Chris Blask, Cybeats | RSA Conference 2023

This is texturung TV. Hey everyone, it's Alan. We're back here.

We're live in our last day of RSA 2023 coverage. What do we could spend? You know personally for me last night.

We went I organized helped organize the 18th Annual security bloggers Meetup. No Awards this year. We didn't have time for that.

But we we had our meet up and you know, most of the people I know there are for 20 years plus the we've all come up in security together and it's it's a beautiful thing and a lot of really big friends for anyone out there and you'd probably hear this as well. How do I get into cyber security? What's the cyber security industry like going to that meet up with people who you've spent 20 years in this industry with that's what it's about.

Like, you know, if you can't do it. It's a great. It's a great career path.

I don't know what it'll be with AI and everything else but there's always gonna be a need for security folk and it just I don't know to me it brings it all home speaking of that though. Let me introduce you to my friend Chris blask. Chris was at the bloggers meet up last night, but I know Chris 20 years or something like that, right?

It's a long long strange trip Chris welcome and it's great to have you here. It's good to see Alan. Thanks for having me.

So you know what Chris Knight everyone out here knows you why don't we start if you don't mind sir, give him a little bit of the Chris Blast story. Right as you're saying, you know, I encourage you out there young folks get into this. You know, I've made a habit the last couple years of saying this is the last day get a cyber security because I mostly want to piss off the old folks.

Yeah. What are you talking about? What I mean is we're coming into the end of maturing having a practice and we're gonna stop finding entirely new Fields, but I yeah, I think we're just at the end of the beginning, right?

But but the actual work when you're done by the AI right now, here's not gonna reduce the need for cyber security people, you know, because both sides have them used only the people guiding the tools it might create more problems than it solves. But yeah a lot of problems that look great new one. Yeah, but we won't get for it, right.

This is all about Evolutionary pressures. Yeah, you know and there was a great talk Microsoft held the the other night with some cheap people from Microsoft sap and so forth and talking about Ukraine in part and and openness and transparency. It's about the questions the panel in the comment.

If you know many of them they think they're doing good work, but you and I have seen them 30 years ago. They were closed close close Bill Gates go set on television that no one will ever use the internet. They will use the Microsoft network.

I talked is dead which the other one Roamer and you know as a kid, you don't understand the big Corporation is gonna own these you know, and so I'm saying these folks right? You know, Top Flight folks like today you guys have all over the last 30 years embraced open systems Open Standards open everything right and sign from the moral inevitable side of this isn't it more effective efficient, you know, isn't this better economics, right? So in cyber security, you know, like economics working beating.

Open systems outcompete closed systems decisions are made faster. There's more options. But yeah, it'll never get dull.

No, you know what look I just came from Amsterdam where I was a kubecon for cloud nativecon Linux foundation, and if there's ever a doubt in anyone's mind that opens systems are not are going to be superior to a closed system. Go talk to the 10,000 people in 2000 people on the waiting list. For that event because it's if it's not open.

They don't want to use it. Right? It's not even a well if I can't have that I'll have this no it's either open or bust, right?

And that's that's very different than the world you and I came into right? Yeah. I remember I've used next conference in Toronto somewhere early 90s probably right now in this this guy had 80 days to go to retirement with IBM is entire life and they just come out with AIX right there.

Yeah. Yeah, and he was driving people nuts with the smug. Look on his face saying open sources great as long as you can keep it entirely proprietary at all, right and that's the proprietary open source, right my path right, you know, so as you talking about a high school drove forklift for six years landscape my way through some college a computer job, you know and just Forrest Gump my way from there jumped up an early firewall Cisco build a big thing there the Sim company and Fred intelligence and I sex and and that was all supply chain, but we're going on the right path.

It's open systems, you know, I've done, you know, like 50 podcasts now with side beats the company I'm working with with our friends. Peers, it's always the same thing past present future on transparency. Was it, you know in a look at each look at the guests, like who are they've been a lawyer serves a lawyer right?

