Cold Open On Fear-Based Security

Wes Kussmaul 0:01

The cybersecurity industry makes its money by not solving security problems. The cybersecurity industry makes its money by preying on the fear of decision-makers.

Meet Wes And The Early Net

Joeri Billast 0:15

Hello everyone, and welcome to the Web3 CMO Stories podcast. My name is Joeri Billast, and I'm your podcast host. today I'm joined by Wes Kussmaul. Hi Wes, how are you doing?

Wes Kussmaul 0:28

Very well, Joeri. Wonderful to be here

Joeri Billast 0:32

Happy to have you. Guys, if you haven't heard about Wes, Wes Kussmaul, he's the founder of Delphi Internet Services, one of the major online networks of the early internet. after watching the internet evolve from those early days, Wes spent decades studying what he believes went wrong with digital identity, privacy, accountability. And today, through the Authentici-Authenticity Institute, he's working on ways, to bring trust and authenticity back into our digital world. Wes, welcome to the show. as my listeners know, I always like to dive straight in. So, let's start from the beginning, you were building Delphi in the early 1980s, what did you imagine this emerging connected world could become, and when did you first realize that it was developing in a very different direction?

Wes Kussmaul 1:32

Well,

From Delphi To Social Media

Wes Kussmaul 1:33

the very early, earliest days, 1981, we envisioned it as a, an information source, and we created the world's first online encyclopedia. so that was the vision. and very quickly, we learned that the business model was horrible, and, that we were never going to make it sustainable if we didn't, make some changes. So we started adding social features, special interest groups and, and forums and, and of course email and, and that turned out to be the savior of our business because by 1982, late '82, the was just a menu item on what was essentially a, a social network. It morphed from information retrieval to, to social, social media, by, late 1982. And that's where, the internet evolved into. That's what, social media is, the consumer end of the net. and, it evolved suddenly for us

The Web As An Outdoor World

Joeri Billast 2:46

Yeah, you make an important distinction, between the internet itself and the way, the web evolved commercially. Where exactly did we take the wrong turn, and what did that change about identity, privacy, and accountability?

Wes Kussmaul 3:03

Well, perhaps, your audience recalls a cartoon by Peter Steiner, which has been used all over the place. the caption is, "On the internet, no one knows you're a dog." that appeared just before, the main way of accessing the internet, became... Well, first it became Gopher. For one brief year it was something called Gopher, but quickly, that, shifted to the World Wide Web, of course. The web browsers. here's what happened. I was there. I saw it. I was part of it. Before computers were time-sharing devices. You know, host computers you accessed via a terminal. Now, you might have used your personal computer, which of course was a new, new thing. You might have used it, but you used it as a terminal. and time-sharing services were very constraining. You were really in a gulag, in a prison. You know, you really didn't have much, freedom of movement, in time-sharing services. Then... I was gonna say the net came along, but really first it was X.25 networks like ours. just a little aside, commercial services like ours didn't get to use the internet as a transport medium until a decade after we launched because, the National Science Foundation had a, no commercial content policy. so we were on X.25 networks until the early '90s when some friends of mine did some very clever maneuvering and kinda compelled the NSF to bop, drop out. but so it was a confining environment. Time-sharing was a confining environment, and all of a sudden, here's this web thing, and you could go anywhere. It was liberating. It was exciting. it was something we'd never seen before So in all this excitement, we forgot that some things we do with computers are dependent upon accountability. that the web-- And here's the essence of it. The internet and its web, which I regard as the, markings and signage layers of, the internet, is outdoors all the time. I call them all the web, a part of the transport layer And it's wonderful that way, as long as what you want to do is an outdoor thing. When we go outdoors, we have the whole world. We can go in any direction, go do whatever we want. But wait a minute. Do we really wanna do our banking on a billboard outdoors? No. There are things that we want to do. In fact, typically, so the internet was characterized as an, information highway, and the name s- still fits. But what do we typically do with highways? How do we typically use an outdoor public transport system? Typically, we use highways to go from one indoor space to another indoor space. We find that indoor spaces or buildings are useful. Why? 'Cause a building is really a s- a set of accountability spaces. You tend to know who's in the room with you. But the important thing is that buildings are reached via highways, but they're apart from the highway. You go through a doorway, and you enter a set of accountability spaces. And where you go, what accountability space you go to in that building, has everything to do with the badge you're wearing and where you're supposed to be. there are access controls. Around the same time, when I-- actually before this, I worked for a big insurance company and, management had been told by IBM to, watch out for security. You know, be aware of security. so management were middle-aged guys mostly who, knew a lot about building security. They understood what is building security? Do you tell your lobby receptionist in a building to identify the intentions and character of everyone walking through the door, and identify the bad guys? Or do you tell your lobby receptionist in a physical building, Get some ID, a driver's license, a passport," or if it's not a particularly, security intense facility, a business card will do. But in any event, people coming through that door and going past the turnstiles into the elevators either need an employee badge or a visitor badge. And if they're visitors, they c-stop by the reception desk, and reception desk asks for that ID and issues a visitor badge and says, "Who are you here to visit?" And, "Oh, I'll let them know." And sometimes if it's a secure facility, they come down and escort you in. It's about accountability. Real security is about accountability, and that absolutely, thoroughly a hundred percent applies in digital facilities as well. The problem is we have no digital indoor spaces. We have no digital buildings. the digital world is void of these spaces of accountability That's the problem. You know, outdoors versus indoors. We're all outdoors all the time. We're holding our meetings, keeping our files, letting our kids hang out You know, as though we're homeless people in cardboard boxes by the side of the highway

