Banning CVEs – Thomas Pace, NetRise

This is texturing TV. Hey guys. Thanks for the throw.

We're here with Thomas Pace. Who's CEO for net rise your experts in the land of cybersecurity and we're going to be talking about legislation. There's some pending legislation that I guess Congress wants to Outlaw CVS inside a software and federal agencies.

Not sure that's ever going to happen. But Thomas welding the show. Thanks a lot.

Happy to be here. What do you think these folks are thinking of there on the Capitol Hill do they not understand how software is constructed and it seems to be built by mere mortals. So can we actually ban CVS or is it just that we need to have a little chat with them about how the world really works.

You know, I'm not sure if the people who build software. Understand software or the people who use it understand software software is complicated thing. But certainly I think the I think the intention is is Noble but I think the implementation of a noble intention is is someone laughing here as the famous saying goes the road to hell is paved with good intentions that seems to be an adequate saying here.

So I think what they are trying to get to is minimizing the amount of risk that is accepted by the federal government as much as physically possible by attempting to eliminate cve's in totality is a at this point a 100% totally unreasonable Mission and goal for countless reasons I guess some of those would be as as long as humans are writing code having software without errors and vulnerabilities and thusly cve's is is is a long ways away if that will ever happen which is probably fairly unlikely. So I think that you know, a more pragmatic approach is probably going to be required here where maybe we say something like No, critical vulnerabilities are in are in software that the federal government procure, which is also going to be a unbelievably huge challenge or maybe it's vulnerabilities that don't have any active exploits available for them things like that. So I do think there's an opportunity here for the government to adjust the language to make the the expectations a bit more reasonable that that screenshot of that language has been sent around the internet like wildfire and has been turned into memes and everything else already.

So I'm fairly certain that the folks responsible for that language are probably pretty aware that and edit of some form or fashion when you do occur. It's also almost impossible to know when there might be the next CV right we have zero day vulnerabilities. They get assigned the cve and I got an application that was deployed before anybody knew about the vulnerability in the first place.

So am I supposed to put like timestamps on things to let people know how long my CVS existed for when it was discovered. It's kind of becomes like, you know used by this state milk carton kind of thing. yeah, I mean you do get There are dates for CVS.

But you know, I think your point is once the software gets sold to the government that doesn't preclude it from getting cve in the future. That's that's certainly true right the you know whenever we used to do a lot of this the work that we've built a product for now in the past one of the big impetuses for starting the company was well, Hey listen, we're giving people like a PDF and here is like a list of vulnerabilities like well 30 days later 60 days later that report was totally out of date, right because new vulnerabilities have been discovered in open source components or proprietary components or whatever whatever components made up the particular, you know application or device or firmware. So, you know, once again, it's a it's a good idea from like a gating mechanism perspective because I do think there's value in saying something like okay, we do maybe we've identified some vulnerabilities here, but none of them are older than Six months old or something like that.

I don't know because what we find especially in the firmware space is vulnerabilities that are 10 years old 20 years old like ancient software components that are being used in brand new products. So, you know, I think there's there's some room there to put something in there. It's a bit more reasonable.

Like I said, Do you think though that this conversation May expose more people to the flaws in the way that we build software because essentially people are taking components and They're copying them from one application to the next very few. People are writing original code, but they seem to be copying the vulnerabilities that are in the components along with everything else and then somebody goes to fix that when it's actually in a separate branch and then somebody else comes along and copies the same vulnerability over again. So maybe the way we build software is fundamentally broken.

It's a it's a very it's a very good point. It's certainly the case that you know, you see all these numbers like 80% of softwares made up of Open Source components or you know plus or minus that whatever number makes you happy. I guess, you know, there's there's plenty of great tools Technologies processes and place these days that do a very very good job of minimizing the amount of risk associated with like a software development life cycle.

I mean the tools that people are just using natively like get lab and GitHub and Jenkins and things like that have built in vulnerability scanning that if used properly drastically reduces, the number of issues that kind of get exit that can exist and move into moving to production. You're 100% right? There is a significant amount of code reuse that is very very easy to identify.

That's one of the things We obviously do is like okay great. We've identified a risk or vulnerability or something that's been exploited and gone wrong over here. That's relatively easy to do right like that.

People are doing that for a long time. Here's what's really hard to do. If we identified this thing getting exploited over here where else is the thing that got exploited in the greater Corpus of things right log4j being the biggest bonus most recent example, but even if you look at like pipe dream the attack that happened in Ukraine that draw ghosts wrote about probably actually made a wonderful point one that I've been talking about for a while is hey guys, we're happy we found this it was bad.

Here's how it happened. Here's why it happened wonderful, but the bigger more important question is where else is this software component? That was the foundation for this attack to occur.

That is something we don't have good visibility to and so that's that's I think the an even bigger concern in some cases. Man, when you use three words that are among the biggest in the English language, which is if used properly so why aren't things used properly? Well, I think there's a bunch of reasons.

time to Market matters more than security Market Uh, so velocity is always going to Trump Security in most of these areas. There's exceptions to that right like some some Industries do a much more like rigorous job, like Automotive Safety critical systems defense things like that. All of these markets have had problems like no one's perfect.

But some markets seem to do a better job than others. You have the you have the infamous cybersecurity skills shortage issue that exists out there. You don't have enough well-trained people to to understand that what kind of decisions they should make you have an education system that is that is lacking in terms of teaching secure by Design at University's and whatnot.