It's about policy transparency and policy back then now what do you think about the future? and it's I love security, you know fight the good fight, you know, protective things are worth while And to win that though, you have to say can you afford to be more secure or better yet? Does your security make everything more affordable?

Right and transparent systems are better faster cheaper and easier to secure. so that I would say that's been one and it transcends security by the way, the whole open systems argument has been like one of the I mean we really used to argue about it. Oh, yeah.

Oh, yeah well and we were young and the people know they're talking about which it wouldn't argue about. There's a tell us we were wrong. No.

No, I but I remember a Fort Carson right in Colorado. Yeah army base right there. Yeah.

I remember being there with the what do they call the security guy in an army you do them? do direct your information assurance to direct information, whatever there's a name they have for the like you see so equivalent in an army base and I remember sitting down with the guy at four Carson because we were based in Boulder and they're in like near the springs and Him telling me we will not use open source here. It is inherently inherently a threat a risk, right?

And at the same time. He said the other thing is we'll never have wireless now, of course along right access and as I'm walking with him, I see people chucking their waps under their desk. So the guy doesn't see you because they would just plug in Ethernet into a what happened and they would Wireless it was literally shovingly sand against the tide.

But we overcame that people finally said enough enough. All right. Yeah.

So the last four years particularly, I've been focusing on supply chain. Okay, and you know, I'm this the company sidebeast does esplan management, right? Assuming you have these software building materials the content documents and so forth.

Now what? And I got involved with with them because they're going down this path. It's interesting because every you know, it's like I need to have these things.

Well, what do you do with them but to our Point here you start Leading it out. Right? I'm tearing the sis aspan of sharing working group right now and it's fantastic group of people.

Yeah, but we're all having a hard time agreeing on how this all works in scale. What are we talking about? Scale?

No, why don't you for these things by hand? Yeah, not today not in ten years not in 20 years. There's too many much long Forge.

That's part of the rant. But long for Jay, right? Yeah long 4G comes out.

Yeah and you know working with a lot of companies through that and you know, and it's before then and it happens not surprising. What does that mean? Well, either you're going to spend literally millions of dollars getting your most expensive six-figure folks on phone calls and zoom meetings and having them go by hand through.

Can you imagine there's literally going on today? So that's you know in the fear of intellectual property control everything else. I can't make this more transparent.

So lose everything look you can't do it that the manual way cannot period So what are the advantages of transparency where the risks how do you do IP Control now? You you and I represent big companies will agree to a contract will vaguely hope that our employees more or less know the terms of the contract and try not to mostly interleak our intellectual right? We're not doing that.

Well now be more transparent makes it better. You'll know where your IP is look, that'd be good. I so we do our deficit cops event on the Monday of RSA week every every year here.

It was right the one right before covid. This is the argument that came out around Esports can have an s bomb because you'll be giving away the recipe. right Okay.

I mean and I soon as I heard it like the hairs on my next turn up because I've heard this before I've heard this before it's it's you know, it's these. They wrapped themselves in these arguments over and over and over again. It never and it never plays out that way sooner or later.

Someone says the emperor has no clothes. That's a nonsense argument. Right?

And I think it's it's been proved again, and that's pops right now. Do we have work to do on ES Farms to agree on common formats and and all of these things absolutely but let's let's give a second mentioned you're on this system working group. Thank God for siso.

What a great. You know, look. I know there's a lot of people out here.

Say the government. I'm here to help the eight. Yeah, you know here on the Pokemon but everyone does but you know what and they may not be perfect either.

Yeah, but look at the role sisters played in the short amount of time that it's kind of been on our radar here. Right, honestly, you know American I you know went to high school in Canada, you know traveled the world like you had and so forth. You know, I can pick on my home country all day long and government bureaucracy and corporate bureaucracy big pain that took us, you know would be more efficient.

However, you know, as as the Beatles said, well, you have a better solution. We love to hear the plan. Yeah, and I'm pretty pleased with the US federal government, you know and with particularly on this area, right?

