Speaker 1: Welcome to the deep dive. We take critical research, pull
Speaker 1: out the key insights and bring them straight to you. Today,
Speaker 1: we're tackling something huge, really critical. We're looking at cybersecurity.
Speaker 2: Now.
Speaker 1: You hear about massive spending right. Global investment was over
Speaker 1: one hundred and twenty three billion dollars back in twenty
Speaker 1: twenty alone. But here's the kicker, and this is what
Speaker 1: the research we've looked at Hammer's home. Despite all that cash,
Speaker 1: we seem to be losing badly.
Speaker 2: Yeah, it's a start picture. The sources we're drawing from,
Speaker 2: including analysis from folks like Steve King, argue pretty strongly
Speaker 2: that we're spending more and somehow getting worse results. We're
Speaker 2: operating at a quote decided disadvantage.
Speaker 1: A decided disadvantage. So the big question for our deep
Speaker 1: dive today is why, why the disconnect? And maybe more importantly,
Speaker 1: is there a way out? What's the proposed fix?
Speaker 2: That's exactly it and the core idea here. The real
Speaker 2: insight is that this isn't just about tech. It's not
Speaker 2: just firewalls failing. It's a systemic problem. It spans five
Speaker 2: interconnected areas. Think of them as battlefields. Economics, technology, information, education,
Speaker 2: and leadership. We're falling short across.
Speaker 1: The board five battlefields. Okay, that really broadens the scope
Speaker 1: beyond just code and servers. So before we dig into
Speaker 1: where we're failing, let's talk about the proposed solution you mentioned.
Speaker 1: It's called zero Trust Architecture.
Speaker 2: ZT exactly zero trust or ZT, and the idea behind
Speaker 2: it is well, it's simple in concept but really radical
Speaker 2: in practice. It basically says, forget the old idea of
Speaker 2: a secure perimeter like a castle wall around your network.
Speaker 2: Assume the attackers are already inside or they will get inside.
Speaker 1: Okay, so if they're inside, what do you do.
Speaker 2: You trust nothing implicitly, no device, no user, no service
Speaker 2: inside or outside, gets a free pass.
Speaker 1: Nothing, even stuff already on my network.
Speaker 2: Nothing. The philosophy is never trust, always verify continuously every
Speaker 2: single time something tries to access a resource. It flips
Speaker 2: the old Internet model of built in trust completely on
Speaker 2: its head.
Speaker 1: Wow, okay, never trust, always verify. That sounds like a
Speaker 1: massive shift, and you're saying this is key to tackling
Speaker 1: those five failing battles.
Speaker 2: Fields its position as the strategic counter Let's maybe start
Speaker 2: with the human side of things. Education and leadership, because
Speaker 2: the talent situation described is well, it's.
Speaker 1: Alarming, alarming, how what kind of numbers that we talk about?
Speaker 2: The numbers are just staggering. In twenty twenty one, the
Speaker 2: US apparently had something like three million unfilled cybersecurity jobs
Speaker 2: three million, three million, and that gap is growing way faster,
Speaker 2: like seven times faster than average job growth. But it's
Speaker 2: not just the numbers.
Speaker 1: It's the type of talent too.
Speaker 2: Precisely, while we're struggling to fill basic roles, adversaries, particularly
Speaker 2: state sponsored groups like those reportedly in North Korea, are
Speaker 2: running these intense, disciplined programs. They're training thousands of specialists,
Speaker 2: not just hackers, but cyber warriors, lawyers.
Speaker 1: What makes some different? What kind of skills are we
Speaker 1: talking about?
Speaker 2: We're talking highly advanced stuff zero day exploits, obviously finding
Speaker 2: flaws nobody else knows about, but also incredibly sophisticated techniques
Speaker 2: like analyzing electromagnetic radiation leaks way leakage from what from
Speaker 2: air gap systems, computers deliberately kept off the network for security.
Speaker 2: They're reportedly training people physicists and engineers to pull data
Speaker 2: from the faint electronic signals. These machines give off that.
Speaker 1: Is mind blowing. In our education system, it's not producing
Speaker 1: people who can even defend against that.
Speaker 2: It's the core critique in the sources. Yeah, US cybersecurity degrees.
Speaker 2: They often focus too much on let's say, administration compliance
Speaker 2: stuff you need for certifications like CISSP, which is valuable
Speaker 2: for management, sure, but it's not frontline combat training.
Speaker 1: So we're graduating what administrators and bureaucrats.
Speaker 2: That's the phrase used, Yes, administrators and bureaucrats, when what
Speaker 2: we desperately need is a warrior class, people trained in
Speaker 2: red teaming, offensive tactics, thinking like the enemy.
Speaker 1: It really sounds like we're training auditors for a knife fight.