Anonymous Yet Accountable Identities

Joeri Billast 9:29

One of your most interesting ideas is indeed anonymity. How can someone remain private or anonymous while still being accountable for what they do online?

Wes Kussmaul 9:42

Once again, we find the answer in the physical world. In fact, we have a series of videos that we're transforming into a course, called SHIPS, Solutions Hiding In Plain Sight. In this particular one, we find in our car's license plate, which was invented in 1901, by Henry Lee Higginson, who also is the founder of the Boston Symphony Orchestra. the license plate, it makes you accountable for what happens on public roadways while not disclosing your identity unless there's been an incident. If there's been an incident, then the other party to the incident, say it's an accident, gets to know your identity, and you get to know theirs. but until then, are accountable, but you're anonymous. Now, to do it right in the physical world, you need a stable full of cars because people, see you driving your car, and they recognize your car, and so, you're not entirely anonymous. But in this wonderful digital world, you can have, as many packet vehicles as you want, a different one for each persona. So for instance, you don't wanna use the same identity in a dating app that you use in your employment or in your professional networking. So you create, a few dozen personas. and then there are some, identity credentials where disclosure of your name is required. So for instance, if you are a licensed professional, let's say, code auditor or pen tester, your name is disclosed. But that still doesn't let others know that this identity is the same as that persona that you use in your dating app. So once again, these are all in our world, in our solution, these are X.509, digital identity certificates, PKI identity certificates. PKI is the construction material by which we can bring about the solutions to these problems in indoor spaces, et cetera

Why Web3 Still Needs Authorities

Joeri Billast 12:00

now the name of the podcast is Web3 CMO Stories, so I have a question about Web3 too. Web3 was supposed to fix many of the structural problems of the digital world decentralization. where do you see or why do you think that Web3 is actually repeating some of the same mistakes from before?