Yeah, I again, Anybody who thinks you have criticism of individual steps along the way in cyber security and federal government, you know, I could probably agree with every second one of them, but I've been asked over and over and over again and it's each at each step. That's most recent one, you know the journalist, you know, people want to talk about and say look this is a good incremental step. Is it perfect.

No, I mean do I think it could have been better? I mean if utopian World maybe putting the actual practical world, this is the next step to be done in this Channel live. Perfect.

Get in the way of good number one. Number two. I just You know who I forgot who said this quote, you know about democracy.

It's the that's worse form that we can have right? It's the same thing here. What's the alternative?

I mean you want to go you want to go China? We'll go China. What?

Yeah, give a shout out to one of my one of my favorite people, you know hesitated as a hero for anybody but you know, Michael General Michael Hayden. Yeah, really really high and in that doesn't say much in our crowd everybody really really smart, but incredibly Savvy very very very very smart guy and I had a meeting with him the day after the Navy Yard shooting for the bed and Edward Snowden is like being free in China or something. And you know Michael's very very mature very controlled guy.

He sort of snapped, you know, because I was trying to say, maybe this is maybe we'll all you know, figure things out come together. It's like look, I'd never say this on TV, but the US allies send their National Security people to the NSA to be trained on protecting civil liberties. Because say what you like about the NSA specifically, but if you're into say analyst and you touched an American Citizen's data, you have seven things you need to do.

Because everything needs to know who you are. Why'd you touch it what you do? If you're a Russian intelligence analyst and you touch a Russian citizens if anything, yeah, I know it you'll help that's so that's the is inefficient.

Right? Good bad. The otherwise one system is more efficient than the other and will have compete it every time.

you know what Mussolini made the change right you didn't but he did it exactly but so but and so that is something else too that I and I think you are. So let's bring it home to RSA a little bright. I think that's something that yarisa conference folks do good year in and year out right which is include the NSA.

I remember my friend Tony you remember Tony from the NSA. He kind of he was like the public liaison. Yeah, okay here.

Yeah, probably retired ten years ago, but You know, that was my first exposure to the NSA as a not a journalist. I wasn't a journalist as a cyber person. And I realized really quick.

All right, are there people who could abuse this system? There's always Edward snowden's this new guy up in yeah with the the 21 year old kid giving out secret. Yeah, there's always that nonsense.

by and large what a kick-ass what a kick-ass organization they play by the rules for the most part. And they're they're the best you may hear about the most side you hear about the Russians in the ukrainians in the East Europeans and the Chinese they keep a low profile on essay, but they do their job and oh, yeah. I'm I'm A Yank and I've enjoy being a yank in the world right opinionated about it and so forth because yeah, I mean like they bring back to RSA, right, you know, all these corporations, you know and for-profit organizations trying to make products and try to make security products and sell and make a profit.

It's like it turns out the best way to do that is honestly and with transparency, right like we're you know, bring all the way that you know, If you're worried about the bad guys having the in this case, you know, the your little recipe they already have it. It's kind of easy. You should have it too.

Remember threat intelligence. Oh my God, we can't let the bad guys know their vulnerability. They already know that I know.

Yeah, you may not know that so that was not here. Yeah, that would know it that was a naive period we were still there. No, I know there are people who do that.

Let me ask you one Chris why I got you here. So the one thing that I've been hearing about some of what the government is doing, you know around this Supply chains security and so forth is kind of trying to put in a regulation that you're not allowed to sell software to the government. Anyways, if it has any known vulnerabilities Now you and I we've been around right, you know, that's kind of impossible not gonna happen, right?

It's a statement of intent, you know, and that's really nice. You know, the industry will come back and say oh that's actually not physically possible. We understand your intent.

Here's what we can do. Right and which is why I have these, you know positive statements about because not to the public sector corporations do the same thing. Here's what we're gonna do and you look at and say well that's not actually you're going to be I understand why you know, it's a good thing right?

That won't be what and it's a worthy goal right goal. But I like I like you have to live in the Practical. I'm sorry that Rose, you know, yeah, I got you know, the that's my requirements in the far the federal activation rules, you know, the FDA, you know is requiring you provide this and I love it to our to our thinking about transparency what it means.