Speaker 1: And does this problem, this disconnect reach the leadership level too,
Speaker 1: the CISO.
Speaker 2: Role, No, absolutely, the CISO, the chief information security officer
Speaker 2: is often in a really tough spot. They're trying to
Speaker 2: justify security spending to executives to the board who often
Speaker 2: don't fully grasp the technical risk, and.
Speaker 1: They rely on models to make decisions.
Speaker 2: Yeah, and that's part of the problem. They might use
Speaker 2: something like the Gordon Lobe model, which mathematically suggests you
Speaker 2: should only invest a certain percentage, maybe around thirty seven
Speaker 2: percent of the expected loss from a breach.
Speaker 1: Okay, but hold on, if the math is sound, isn't
Speaker 1: the issue that the execs are just bad at predicting
Speaker 1: the actual potential loss, especially the non dollar stuff like reputation.
Speaker 2: That's a really sharp point. And yes, the sources argue
Speaker 2: the model becomes problematic because executors consistently underestimate the true
Speaker 2: total cost of a breach. Quantifying cyber risk is hard,
Speaker 2: so they default to that lower investment figure, maybe thirty
Speaker 2: seven percent of a low ball estimate. The result crowning underfunding, and.
Speaker 1: The CIO's job just becomes keeping the lights.
Speaker 2: On pretty much, keep the basics running, try to stay
Speaker 2: out of the news. Don't build genuinely resili in systems
Speaker 2: because the budget isn't there, which.
Speaker 1: Leads us straight into that second battlefield, economics and technology.
Speaker 1: And you said, the asymmetry here is stark.
Speaker 2: Stark doesn't even cover it. It's fundamentally lopsided. Think about it.
Speaker 2: Huge companies, governments spending billions collectively on defense, and the
Speaker 2: attackers their cost is minuscule. You can apparently buy a
Speaker 2: ready to go DIDO attack kit distributed denial of service,
Speaker 2: the kind that floods a website and takes it offline
Speaker 2: for fifty dollars fifty bucks, And even the most sophisticated
Speaker 2: attack hits sold on the dark web for targeting large
Speaker 2: enterprises maybe ten thousand dollars tops ten.
Speaker 1: Thousand dollars versus multimillion dollar security budgets. It's absurd you
Speaker 1: the listener could cause serious disruption for the price of
Speaker 1: a cheap laptop. The whole incentive structure is.
Speaker 2: Broken, completely broken, and the criminal side is getting incredibly professionalized.
Speaker 2: Look at ransomware as a service.
Speaker 1: Riot like a software subscription, but for crime.
Speaker 2: Exactly like that. Groups like Darkseide, who are behind the
Speaker 2: Colonial Pipeline attack, they operate like well, like legitimate businesses.
Speaker 2: They issue press releases, they have customer support desks for
Speaker 2: their affiliates who deploy the ransomware. They even have tiered
Speaker 2: pricing ticking maybe twenty five percent commission on smaller ransoms,
Speaker 2: but dropping it to ten percent if the victim pays
Speaker 2: over five million dollars.
Speaker 1: It's a franchise model for extortion. Okay, wow, Okay, so
Speaker 1: the economics are skewed. What about the technology battlefield? The
Speaker 1: sources mentioned technological solutionism.
Speaker 2: Yeah, this idea that we can just buy our way
Speaker 2: out of the problem with more tools. The industry's flooded.
Speaker 2: One estimate suggests there are over thirty five hundred cybersecurity
Speaker 2: vendors out there.
Speaker 1: Three thousand, five hundred.
Speaker 2: How do you even choose exactly? Companies keep buying the
Speaker 2: next shiny object, another tool, another layer. But this techt
Speaker 2: sprawl isn't fixing the underlying weaknesses. In fact, the sources
Speaker 2: point to a disturbing trend. The more we spend, the
Speaker 2: more tools would deploy, the more successful breaches seem to increase.
Speaker 1: So more tools, more complexity, more ways for things to
Speaker 1: go wrong.
Speaker 2: We're drowning in tech but starving for a coherent strategy,
Speaker 2: and the tech itself is getting riskier.
Speaker 1: Take five g AH faster speeds, more devices connecting. What's
Speaker 1: the specific threat there?
Speaker 2: Speed and scale. By twenty twenty five, they predict maybe
Speaker 2: seventy five billion new devices connecting every year. Seventy five billion, okay,
Speaker 2: and five g offers this instant high speed connection fabric.
Speaker 2: So imagine malware spreading not just quickly, but potentially at
Speaker 2: the speed of light across vast networks of devices.
Speaker 1: So an attack like WannaCry, which caused chaos a few
Speaker 1: years ago.