Wes Kussmaul 12:21

Well, right off the bat, I will cite something that has been, said by Lawrence Wendy Bryan, who is a decentralization advocate, as you know, he's part of the blockchain community. but he's also, a student of governance. And that quote is: There is no such thing as decentralized governance. If you and I were to engage in a significant transaction, that involved some, amount of money, you would want to know that I'm really Wes, and I wanna know, I would wanna know that you're really Joeri. And we both need an authority to attest to our identity claims. Not just attest to whether or not, not just a binary thing, but to what extent can I trust your claim of identity, and to what extent can you trust my claim of identity? because You can't build trust if you don't start there with confidence in identity claims. And now, with AI agents, making it very easy for some not very bright people... I mean, it used to be that, account takeovers and mayhem like that required some intelligence. No more. know, all you need is, a malicious outlook on life, and, you can create whoever you want and impersonate whoever you want. so, You need an authority to say, first of all, this digital certificate is not an object certificate. It's an identity certificate, and we have evidence that this represents a real human being. beyond that, we have evidence that their claim of identity is accurate. We have a number that represents our confidence in that, and that number ranges from, zero to seventy-two. Why zero to seventy-two? Because it's measured in eight different metrics, each on a scale of zero to nine. Add them up, and you get an aggregate score of zero to seventy-two. That's bound to your identity certificate. and the certificate itself, as well as your IDQA score, your identity reliability score, is digitally signed by guess what? A central authority. now, getting to your question about Web3, Web3 brings all kinds of useful things, including navigational things, to this outdoor space called the web. It's right there in the name, Web3. You're still outdoors, you know, I love to go hiking, we have some great hiking areas around here in, New Hampshire. but I have no way of knowing whether the people that I interact with on the trail, are, well, accountable for anything. it's outdoors. It's a wonderful space, but it's outdoors. When I need to get something done, when I need to either work or, settle something with my bank or, work on a nonprofit, I do it while I'm in a space of accountability. this space where you and I are meeting right now, we're not doing anything that involves high finance or legal commitments, so not having measurable identity reliability isn't that significant. But it's never gonna serve as a serious meeting place for serious decisions being made until there are spaces of accountability and privacy. So you need real privacy, real security, and real accountability, and that happens when you have things like occupancy permits that make buildings trustable. The reason you and I are sitting in buildings right now, I know nothing about the building you're in, you don't know anything about the building I'm in, except our visual cues tell us we're probably in our homes. but here's what I know about your space. I know it has an occupancy permit because occupancy permits are the norm throughout the whole built world. And what does that mean? It's that your spaces of accountability where you're sitting, have somewhere this occupancy permit that was signed for by an architect, a contractor, and a building inspector. And How is that different from any, you know, mm, software company certification? It's very different. 'Cause If that building you're sitting in has secret passageways that don't show up on the drawings, the architect can go to jail. certainly if it has serious structural problems, that architect can lose their license to practice their livelihood. Now, no Microsoft MCSE certificate has that kind of teeth in it. But that's the way, the physical world works Why don't our spaces that purport to have security and privacy, why aren't they required to have a professional licensee put their livelihood on the line, saying, "You can trust this space. There are no spies in here. Why? Because I've combed through the code, I know what's going on, and I put my livelihood on the line, so that, if there's a problem, here I am." Now, there's a story illustrating how this works.

Occupancy Permits For Software Trust

Wes Kussmaul 18:27

Until the middle of the 20th century, the financial auditing profession required that financial statements were signed by an accountable professionally licensed individual. So Arthur Andersen signing a financial statement this person, Arthur Andersen, takes responsibility for the accuracy of the contents of these financial statements. If there are serious problems, Arthur Andersen can lose his license, his reputation, and his livelihood. Then all of a sudden, Arthur Andersen became Arthur Andersen LLP. And I don't mean to just pick on Arthur Andersen because across the financial auditing, community, the same took place. your signature, was effectively signed by a group of people, no one of which was more accountable than another, and all of them could jump ship to K-KPMG or, Deloitte if it turned out that there was some funny business in the financial statements, and that's exactly what happened. Do you remember the Enron scandal perhaps? Enron was a business built on fakery. It was just a pile of nonsense. and it was signed by Arthur Andersen LLP, or its statements were signed by Arthur Andersen LLP. and Arthur Andersen LLP went out of business as a result. so perfect illustration of why individual human accountability is essential, not group accountability.

Cybersecurity Incentives And CTBG Trap

Joeri Billast 20:14

So let's make it, concrete now, Wes. Thank you for, for sharing those stories. And indeed, I remember the Enron, the Enron scandal. Now what should a company do differently if it wants customers to know that the people, the message, and the claims behind this brand are authentic?