It doesn't mean that you're gonna show me your list of contents your software. It's gonna show me that you know, what's in your software. Are you doing some diligent enough to know what you selling me?

Yeah, and if you're not Not diligent enough to know what you're selling me. I'm not buying it. Right if you if you're not going to put your own it's on me, right?

You tell me I can't really say what's inside it. But I like you to buy it anyways, which is always been the case, but we're at the point now where you're competitors will say. Oh, yeah, we know it's in our stuff.

Yep, so you're not at the table anymore. So here's another thing though while we're talking just you and I just Like we talked about open being a big thing that's changed during our career. Another thing that's really changed during our career is the nature of the software we use which used to be very bespoke.

Right very custom man. You could reverse engineer stuff but it was it was custom written software by teams of software people where today most of our software would and I think it's why the supply chain software Paradigm work so much. Most of us software is kind of build on the Toyota model of just in time right inventory where oh, I need that component.

All right down from this repo. Let me pull this down here. I got it, you know maybe over here and I call it Frankenstein software that we stitched together with a little bit of code.

And it's great. It makes for Rapid application development right that cool keyword. I think what people don't realize about software supply chain into me, which is the real gotcha is third party dependencies.

Right? Right because I may be pulling a component. I may not.

I may be pointing to a component that exists on someone else's server and that server may not be on AWS. Maybe it's on you know, Joey Joey bagger Donuts data for their server somewhere. Yeah, God knows where in a basement in you know, and the Bronx.

Yeah and Hoboken isn't oh, okay, exactly and You know. Now part of that software supply chain, and that's bomb is I gotta worry about Joey bagga Donuts server because my components there kind of well, yeah, I gotta say you want interesting things about third-party dependencies when you look at that thing, it has third party dependencies. Right?

Right. There's you know, it's in there forget it down, right, you know this and that's what that's bombs do but I don't know if people realize how far that Extends. Well, it's interesting.

I think I yeah cyber people it people may not get it. Right 1980. Right?

I've always loved OT because you know OT folks have been building system for buying a six seven thousand years, right it even Building Systems for about six years or 60 or something. Yeah. Well the whole entity here like well grown up now.

It's like yeah, I'm safety reliability, you know, real reliability and so forth. So, you know people who live in the actual supply chain world have always known this right and you may have requirements to say I want to know who was holding which shovel and you know shovel the sand into the furnace to make was ever in the animal marketing what ahead because it's going to Mars. Yeah, right and daddy want you to say I don't really care if it breaks while I'm using it because it doesn't matter and we just need a system that will do all of those things.

Right but it's so it's never about well, I gotta worry about you know, Joey back at I need a system where I don't have to worry about it, but I know that the dependencies If I need to know. So to me, that's where you start rounding the rough edges off of this old software supply chain. That's bomb thing, right?

Because there are people who are taking it to that and I'm not saying it's absurd but they're taking it to a little bit more extreme than it needs to be. I I think a little maturity helps I again I was in kubecon last week in Amsterdam and what I loved about it, this year was a lot of focus on Plumbing right the play the infrastructure let's get real right? It's not theoretical anymore.

It's not what if what you know, it was it was practical. Right, I think maybe a little pragmatic practicality in celebration supply chain. Well, yeah, so even early 90s, you know the my first but the only term that I usually coined was inevitability curve right inevitability curve, you know, it says I'm here right now and many things can happen in the future.

Yeah, we know that if you write about one saying in the usefully near future this thing's gonna happen. There's a line connecting us to that the shape of that line is everything and whatever you're measuring with that line, you know, it'll move like this is you can inflect it. You can be the right place the right time or what not.

And it helps me think through this because the back then, you know, there were arguably a hundred firewalls and installed in on Earth when border where I came up with that one and you know, we built a company around it and the argument was well, you can't have a firewall unless you personally read through every line of code and my argument was everyone on Earth is getting on the Internet. It's not logistically physically impossible that everyone on Earth is going to read through all their code, you know, right? So while that may have been true Inevitably we have to come away around it and I was a huge dogfight but we all know today, right?