Speaker 2: Could spread globally in minutes. Potentially, it shifts cyber attacks
Speaker 2: from being mostly financial or data theft problems to potentially
Speaker 2: causing real world physical damage at five G pace. Think
Speaker 2: power grids, manufacturing, transport.
Speaker 1: It's terrifying, and it connects to another tech issue mentioned,
Speaker 1: the supply chain, particularly open source.
Speaker 2: Yes, the software supply chain. We all rely heavily on
Speaker 2: open source code, reusable libraries, and components. Developers downloaded something
Speaker 2: like two zero point two trillion open source packages in
Speaker 2: twenty twenty one trillion. It's the foundation of modern software.
Speaker 2: But here's the problem. The most popular, most widely used projects.
Speaker 2: They're apparently three times more likely to contain known security vulnerabilities.
Speaker 1: So the stuff everyone uses is the riskiest.
Speaker 2: It makes the whole ecosystem a massive tempting target. Compromise
Speaker 2: one popular component and you could potentially infect thousands of
Speaker 2: applications downstream.
Speaker 1: Okay, this is bleak. Let's move to the third battlefield information,
Speaker 1: the fog of cyber war you called it.
Speaker 2: Yeah, large leaps of attribution, or rather the lack of
Speaker 2: reliable attribution. You get hit, but figuring out definitively who
Speaker 2: did it? Was it Russia, China, Iran, North Korea, A criminal, gang,
Speaker 2: an individual?
Speaker 1: It's hard to pin down.
Speaker 2: Extremely hard. The example given is the Anthem Health insurance hack,
Speaker 2: huge breach, seventy eight point eight million records stolen, massive investigation,
Speaker 2: years of work, million spent, and the conclusion only a
Speaker 2: suspicion that she was responsible, No definitive proof. That uncertainty,
Speaker 2: that information gap benefits the attackers immensely. They can deny,
Speaker 2: adapt and strike again.
Speaker 1: And there's another angle to this information problem. Isn't there
Speaker 1: something about our own government agencies?
Speaker 2: Yes? This is a really critical and kind of uncomfortable
Speaker 2: point raised in the sources. It concerns the tension between
Speaker 2: intelligence gathering and defense agencies like the NSA. Their job
Speaker 2: involves finding weaknesses exploits in software, including common commercial products
Speaker 2: like Microsoft Windows or Office.
Speaker 1: Okay, standard intelligence where finding vulnerabilities, right, But.
Speaker 2: The crucial part is historically the policy has often been
Speaker 2: not to tell the software vendor about the flaw they found.
Speaker 1: Wait, so the NSA finds a hole, uses it for spying,
Speaker 1: but doesn't tell Microsoft to fix it.
Speaker 2: That's the reported dynamic they keep the vulnerability secret to
Speaker 2: maintain their intelligence access. But the side effect is huge.
Speaker 1: It means that vulnerability stays open for everyone else to
Speaker 1: find an exploit too. Yeah, adversaries, criminals exactly.
Speaker 2: We're essentially leaving known holes in the software that runs
Speaker 2: our businesses, our banks, our infrastructure for the sake of
Speaker 2: potential intelligence gains. It's a deliberate trade off that increases systemic.
Speaker 1: Risk that seems counterproductive to overall national security.
Speaker 2: It highlights a major internal conflict, and it's worsened by
Speaker 2: the fact that even when threats are known, information sharing
Speaker 2: is poor. Both private companies and public agencies tend to
Speaker 2: hoard threat data, preventing a truly unified defense.
Speaker 1: Okay, so education, leadership, economics, technology, information failures across the board.
Speaker 1: It really paints a picture of needing a fundamental strategic shift,
Speaker 1: not just more money or tools.
Speaker 2: Which brings us back to zero trust.
Speaker 1: Right, So, how does ZT actually counter these failures in practice?
Speaker 1: You said, never trust, always verify. What does that look
Speaker 1: like day to day?
Speaker 2: Okay, So the first practical is defining your protect surface.
Speaker 2: Instead of trying to defend everything. You identify your app,
Speaker 2: most critical data assets, applications the crown jewels. It has
Speaker 2: to be small and management focus.
Speaker 1: On what truly matters most. Got it? Then what?
Speaker 2: Then? You use micro segmentation. Think of it like putting
Speaker 2: tiny secure rooms around each critical asset or application within
Speaker 2: your network. You build internal walls so.
Speaker 1: Even if an attacker gets past the main door, they're
Speaker 1: contained in one small area. They can't just wander around
Speaker 1: the whole network.
Speaker 2: Precisely. It stops lateral movement, which is how most major
Speaker 2: breaches spread. And the third key piece is rigorous identity management.
