Feb 20, 2020 · 19m · a16z
The Latest in Cyber Attacks
0:00 / 0:00
▶ Watch on YouTube →
gold bands on the timeline = statements, start to end. Hover to read, click to jump. CC turns on captions
At the a16z Summit, Martin Casado explains how cybercriminals have shifted from attacking heavily fortified corporate networks to targeting individual people due to stark economic imbalances. He breaks down real-world social engineering tactics and details enterprise-grade security practices individuals can adopt to protect themselves.
How this conversation actually went
Every chapter scored 0–10 on four independent dynamics. Hover any point for the reasoning behind the score. How this is scored →
The host as informed peer 0.0 Guest teaching 5.0 Guest disagreement 1.1 The host pushing back 0.0
speaking balance: gold is the host, purple is the guest (3 minute bins)
Sharpest disagreement ▶ 12:55 Anti-vaxxer comparison
Casado uses provocative framing, asserting that failing to adopt basic security tools is akin to being an anti-vaxxer because it destroys the company's herd immunity.
Hardest push from the host ▶ 17:48 Audience 'Why?' promptBecause the recording is a solo keynote monologue without host interaction, the only external prompt occurs when an audience member interjects asking 'Why?' regarding physical security.
Biggest teaching moment ▶ 10:00 Bank impersonation trickCasado provides a step-by-step breakdown of how attackers exploit password reset SMS workflows to trick sophisticated victims during live phone calls.
The host holds their own ▶ 0:00 Host absence during presentationThe host does not speak or engage during this presentation monologue, resulting in zero host expertise displays or pushback.
the scores for every segment, with the reasoning behind each
| Chapter | Topic | The host as informed peer | Guest teaching | Guest disagreement | The host pushing back | Why |
|---|---|---|---|---|---|---|
| The Cyber Threat Shift to Individuals | 0 | 4 | 1 | 0 | Casado delivers a monologue keynote explaining the industry-wide pivot from defending infrastructure to targeting individuals. Host participation is zero in this presentation format. | |
| The Economic Imbalance: $0 Individual Security Spend | 0 | 5 | 1 | 0 | Casado breaks down dark web costs versus the $26B business email compromise industry to highlight individual vulnerability. No host involvement occurs during this monologue segment. | |
| Target Demographics: Small Businesses and Home Offices | 0 | 5 | 1 | 0 | Casado presents Google Transparency Report data showing how malware sites have been almost entirely replaced by phishing. A single-word audience reaction occurs, but host interaction remains zero. | |
| Case Study: SIM Port Attacks | 0 | 5 | 1 | 0 | Casado explains SIM port jacking mechanics using high-profile cases like Sean Koontz and Twitter CEO Jack Dorsey. The host is absent during this educational presentation. | |
| Case Study: Phone Phishing and Bank Impersonation | 0 | 6 | 1 | 0 | Casado details sophisticated social engineering tactics including bank phone impersonation and company barbecue phishing. Host scores are zero as this is a uninterrupted talk. | |
| The Security Renaissance: Consumerizing Enterprise Protections | 0 | 5 | 2 | 0 | Casado outlines consumer solutions like Chromebooks and password managers to prevent password reuse, comparing non-users to anti-vaxxers. Host participation is zero. | |
| Product Category 3: Hardware Security Keys (2FA) | 0 | 5 | 1 | 0 | Casado describes hardware security keys and deception canary hardware, citing Google's six-year record of zero account takeovers. Host scores remain zero. | |
| Physical Security Safes and Next-Gen AI Surveillance | 0 | 5 | 1 | 0 | Casado concludes with physical security tools like home safes and AI-powered surveillance cameras. An audience member asks 'Why?', but no host pushback or dialogue occurs. |
Statements from this episode (28)
Casado: Cyber attackers are shifting focus from companies to individuals
“En masse, attackers are moving from these traditional targets of companies and of systems and actually are focusing on, on you. And actually, we think this is one of the biggest shifts in the entire industry, and we think that it impacts everybody in this audi…”
Casado: VC Cybersecurity Funding Reached $5.3 Billion in 2018
“VCs typically pump billions of dollars into security every year. In 2018 is about 5.3 billion.”
Casado: Most cybersecurity funding targets devices and corporate networks
“And the thing you should know is the vast majority of these logos and the mass majority of this effort are building technologies to protect devices and to protect companies.”
Casado: Enterprise Cybersecurity Investment Will Exceed $100 Billion in 2020
“So estimated in, like, this year, over a hundred billion dollars will be invested in cybersecurity from large companies.”
