Thought leaders in the cybersecurity space such as Ted Schlein at KPCB and Adam Ghetti at Ionic Security have said that hackers are going to breach organizations’ networks and so the focus of organizations should be on securing the endpoint rather than the network. How do you think about network security in its current state?

I’m surprised that people as smart as Ted would say to focus on endpoints. He must have meant more than that. He often said (and others have quoted as their own) that there are two types of companies, those that know they’ve been breached and those that don’t – but make no mistake that all have been breached. I suppose that’s why some would say to focus on endpoints, since attacks are already inside, but that’s rather myopic. As a person who ran Product Mangement for Symantec’s core enterprise business, including all endpoint antivirus and Symantec Client Security, as well as McAfee’s Total Protection Solutions, endpoints are just as fallible as network security. Even the latest endpoint security approaches, while better than my old products, see only part of the picture. I think the days of just trying to stop attacks as they cross a perimeter OR land on an endpoint are over – you need to assume they’ve bypassed that and start looking beyond the initial phases of the attack kill chain – assume they are inside and are laterally moving.

You’ve worked at both Symantec and McAfee. Why did you choose to leave and start Shadow Networks? What are you able to do at Shadow Networks that you weren’t able to do at those larger companies?

It was my experience at these traditional security vendors that illustrated the need to use disruptive technology like Software Defined Networking to change the game and try a different approach. Our entire industry for the past two decades has been built on the premise that you “block” attacks as they enter networks or land on endpoints. Problem is, once advanced attacks bypass that first (and only) line of defense, they live in networks for an average of 6-8 months. I founded Shadow Networks on the assuming that attacks would already be inside the networks, and ignored the first couple stages of the Attack Kill Chain to focus on the behaviors of attacks ONCE INSIDE a network. It’s lateral movement, communication to Command and Control and Exfiltration techniques etc.. Our goal is to DECEIVE attacks to take them away from the real network, but rather than kill them on contact, let them safely play out in a Deception Network to reveal intent, while keeping them from finding the real network.

The press has talked a lot about the “virtual honey net” that you create to trap hackers in a sort of virtual environment separate from the organization’s assets. How similar is this technology to the containerization technology used by companies like Invincea?

A “virtual honey net” is a nice start, but you need them to be more dynamic, scalable, and responsive. Typical honeynets are often statically deployed and pray something lands, rather than dynamically deployed to where the action is suspected to be going on at that moment. Honeynets are also often used as the launch point for a pivot and attack, since they don’t really control where attacks can go after they land. Use of SDN and flow control in a true Deception Network can do what a honeynet can do, but can respond quickly to attacks in networks, and contain them to allow the attack to go where you want them to, and not to where you don’t. That’s the difference between a static honeynet and a dynamic Deception Network.

What areas or problems in cybersecurity should up and coming entrepreneurs be focusing on?

The market needs to shift. It’s now painfully obvious. It was blasphemy a few years ago when we started, but today it’s a foregone conclusion. Entrepreneurs cannot try to repeat the approaches of past security. We don’t need a fifth generation firewall. We need the market to be more “Active Defense” in nature. Not Active Defense in the military term (the best defense is a good offense – which is illegal for businesses), but active in terms of dynamic and responsive. Assume they are inside. Assume they aren’t known (zero day). And rather than “allow or deny”, why not “allow or divert”, or “allow or deceive”. If you’re lucky enough to see anything, let it safely play out and determine intent. It won’t be the only attack moving through your customer’s newtork.

How did you choose Crosslink, Paladin and Yaletown as your investors and how do you look for VCs to add value to your company?