No, 10 hundreds of millions billions of firewalls. We don't even count anymore. And if and that's why change it's like well, I need to know everything in the look at what how much information that is now and it's not going to get less is going to add zeros over time years and decades.

So if that's your answer inevitably we can't have nice things like like electricity, but we're gonna come up with something else and they're a big part to the city without electricity today. You should but you mentioned the right thing with plumbing. So the digital build materials D Bomb Dot IO my Foundation project median Desiree and I but it's a quick plug and our blog.

I know we're what did I do? Monday? The death said cops devops connect event.

We did Monday here. I don't know if you'd stop dead DJ Selene. Yeah amazing presentation on this.

Oh and deep bomb classic. That's awesome. And it's gonna be replayed June 1st.

We're doing the virtual. Thank you. The virtual version of it his whole entire presentations there if d-bomb something you're interested in check it out.

Well because it's and again, I'm so biased in this one. Maybe it's not even maybe it's something else but we open source attestation ecosystems and allow us to have Plumbing that simplifies all that and what D bottom is about you go to GitHub you download node. I downloaded a node one of us creates a channel and out of some sort of repository and we put a policy on it and we're gonna do a test to each other about whatever we need to do and in a supply chain environment, you know, I you're I'm the integrator you're the vendor, you know, my customers telling me I have to have access to this stuff set up in advance so that whatever the umpty million s bombs or in total whatever access stations they need I can access them when they need them.

So all I have to do is you know is instantiate that relationship with Imam or something was like that between the two of us and do the same between my vendors. Hey vendor, I need you to make available the software Bill materials for everything. I'm gonna offer to these people and you know the talk Kate and I gave yesterday, you know, the build s bombs.

So the my procurement and diligence people can check in advance and and so on, you know, whatever the information is make it available and and your suppliers have to do the same and I don't have to know about your suppliers. My customer doesn't have to know about your suppliers. There's no ways that we're all gonna know about these to the suppliers.

I just need to build like you separation, right? Yeah, I am. look fear of people who do things Exercise is just it's one of the reasons.

I hated law that I couldn't be a lawyer because they do things just because they can yeah dot dot it works. Yeah, just get to the bike. I hate getting worries involved in my business deals for this reason, right?

But I didn't really say that but anyway. You know a good dose of pragmatism and practicality about what we want to what is what is the idea behind it? Why do we try to accomplish?

Let's not be ridiculous and take it out there. Chris this was the longest 15 minute interview we've ever done. It's probably a half hour 40 minutes, but I want to end with a couple things.

First of all, you did all you doing all these podcasts. How can people find them should be doing a lot of interviews for babies? Yeah.

Basically, you know, I have a odd name search for Chris blask YouTube and you'll find a lot of stuff. It's they're on YouTube. Yeah.

Okay. So look up Chris blask on YouTube God and all the terror my electric boat company. We've been doing a lot of reels and streaming, you know, again, we're going to deep into this but how we get this communication scaling.

I love the Young Folks are doing and trying to figure it out right 30 seconds 60 seconds, you know, I'm watching him too. We all are we all I try It's hard for me to do anything in 30 seconds. I got up.

Yeah, I hear you. And also I I will just tell you if you want to really something really interested. Follow Chris's whether it's his Facebook or wherever you can follow him on his journey.

You know, he he mentioned argumentaries is the Boat Company. Chris is built two boats the the Twains. Is that what you guys Mark Twain?

Yeah, Chef Clements and Mark Twain and he sells them up and down the Florida coast. It is a lot of fun to watch what he's done. He's constantly Improving them a little bit at a time a little here a little there and you look over you know the days of long but the months are short.

You look over the course of a month or a year. You see what he's done. It's an incredible story and for nothing else.

I I enjoy doing that following you for that more than anything. But hey, man, you are a treasure. Thank you.

Very thank you for coming here. We're gonna take a break. We're on our last day of coverage here at RSA.

We'll be back in a minute.