hi everyone great to see you all this
morning today I'm going to talk about
how we can collaborate to make
technology move faster as an academic I
spend a lot of time thinking about how
come the ideas that we're coming up with
aren't making their way out into the
real world this talk is about how we can
better use what we already know about
cyber security in case you've forgotten
to attend any other session in this
conference I'll start by saying two
things first the future runs on software
we have smart homes smart cars and even
smart dating if you haven't right about
the tinderbox algorithm for
automatically liking faces based on your
previous likes well I'm not sure if you
want to but to get to this future we
first have to solve the problem of
software security as Kazmir mentioned
hackers can control our electric
skateboards they can control our rifles
they can even control our cars some of
these hacks take years to get fixed and
sometimes they never get discovered
until it's too late in academia there
are many ideas that comfort me there are
all these research ideas that promise to
help secure our software there are
encrypted databases there are mechanisms
for replaying programs so we can find
the vulnerabilities there are techniques
for scrutinizing our programs to find
bugs before it's too late and there are
also mechanisms to write software that's
provably secure but the curious thing is
that in industry the state of the art is
firewalls so in this talk I invite you
to think with me about how we can get
research ideas to make their way more
into practice in this talk I'll first
describe what I've been thinking about
in academia my own work on programming
languages and
in privacy then I'll talk about some
work I've done on better connecting
academia with industry so with startups
venture capital and bigger companies and
a missing part of the piece is
policymakers and consumers so I'll end
by talking about some of that so I
invite you to think with me about how we
can better connect researchers to
everyone else and this isn't just about
getting research out there but it's also
about giving researchers feedback about
what it's useful for us to work on so
let's start by talking about what we
already know this is what we've been
thinking about in academia and something
that many of us think about is how can
we get security by design instead of
finding bugs before it's too late or
waiting for hackers to find our bugs how
can we design our systems with security
and privacy in mind and from my point of
view as a programming languages
researcher we're still living in the
1970s here are two screenshots of code
from the popular hot crop conference
management system yes that's what it's
really called and I don't expect you to
read this code but what I want to show
is that in order to enforce security and
privacy policies programmers have to
write conditional checks
if-then-else checks across the code if
we think about it it makes sense if we
look at all of the programming paradigms
in mainstream languages they've been
around since the 1970s private privacy
and security were not concerns in the
1970's and so it makes sense that
languages weren't built with those in
mind
and so if programmers want to protect
sensitive data everywhere that it's
being hugh's across the program they
have to check to see where is this data
coming from where is it going what's the
other program state that's allowing me
to make these decisions to address this
problem my PhD work has been about a new
programming paradigm called policy
agnostic programming the main idea is
that programmers can attach policies to
broccoli to data and the Rustler program
can be written in a way that's agnostic
to these policies and the programmer can
then rely on the language and the
language runtime to enforce these
policies automatically I spent some time
developing a programming model that
provides mathematical guarantees about
what it means for the program's to
comply with these policies and I also
developed an implementation strategy
that demonstrates this can work on
real-world programs and so I hope that
policy agnostic programming is what can
take us into the 21st century of
programming with security and privacy in
mind on the left here we have our friend
the program with manually enforced
policies you have the conditional checks
that are repeated across the program and
on the right hand side there are are
screenshots of code from the Jaqueline
web framework a policy agnostic web
framework that i've built as an
extension of the Django Python web
framework and what you can see is that
all the policies are in one place
associated with the data what you can't
see is that you don't have to write the
policies as repeated checks anymore but
each of them needs to be written now
only once so by reducing the opportunity
for program or error we can reduce the
opportunity for information leaks now
you might be saying well this sounds
good but how can we get this into
practice the next part of my talk is
about why more of these ideas aren't
going into practice and how we can do
better with this to answer this question
we first have to think about what the
barriers are to industry adoption of
these ideas the first is that managers
need to fight the status quo they have
to make arguments often economic about
why they have to do things differently
so unless there's a catastrophe it's
often hard to justify using a completely
new paradigm or tool steam for
programmers programmers struggle with
legacy code so even if they really
wanted to take the time to
learn a new language or a new technique
they have to make sure that this
interoperates with all of the code
that's been written before so one way
that we can think about tech transfer is
through startups startups aren't
burdened by the same problems that large
organizations have and in fact there's
been an increasing interest and
investment in startups for security Sam
Altman who's the president of the Y
Combinator incubator tweeted recently
that he wants to invest in dozens of
security companies in the next few years
but before we get too excited about this
we need to think about why there haven't
been more security startups already and
my answer is that security is no tin dog
so let's think about the quintessential
hot new Silicon Valley startup I
recently heard about tinder for dog
lovers where you can you can post
pictures of you and your dog and you can
swipe through to meet other people who
also love their dogs this has a fun
concept it has a slick design it's so
easy that even your toddler enough you
can use it and you don't have to change
anything about your life in order to use
it except for maybe give up several