Speaker 2: This means continuous verification of users and devices. Strong multi
Speaker 2: factor authentication or MFA isn't a one time login thing.
Speaker 2: It's constant, and you apply really granular controls at the
Speaker 2: application layer seven, controlling exactly who can do what with
Speaker 2: which data under what conditions.
Speaker 1: That sounds much more granular than just checking if someone
Speaker 1: has network access. You mentioned active directory earlier, calling it
Speaker 1: a trojan. How does ZT fix that?
Speaker 2: Because systems like active directory are built on implicit trust.
Speaker 2: Once you compromise AD, you often get the keys to
Speaker 2: the entire kingdom ADMIN rights everywhere. It's powerful, but brittle.
Speaker 2: ZT dismantles that excessive trust. It assumes any identity could
Speaker 2: be compromised and requires continuous proof isolating resources. So one
Speaker 2: breach does in cascade it essentially neuters that trusted internal
Speaker 2: system's ability to grant universal access.
Speaker 1: Okay, it makes sense conceptually, but does it actually work?
Speaker 1: Is there evidence ZT improves things?
Speaker 2: The data reported in the sources is pretty positive.
Speaker 1: Yeah.
Speaker 2: Studies apparently show organizations adopting these core ZT principles see
Speaker 2: around a fifty percent improvement in preventing breaches.
Speaker 1: Fifty percent just from those changes. Just by shrinking the
Speaker 1: attack surface, eliminating that excessive internal trust, and enforcing continuous verification,
Speaker 1: it fundamentally changes the defensive posture.
Speaker 2: That's significant. But implementing this sounds like a huge undertaking,
Speaker 2: especially nationwide. What kind of big, national level actions do
Speaker 2: the sources recommend to actually make this shift happen.
Speaker 1: They don't pull any punches here. The recommendations are aggressive,
Speaker 1: almost wartime footing kind of stuff LIKEWI. First, mandate zero
Speaker 1: trust for everyone every network, public and private, set a deadline,
Speaker 1: make it non.
Speaker 2: Negotiable, a government mandate for ZT architecture.
Speaker 1: Wow.
Speaker 2: Second, create a National Cybersecurity Manhattan Project pour massive funding
Speaker 2: into applying AI machine learning to security, focused on rapid
Speaker 2: development and deployment, not just slow academic research. Get solutions
Speaker 2: out fast.
Speaker 1: A Manhattan project for cyber AI. Get what else?
Speaker 2: Third change the laws modernize cybercrime legislation to allow for
Speaker 2: more offensive defense measures. The idea is to let victims
Speaker 2: actively pursue attackers, maybe seese assets or evidence in real
Speaker 2: time during an attack. That's controversial, but.
Speaker 1: It's proposed enabling hackback or active defense legally. That's a
Speaker 1: big one.
Speaker 2: And the fourth mandates on cyber and insurance providers basically
Speaker 2: force insurers to require companies meet to standardize security baseline
Speaker 2: like the NIST framework before they can even get coverage.
Speaker 1: AH using the insurance market to enforce standards. That's clever.
Speaker 1: It shifts the compliance burden exactly.
Speaker 2: It leverages market forces to drive adoption of better security
Speaker 2: practices across the board.
Speaker 1: So, bringing this all together, what's the main takeaway for
Speaker 1: you the listener? Where does this leave us?
Speaker 2: Look, the core message from this material is pretty clear.
Speaker 2: We're losing this fight not because we lack money, but
Speaker 2: because our strategy, our education, our leadership, our whole approach
Speaker 2: across these five battlefields is fundamentally flawed, and zero.
Speaker 1: Trust is offered as the framework to actually turn things around.
Speaker 2: It's presented as the practical strategic path forward, a way
Speaker 2: to redefine the battlefield, shrink the target, and actually start
Speaker 2: pushing back effectively. But the sources end on a really
Speaker 2: sobering note. They draw this parallel to the lead up
Speaker 2: to World War Two, where the US was underestimated. How So,
Speaker 2: the warning is that if we don't undertake a mass
Speaker 2: of coordinated national effort now like some of those proposals,
Speaker 2: maybe even a national Cybersecurity Service program for graduates, if
Speaker 2: we don't fundamentally change how we manage this risk, the
Speaker 2: potential impact on our hyper connected society could be devastating.
Speaker 2: The quote used as stark. It could plunge the US
Speaker 2: into resembling a third world country, at least as it
Speaker 2: relates to cyber.
Speaker 1: Wow, a failure connectivity knocking us back decades.
Speaker 2: That's the potential future painted. So the final question really
Speaker 2: left for you to consider is do we collectively have
Speaker 2: the will to make these difficult systemic changes before a
Speaker 2: catastrophe forces us to, or will we wait until it's
Speaker 2: too late