and National Governors Association would never ask states to do something they don't want to do so that's up to each particular governor Not about disclosure states talk about election security with each other and state officials all the time But not about this particular issue and I wouldn't know that So I can actually speak to that a little bit as well from the MSI sec standpoint since I said MSI sec acts as a Almost like a cyber security proxy in many ways right where we facilitate communication among states and so forth and and so you mentioned a figure That the DHS had let out. I can tell you this from the MSI sec standpoint also from the state standpoint We take the the privacy regulations and so forth of each state very very seriously in fact our entire constituency and everybody who's doing who's Collaborating with us. It's done on trust and so we couldn't the MSI sec could never release that type of information Because each state trusts us as an organization to not do that, right? But so I don't know if that helps lend lend some information to your question or not But at least from the MSI sec standpoint and from the standpoint of how the states collaborate with either with each other from a Cybersecurity standpoint, I wouldn't keep your fingers crossed in terms of that kind of stuff coming out Not sure if that helps but yeah And so the last thing I can say about that is that that avenue that you just outlined where the people are writing letters to There let's say you know secretaries of state or something requesting public information that would be I think the suggested path The MSI sec would say Regular every day citizen should take because the organization like ours couldn't disclose that information just by the nature of what we do We can't disclose that publicly so nor could I was it real quickly a Texas did just just pass a law That is going to require the secretary of state to do a postmortem on the 2016 election So you might want to look into that Who's next? So I don't think that there's anything right now I think that there's a lot of folks who've been talking about this about how do we compel states to to disclose this And I I think there's going to be a lot more conversation about it in the future so I'm almost positive that there is legislation that has been introduced for a federal data breach notification law Almost positive don't quote me on that. But so if that's movement, I don't think there's any chance it's going to pass But if that answers your question Okay, so we have one minute so I didn't want to just give some final wrap-up notes on what's been going on in the in the village Since today so for anybody who wasn't in the room when I announced it earlier Within an hour and 40 minutes The the group in there were able to remotely Gain access to a win-vote machine And with and another group with no prior knowledge of the device at all was able to hack an express pull book And get in and start messing around with the with the database in there that would that would contain a list of voters Since then since I made that announcement around noon today They've gained asked to access to hardware and firmware of a TSX machine And they're currently in the process of reverse engineering the infrared communication protocol of an iVotronic And so they've moved a bunch of the so our our friends in the voting village are Have become a little bit manic about this whole thing And so they've moved the machines upstairs so that they can start working on them tonight actually I think there'll be people some people with a lot of Jolt cola and no sleep mess around voting machines tonight So we're excited about that I Don't know it just says upstairs Probably didn't tell me on purpose Okay, so with that. Thank you everybody who came to this today, and we look forward to seeing folks tomorrow