The Exchanges

Q You just said a whole bunch of terms I've never heard of. So I'm going to start asking you about them because I don't understand them. And I'm pretty sure a lot of other people listening don't understand them either. What is a layer seven attack?

A So, uh, you know, the, um, our internet is governed. Let's call it by the Aussie layer seven layer module. We have the transport layer. We have. Where, you know, we carry our bits and bytes of our communications. On top of that, we have the layer three and four, which are responsible for the transport and for the session. So organizing all of those bits into trackable, um, Pieces of information. And at the top of the layer of this kind of pyramid, we have the layer seven, the application layer. Think of things like HTTP, SQL, and so on. So when we talk about layer seven attacks, we talk attacks against the application. Think of SQL injections or cross-site scriptings and so on. Um, that's basically the main task of a web application firewall to detect those attacks and properly mitigate them. When we talk, does that make sense to you, Sean?

AI assessment note: “when we talk about layer seven attacks, we talk attacks against the application”

Q So it says that you're a sales engineer and a security analyst. Is this, is this a specific goal for the company? They want the people who are selling to be the people who actually understand the security that they're selling rather than just hiring Uh, random salesperson and saying go.

A Correct. So, uh, in Portugal, we have a saying, which is like having the hands on the door. So we basically really, um, work, uh, and implement the solutions and also guide our customers in the post sales, um, process of the sales cycle. Um, and obviously then help them achieving the maximum usage they could have of these security products we put in place. When we think about threats like, uh, layer seven attacks or bots, we really make sure that our tools and solutions are performing, um, the best they can, minimizing false positives, minimizing false negatives, maximizing true positives, and making sure, uh, our customers are happy with the products they get from us. So yes, we, We, uh, integrate, implement, and we also then are there for the whole post-sale cycle.

AI assessment note: “Correct. So, uh, in Portugal, we have a saying, which is like having”

Q it's not your fault. I'm just playing devil's advocate here. When police officers try to find evidence at a scene, they often look for the fingerprints of someone left behind, right? If we all are, are moved on to a fingerprint based biometric authentication kind of standard. Wouldn't it be easier to break into people's accounts if you can just lift their fingerprints off of any surface that they've touched?

A It would be easier to break a password or to find that password dump somewhere to, to, to take out, uh, I mean, there are a number of, uh, works in people trying to bypass face ID with reconstructing three D models of people's faces and face ID has been very successful in, in, in mitigating those with fingerprints. Yes. You could probably, Snuck out some fingerprints or, uh, or an eye, you know, and, and make some kind of fake finger too. Um, but, um, but at the end of the day, um, those device, those, that biometric data would be attached to a device, you know, like my iPhone accepts my face and my fingerprints, not your iPhone. Your iPhone would accept my face or my fingerprints. So there's also a connection between biometric data and my device. My device without, by, without my biometric data is useless. And my biometric data with my device is also kind of, but I can always enroll a new device, right? But what happens is that actually, you know, all of that biometric data never really leaves your device, right? Basically it's kind of, uh,

AI assessment note: “those, that biometric data would be attached to a device”

Q I totally agree that we need to become passwordless, but what I'm seeing in its place is like biometrics, like fingerprints and facial recognition, things like that. Is that any more secure or, or are there, there attack vectors in that regard? Sorry to get technical for the audience with the word attack vector.

A I think at some point in time, and this might be the year or the next year, we will migrate from accounts to identities, right? Um, I think your biometrics, your, your face, your fingerprint, your iris, or, and so on, these are, this biometric data that Univocally identifies you, right? And if we could use that, um, and, and draw passwords and usernames to just authenticate my identity with my service provider, um, We would probably be in a point where ATOs wouldn't happen at all because, uh, you know, there are no passwords or credential stuffing attack because there are no passwords to, to, to crack or to iterate through, um, every day, uh, Almost all of us have kind of Fido enabled devices at our hands with, um, you know, like we said, fingerprint sensors and face IDs and so on. So if we could use that data to authenticate ourselves with our, uh, providers and to show that it's us accessing with our, um, biometric data validating that request, I, I think we would probably be in a more secure world and we would sleep better at night.

AI assessment note: “We would probably be in a point where ATOs wouldn't happen at all”

Q Okay. What's your most favorite thing about being a cybersecurity researcher?

A Um, it's always, there's something new in the industry now, you know, like we, we, at Koboldauz, we have been, um, Um, working heavily in the bot mitigation landscape. Now we're also moving into the passwordless world with passwordless as a service tools. Also the adoption, the every adoption of, of, of the cloud and all the security problems that entails and the solutions that we need for that to have a proper cloud security posture management and make sure that your cloud environment in which public cloud it is, uh, is properly protected and secured. And that also When an attack comes, again, thinking of that log for J attack, you have the tools in the proper tools in place to block those. Zero day attacks and, and normal attacks. Yeah. So I think that we, we always have new challenges. It never gets boring. Like we usually say, um, and there's always a new problem to try to solve. That's why I mentioned also in the beginning that we have a couple of those, we try to solve a bit of problems that our customers might have tomorrow, um, by having, um, tools that, um, yeah, that are a bit, uh,

AI assessment note: “we always have new challenges. It never gets boring”

Q I, I, I need to pull on this now, this thread. You mentioned AI, and I was also thinking about VR, cybersecurity and VR. Um, if you had to choose one of the two as the final topic for today, which would you choose? We'll go down that one.

A I don't know. Artificial intelligence, machine learning is something we are working on, trying to solve problems Of our customers based on data that they have using algorithms that are a bit, uh, yeah, uh, out of the box and so on and trying to extract data. We usually say data is the new oil and the way, and we have data coming from so many sources, um, be it your CDN, be it your security tools, be your, IOT devices and so on. And, um, so all of that data will hold some secret that will probably bring your business forward. And we're also working together with our customers and prospects to kind of help understand what would they like to extract from that data and having, um, the proper algorithms kind of, um, implemented by our department and help them like reaching that, um, yeah.

AI assessment note: “Artificial intelligence, machine learning is something we are working on”