Unless you are a specific cyber security major. So I keep hearing that that's changing and getting better at some of the but hard for me to know and then I think you just have You know a fair amount of maybe laziness in there where just so many people have access to these Technologies. Some of them do also have an increased.

Cost associated with them for you know Advanced security scanning features and the ability to identify vulnerabilities and things like that. But I've seen a lot of these providers move that capability like down a tier or two for the benefit of the broader community. So you do see a bit of that happening which is encouraging at least To your point that we need to go back into the education system and say hey Mr.

Or Mrs. Professional developer security is no longer an elective. It's a requirement because it seems like to me a lot of the foundations of these issues is the schools never really emphasized any of this stuff that the developer community.

I mean that's that was my experience, but The difference I went to program that was specifically aligned with cybersecurity. But even so even though that was the program I was in All of my development and programming courses. We're just like right data structures and see right data structures and Java, right PHP code to make this web application work.

security was never An aspect of that, right? It was like understand how these algorithms work understand how to design this network stack understand how to implement these libraries things like that. It was never how do I ensure that this web application cannot be, you know, compromised by SQL injection attacks or cross-site scripting and things like that.

That is that's just not what was taught. It was just here's how the code Works get it to work. Now people can log in and access your whatever and that was it.

So I I totally agree that, you know, a broader emphasis on security within the actual, you know, computer science programs and other software development programs and things Computer Engineering electrical engineering all of those kind of things is certainly overdue. Is there hope for devsecops? I mean we talk a lot about it, but I'm not quite clear how many people are actually implementing security into the application development process and shifting left.

And then the question is how far left. so I think that this problem is and I say this as a company that is fairly on the right hand side of the process. We're looking at compiled firmware images.

We're about as far right in that development process as you can be for these kind of things. However, I think that this problem is best served. At this time at least by by the security vendors who operate in this space right shift left.

You mentioned that I mean, you didn't mention that company but there's a company called shift left there. You have the varicodes you have the synopsises of the world like these are well established companies that do a good job at you know, bringing to Bear visibility to security issues and also reading remediating those security issues and then effective manner so, you know as the saying goes with we have the technology this is we have approaches to go about and Make a make a pretty big dent in this space. But here's what I found even with our company.

we'll go into product security teams and they won't have anything Right the person some in some scenarios. They're essentially. The team that's responsible for working with outsourced Consulting companies to come in and do assessments on devices or things like that or sometimes they are doing some like source code reviews, but they're leveraging only open source tooling for those purposes and while that's it's good.

I wouldn't say it's good enough so that that would be my my thought in terms of like the shifting left and if you want to talk about how far to shift left. I mean, we can't we already touched on this but Shifting very left in terms of education is the Brit is probably the place to make the broadest or the biggest impact over time, but for the you know, there's training and I've even seen it seen a few of these vendors that actually have and I really like this say you have a bug is identified or vulnerability is found or an issues created whatever. It's it's custom per the developer that if an issue continues to occur like the same kind of issue, like maybe it's the same kind of buffer overflow attack can occur.

They automatically send them through some automated training that's like built in to the to the security tool that says like hey, you keep doing this thing. Make sure you code it in this way to ensure that there's not overflows or ensure whatever X, you know X Y and Z. So I I like that kind of it's more of a holistic approach to deaf secops I suppose.

all right, Ronald Reagan once observed that the most dangerous phrase in the English language is Hello, I'm from the government and I'm here to help. What is your best advice to the government folks about what their role in all of this should be? You know.

Being someone who was in the Marine Corps and then went on to work for the Department of energy for a period of time and has had pretty good relationships the government over my over my career and life I suppose. I'm generally not a huge fan of public private Partnerships and things like that. They just never seem to make it real farther.

They're well intended but not well executed. There's one pretty specific exception to that that I think's worth mentioning and that's the whole like software bill of materials initiative that came out of the ntia kind of spearheaded by Alan Friedman and is now moving into the like implementation phase at sza. They've done some incredible work and I am there.

They're making actual change, you know, the executive order they put out I think was that but what they helped put out rather. Was was made a really big impact and will continue to do so, but generally, you know guidance I think here is what makes the most sense. However, the problem you run into is as you Look at some of these industries in spaces that have signed have a significant impact on the daily life of Americans.

If the private corporations themselves are not going to step up to the plate and ensure that the products and services. They are putting out our secures possible. Then the government's going to be left with very little options.

And that's not a great State of Affairs and I feel like that's a lot of what's happened here with the executive order in some cases and I don't think this was like maybe deliberate but is maybe like a second order consequence or impact which is basically like listen. We're maybe it's like almost like a warning Uh, we don't remember this unless you guys like get it together. Right and the colonial gas pipeline was a huge inflection point there.

Like we can't just have it. We can't just have the State of Affairs be that an organization that is responsible for half of the oil and gas being piped through the east coast is just going offline due to ransomware attack like that. Just can't be I just can't be what happens.

So, you know, I'm not advocating for the government coming down and overregulating all of this. At least at this point. I guess would be my would be my opinion.

All right, it's clearly a reaction among folks that are experiencing pain, but may not understand exactly what the source of that pain is. And so they have a sweeping edict and hope for the best Thomas. Thanks for helping us sort this out and I'm sure smarter heads will eventually prevail.

Agreed. Thanks a lot for having me. All right back to you guys in the studio.