Wes Kussmaul 20:35

Well, they need to change the way they do things. They need to shift from a CTBG structure, catch the bad guy structure, to an ABE structure. AB, I should say sets of assumptions. An accountability-based environment set of assumptions. Going back to that, lobby receptionist, once again, if your practice is to try to catch bad guys in your network, in your company's facilities, you're gonna fail. And CTBG is the foundation of today's cybersecurity industry. Now let me be very here because I have another very controversial claim to make. The cybersecurity industry makes its money by not solving security problems. The cybersecurity industry makes its money by preying on the fear of decision-makers. The business you're asking about, and by the way, I don't have a quick answer. if you're looking for advice for a company to assure their suppliers, customers, et cetera, that they can trust their representations, their products, the information they share, I don't have an answer until they go to an ABE environment. It's-- It can't be done. you can enrich the cybersecurity industry, but you're going to have breaches, you're gonna have account takeovers. phishing, you know, social engineering will always work. Oh, I have a little story to relate here. I go to the RSA and AGC conferences every year in San Francisco. as I'm sure you know that after the expo hall closes, there are all sorts of hospitality suites and events where people have a beer together and chat. so I do this very disingenuous thing. I will start chatting with a CISSP certified security expert. I'll have a beer. Maybe in the second beer, I'll say, "You know, I have to admit, I've clicked on a bad link. I've clicked on a bad attachment, Over fifty percent of that time, the person I'm talking to will say, "Yeah, I know. I've done the same thing. The same thing happens to me." So Joeri, this person I'm talking to is the one who's going back to his management saying, "We need security education. We need to have me teach these know-nothings how to avoid being phished," when they themselves have been phished. Education is not a solution It's the system, it's the structure, it's a system built on accountability that is going to solve the problem, just as it is in the physical world. We have systems of accountability that enable us not to trust another person necessarily, but have a basis of trust. And we have none of that online. And the cybersecurity industry, makes two hundred and fifty-- two hundred and forty billion dollars a year not solving the problem, preying on fear. I compare it to the, lip balm industry, which has been sued for selling quote-unquote lip balm that causes lip chapping. they're building dependency by deliberately providing a defective product, and it makes money for them because it makes people's lips chap, so they buy more. now the other, moving on to the other reason why, IDPKI has not been deployed to solve these problems, we don't have accountability-based security. That one is just as simple. the set of that I call Silibandia, that is Silicon Valley, the broadband and media industries, plus their feeders and the dark web, mostly data brokerage, botnet industry, plus, I may add, the venture capital, private equity, and cybersecurity industries, they all make money by and selling your personal information. And IDPKI would put you and me in charge, in control of the use of information about ourselves. that would decimate about one trillion dollars of that set of industries' revenue. That's why we don't see it. So basically Things are happening. We're getting attention in our set of companies because people sense we're going over a cliff here, that we're about to hit the wall. And it's true. People are sensing we've gotta do something different because we have no accountability, and we have no trust, And it's, becoming easier and more cost-effective to take over accounts and breach into networks So here we are. The solutions are old, proven, and hiding in plain sight. if you go to authentiverse.net, and watch the little flight video that takes you to Authentiverse, at the end you'll see a number of things you can check out. But one of the more prominent ones is called SHIPS, Solutions Hiding In Plain Sight. It's, considered to be a course on accountability, real privacy, real security, and real accountability. It'll tell you how, we are bringing methods, principles, and technology from the physical world, proven stuff, to the digital world to solve these problems

Joeri Billast 26:40

Well, thank you for sharing your ideas, Wes. To anticipating

Where To Learn More And Closing

Joeri Billast 26:45

my question, how, people can find you and find out more about everything you have been sharing. Of course, every time I have, show notes, I have a blog article. Everything, that you shared will be found in there. So thank you so much for joining us today, Wes

Wes Kussmaul 27:02

Well, thank you, Joeri. It's been very enjoyable

Joeri Billast 27:05

So guys, what an, insightful episode? I'm sure that it makes you think. And if you think this can be useful or also food for thought for people around you, be sure to share this episode with them. If you're not yet following the show, well, this is a good moment to do this, eh, to hit the subscribe button. If you haven't given me a review yet, yeah, if you give me these five stars, this really goes a long way. And of course, would love to see you back next time. Take care a special thanks as well to RYO, uh, the main sponsor of Web3 CMO Stories, supporting conversations at the intersection of Web3 AI and the future of digital leadership.