Casado: JPMorgan spends $600M and Microsoft spends over $1B on cybersecurity
“So for example, JPMorgan Chase alone will estimate about six hundred million dollars in cybersecurity. And Microsoft will spend over a billion dollars in security.”
Casado: Zero-click phone exploits cost $2M-$2.5M on the black market
“If you were to buy on the black market an exploit to break into a phone, for example, an Android phone, it would cost about 2.5 million dollars if it doesn't require the participation of the user. If you wanted to break into an iPhone, it's about two million d…”
Casado: Median individual spend on personal cybersecurity is zero dollars
“Compare that to the median price a person in this room spends on their personal security, which is zero dollars.”
Casado: Corporate cyberattacks increasingly originate from individuals' personal lives
“You are a conduit to every organization that you're connected to, and so many attacks will start with you in your personal life and then move to the company.”
Casado: Dark web hackers charge about $100 to breach a Gmail account
“So in order for me to, for example, take over your Gmail account, it costs about a hundred bucks.”
Casado: Business email compromise is an estimated $26 billion annual industry
“So business email compromise alone is estimated to be about a twenty six billion dollar a year business for attackers.”
Casado: Vast majority of BEC and ransomware attacks target SMBs
“So the vast majority of these type of attacks are focused on small to medium businesses, which really is anybody with a home office.”
Casado: Phishing websites have almost completely replaced code-exploiting malware sites
“So there are almost no, like, hacky sites, malware sites left, and almost all of that is phishing, which are literally sites targeted to trick you as an individual into revealing your credentials.”
Casado: Sean Coonce Lost $100,000 to a SIM Port Attack
“And he lost a 100,000 dollars to a SIM port attack.”
Casado: Jack Dorsey's Twitter Account Takeover Was Executed via SIM Port
“Jack Dorsey, if you know, his Twitter account was taken over. This was done via Simport.”
A major Silicon Valley breach began with a barbecue-themed phishing link
“Actually, probably one of the most notorious large breaches of a tech company in Silicon Valley happened this way, and it started with something as innocuous as a barbecue.”
Casado admits he would have clicked a context-aware phishing link
“Like, I mean, I would have clicked on it.”
Casado: Physical access to a laptop almost guarantees compromise
“If I have physical access to your laptop, I can probably break in.”
Casado: Nation-state level physical infiltration tactics are now targeting private citizens
“These were the type of attacks that we would see you know, nation states do to each other. Like, I had no idea that this type of things would like to start happening down the street, but it actually is happening today.”
Casado: Neglecting personal cybersecurity erodes an employer's digital herd immunity
“So, there are solutions to pretty much every one of these techs that's very simple to use, so much so, if you don't use them, like, I kind of view you a bit of an anti-vaxxer. And the reason is, is like, you are the attack service for your company, and they're…”
Casado: Google Chromebooks are likely the most secure consumer devices
“Probably the most secure we think is a Google Chromebook.”
Casado: Passwords are not going away as an authentication mechanism
“Like, passwords just aren't going away.”
Casado: Nearly all known nation-state cyberattacks stemmed from password reuse
“And he says to his knowledge of even the nation states attacks that we know about, In the last couple of years, all but two of them used password reuse as the initial entry.”
Casado: Security keys are the only 100% effective defense against account takeover
“So security keys are probably only 100% effective mechanism against account takeover.”
Casado: Google eliminated employee account takeovers by mandating security keys
“There's actually a pretty famous case study where Google rolled them out wall to wall. So every Google employee has a security key. They had account takeover issues, you know, six years ago, over six years of using them, account takeover went to zero.”
Casado: Web-purchased deception security devices are incredibly effective
“It's like, you can buy these on the web, and you can install them, and they're incredibly effective.”
Casado: Physical security innovation is the next major tech wave
“Right now we believe we're in a bit of a renaissance for digital security from a consumerization standpoint. We actually think kind of a next wave that we're very interested in is improvements in physical security.”
Casado: Ambient cameras identify people by body posture and gait
“So this is a video from Ambient, and they build smart security cameras. So these cameras are incredibly sophisticated when it comes to determining threats. So for example, it can watch like your body posture and how you walk and uniquely identify individuals.”
Casado: Enterprise AI physical security will shift into residential homes
“And while today these are primarily being used by corporate offices, more and more we're actually seeing them pop up in residences. So if you want a little bit of a glimpse into a future, an area we're very excited about and one to watch, we definitely think p…”