The Chris Voss Show - The Chris Voss Show Podcast – CES Show 2021 Karamba Security Interview & IOT Security Announcements

Episode Date: January 11, 2021

CES Show 2021 Karamba Security Interview & IOT Security Announcements Karambasecurity.com

You wanted the best. You've got the best podcast, the hottest podcast in the world. The Chris Voss Show, the preeminent podcast with guests so smart you may experience serious brain bleed. Get ready, get ready, strap yourself in. Keep your hands, arms and legs inside the vehicle at all times. Because you're about to go on a monster education roller coaster with your brain. Now, here's your host, Chris Voss. Hi, folks. This is Voss here from thechrisvossshow.com. Thechrisvossshow.com.

Hey, we're coming here with another great podcast. We certainly appreciate you guys tuning in. Oh, my gosh, everyone. It is CES Show 2021 time. It is the massive week. Today is day one of the CES Show. If you're going to it, if you're familiar with it and all that good stuff, we're going to be interviewing a lot of great entrepreneurs, a lot of great companies, a lot of people that are showing there. You can also go to our Facebook group at Facebook.com, CES Show, and check that out as well.

You can subscribe there and see all the different press releases we're releasing and everything else. Be sure to watch the show we had with the head of CES, Gary Shapiro, talking about the announcements and things we're going to be doing. He appears on the show every year, a good friend of mine. So watch that. You'll have some of the different things that are going on. We'll be profiling different companies. They're going to be at CES show 2021 this year, this week. So we'll be doing that. And today we're starting with one of our first this morning on the 11th, the first day of CES.

This is a company called Karamba Security. And I have with me the executive chairman and co-founder, David Barzilai. David, how are you? I'm great, Chris. How are you? There you go. It's wonderful to have you on the show. We're going to be talking about what you guys are doing at CES. But give us the brief bio on you, who you are, and what you're up to.

Thank you, Chris. So I'm a serial entrepreneur. Karamba is the third company I have co-founded together with a great team. I sold one of the companies I've co-founded and CEOed. And Karamba seems as the most exciting one of the series of the three. But in between startups, I also have been a go-to-market, whether sales, BD, or marketing executive with much larger companies. And with the most recent ones, when I was part of the management team,

we grew business from $260 to over $500 million if we try to do something similar here at Karamba. That's awesome. That's awesome. So how long have you guys been around? We started in 2016. We worked on the product, vetting it, working with early adopters and start selling last year, actually in 2019. So it's a little more, it's about less than two years, I would say. That's awesome. Now give us the dot coms for people to look you guys up on the website and check you guys out. So it's www.carambasecurity.com. And do you want to give us a brief overview of the company, exactly what it does, maybe products it offers. We'll get into some of the details here in a bit. Sure. So in a nutshell, Karamba offers IoT

product security. Our customers are the IoT device manufacturers that need to protect their devices against cyber attacks. Our offerings cover the lifecycle of the device. We enable to secure the development phase, the runtime, as well as ongoing operation,

making sure that hackers don't try to hack or to find their ways into the device in order to interrupt business continuity or even to affect safety when we talk about mission-critical devices. This is pretty awesome. This is important. IoT is larger than ever. I mean, it's crazy. I remember when it first launched and everybody talked about the promise of what things are. And even here at the show, I mean, we review a lot of IoT products. So my whole house is like, you know, I can't under the hey, so and so words or the the a word the, you know, from Amazon, I can't answer those words right now.

Otherwise, the device will start going off. But yeah, my whole home is just, I just walk around and tell it what to do. And it's just beautiful. So you guys have some announcements. You guys are doing some stuff at CES Show 2021. What's the rundown on some of the things you guys are launching or announcing here?

So I have to say that this show is different, right? From last year's. Last year we were obviously in the corridors and having hundreds of people coming to our booth, presenting, and everything now is online. We didn't know that a month after, right, in February, suddenly things will go a little haywire and different from where it used to. We're happy that we still have this opportunity to share our stuff online

and host people visiting our virtual booth online and to show so they can interact with us and so on. What are we presenting? We are presenting, in essence, the theme for Karamba's product is seamlessness. We enable the IoT device manufacturer to seamlessly protect the device. Why seamless is so important? Because as a device manufacturer, even as Amazon, as you indicated, there's quite a famous attack on an Alexa where a hacker found ways to infiltrate a house or to the Alexa and start looking and talking to a toddler. Yeah, I remember that.

Which was quite awful, obviously, and we don't want things like that to happen. But the thing is that when companies, even mighty companies, want to protect their IoT devices. They find two obstacles. The first obstacle is that their R&D teams, right, the developers are not so much familiar with cybersecurity. So you need to change substantially R&D processes. Not only that, but also in the IoT, you rely heavily on third-party modules, libraries, supply chain providers, and you cannot really impose your best practices on them.