hours of your day looking at dogs in
contrast the startup that's going to
help us secure our software is going to
have a technical concept probably
verifiable only by experts and because
existing infrastructure is not designed
with security in mind
it's probably going to require us to
completely change the way the
infrastructure already is it's not
really the sexiest start of proposition
in short there are unique challenges for
security startups there's a concept
that's probably going to be highly
technical there usually are not flashy
demos if you're doing more than
penetration testing or bug finding you
can't just go into a company and wow
them with your absence of bugs and
adoption of these technical solutions
requires either the client to understand
fully what's going on or trust the
company fully that they're doing what
there's a say they're doing
and finally building a security product
is quite different than building a
technical security solution Justin so
meanie who's the chief trust officer of
box says that a major reason security
products fail is because they're made by
security people security people are
doing back-end coating they're not
worried about user experience products
are all about user experience so to
address this problem a friend and I
started an accelerator called cyber
security factory justin is wearing one
of our shirts this tweet is from us and
it's an a weak accelerate that gives
teams $20,000 in funding a network of
seasoned security entrepreneurs
potential investors and potential
clients office space and legal support
we piloted our program this summer with
two teams in collaboration with Highland
Capital Ventures one thing that our
accelerator does that's different from
any other accelerator we know is focused
mentorship so our mentors included
seasoned security entrepreneurs and also
heads of security at large companies
including Justin Sami nyet Box Max Crone
who was the founder of OkCupid and key
base Raj Shah from Palo Alto Networks
and David King from Improv odda our two
teams had not formed companies when they
joined our program and they're both
going on to raise funding after the
program what we learned from the summer
is that having this focused mentorship
helps but there's a final missing piece
which is how to motivate customers to
actually pay for security and if we
think about security from a high level
view it's a no-brainer that we want to
all chip in and pay there was a recent
report from the Atlantic Council in
Zurich insurance group that says that by
estimates that by 2030 an insecure
internet would cost us 90 trillion
dollars and in contrast a completely
secure internet would increase our net
benefit by a hundred ninety trillion
dollars and while I'm having some
trouble
managing these trillions of dollars or
what it means to have a completely
secure internet what this is just to me
is that there's a sort of prisoner's
dilemma when it comes to security in
game theory the prisoner's dilemma is an
example where you have two prisoners and
if they cooperate their combined
sentence is the least but the cost of
one of them betraying the other is so
high that it's theoretically optimal for
both prisoners to betray each other and
for security this seems to be the case
individual entities lack incentive to
secure their software if you want to
secure your software you have to train
your employees you your programmers have
to spend extra time writing secure code
and finally secure software isn't
actually providing much competitive
advantage right now it's much more worth
your while to develop a new feature so I
can't speak to the policy changes that
can improve this but I've thought a lot
about what we can do with policies that
exist and what we can do is we can
create a culture around caring about
security and privacy there are two main
parts of this that I've thought about
and one is getting consumers to care
more you might have heard about how the
snapchat ephemeral photo messaging app
has egregious privacy violations they
promise to delete their photos they
don't actually delete their photos but
the thing is they're benefiting from
this it seems their estimated value is
16 billion dollars and they have a
hundred million users it seemed that the
worst thing that happened to them was a
couple weeks of questionable press and
some criticism from the Federal Trade
Commission and in fact I'm the only
person I know who deleted snapchat from
my phone not because I passed the age of
13 but because I objected to the the
privacy practices that they had so we
can do a much better job of getting
consumers to stand up for their security
and privacy the other part that I
discovered this summer with the
accelerator was that there are privacy
standard
people don't seem to be enforcing them
and what we found out was that it's
because people aren't getting audited so
one of our cybersecurity factory teams
spent a bunch of time talking on the
phone with dentists and they said do you
want our secure system and the dentist
said no we're happy just emailing around
our x-rays and records because we're not
getting audited so what this showed us
was well it seems that there are
standards and that these standards say
that people should care about our
solutions but if these standards are not
getting enforced then it's not going to
happen so we can do a much better job of
working together and enforcing these
policies and if we look to the FTC this
requires technology for detecting when
these policies are being violated so
that something can happen about it I'm
running out of time so and by giving you
a recipe for how we can secure our
software number one we ask smart people
to come up with technical solutions
pretty simple number to you we put the
solutions into place and usually the
solutions don't work the first time
around so then number three we iterate
pretty simple but as you saw in this
talk there are some things we need to do
in order to make this happen
first of all we need to better connect
research with industry so the idea is
that the smart people in academia are
coming up with are actually making their
way out into the real world but to make
industry care about these ideas we also
have to change the incentives for
securing our software and this whole
process requires communication and
education to end I'd like to say that
I'm incredibly optimistic about the
state of software security because there
are so many smart people like all of you
working on it and there are many pieces
that are already there so I invite you
to think with me about how we can open
up these channels of communication and
connect the pieces so that we can
eventually have some approximation of a
completely secure Internet