So the first thing is more the ability to overcome that lack of time, lack of knowledge of developers. And the second thing, even if you succeed, then the embedded device, the IoT device, is superbly limited in compute resources. It doesn't have the rich features and the rich resources that we usually have on servers or even on our mobile phones and mobile devices. So for that, if you are a manufacturer and you need to protect your devices, either because of customer requests or regulation or differentiation, you always tackle those two obstacles of lack of knowledge and time and lack of resources on the device. Caramba presents here at CES a suite of three products that enable manufacturers to protect the devices without requiring any changes from the R&D, no changes from supply chain with third party, and no change to the hardware. Geez, David, I think we just got a keynote

speech from you. I think it was awesome. Thank you. A little mini one there. That was awesome. So there's a lot of different industries you guys are focusing on, automotive, Enterprise Edge, Industry 4.0, and Consumer IoT. Do you want to delve into some of those different aspects? Yeah, absolutely. Karamba started our, call it the first market that we wanted to realize, that we wanted to test with, the product with, was actually the automotive. And the reason was that we were quite aware of the need of automotive manufacturers to protect the devices, coming connected vehicles, definitely autonomous vehicles, but even just connectivity. And with that, we started and our innovation was to look at the car as an array of IoT devices,

not as a data center on wheels. Why it's important? Because the IoT device could be protected against unplanned changes, meaning hackers. Yeah. So we started with that. We pretty fast got a lot of traction and brand within that automotive market. We matured the product with proof of concepts, nothing with production. That was the time of development. And when the product was ready, then we've expanded our go-to market to automotive, where we were at already, but also to industry 4.0 that has severe consequences of cyber attacks on the production floor. The enterprise edge are like printers and routers because they've become kind of like the back door or the blind spots through which hackers could infiltrate into the enterprise.

And based on that and the consumer IoT. Now, and the thing is that our software are the same. The software products that we sell are just the same. We are agnostic to the application as well as that we are agnostic to the CPU and to the operating system. And you guys offer several different products and services where you guys will do a design review, help them with that, different binary analysis, embedded security, and continuous feasibility. Give us a rundown on some of those. Okay. So the idea is that we've realized that the IoT device manufacturers are kind of like being sorted on different points in their adoption of product security.

Some of them are superbly advanced, especially the enterprise-edge ones, right? But some of them have just started their journey. And as such, they need help in the more basic components, right, in the preliminary phases of their development phase, of their next generation or update of the existing products, the IoT products that they deliver. So what we have is that, okay, if you just started and you need to open up that black box of software that will run on your device, why black box? Because it's comprised of so many

third-party modules that you don't have visibility into. You have the supply chain providers that give you the binaries and deal with them. I mean, they don't want you to impose your own processes on them and stuff like that. So for that, we have the first product, which is called V code. And what V code does, I started by saying, we're doing things seamlessly. So we enable the manufacturers to drag and drop their binary image, meaning the software, the firmware of their device, into a container. And from then on, everything else is now done automatically.

The software is being unpackaged or being broken down to its various libraries and components and modules. Each module is scanned and you receive a report of the security posture, meaning risks and oversights in each of those modules. So you can close the loop either with your own developers or with your supply chain providers and request them to address those matters in order to improve the quality, the security posture of the product that eventually will go to production. So that's the first product.

It's called V-code, and it enables an elegant way, an automatic way to open up the black box of the software image of your device as a manufacturer and enable you visibility into each of the risks that you may encounter within those modules. However, some of those risks may not be addressed. Why? Either because they're part of the open source or they're part of some providers that from their schedule to fix the problems that you pointed at, it may take them a year. And you don't want to delay your product for such delays and such encounters. So for that comes the next product that we call XGuard Protect or XGuard. And what XGuard does is to seamlessly being integrated

into the software and make sure it automatically scans, again, the binaries, create policies based on the known good state. And in runtime, it continuously monitors the device. And if there is a change to the known good state not delivered by the provider, so it must be a hacker. Someone is trying to hijack the device now in runtime. XGuard Protect shuts the door on the hacker. It prevents the attack by making sure that such changes will not be consummated, will not be delivered by the hacker.

And it reports to the manufacturer. So the first product was opening automatically the black box, pointing out at problems so you can close the loop with your providers and with your own developers. The second product enables runtime integrity to make sure that if there are some attack attempts, they are detected and prevented in runtime. There you go. The third product is a product that we announced just a few weeks ago and less than a month ago, which is called XGuard Monitor. What XGuard Monitor does is that we said the following. In any case, we have an agent.

It's embedded seamlessly into the device. And now we enable our customers to monitor a fleet of devices in order to identify attack attempts before they took place, in order to make sure that if there is a behavioral change in one of the devices or parts of the device, they can be shut down or the source of the attack, the IP address where attacks are coming from will be blocked. So the third product, a ground monitor, enables to manage the entire fleet. Why it's important? Because in the automotive space, now they have regulations

where the manufacturers need to manage their fleet of cars against cyber attacks. In smart homes and smart cities, you have those operators that manage the smart city for the municipality. And part of their responsibility

is to have visibility into cyber health or to cyber attacks, attack attempts on those such smart buildings and so on. So such product enables managing the fleet in a very cost-effective way because we reduce the number of events by 90%. The problem is scale, and we enabled it to scale that's awesome these are all aspects that are really important to have because consumers trust in a brand or consumers trust in a product can be lost overnight especially if you end up on the news where they're

like so-and-so got hacked and there it is and you know i we cover the hackathons that are usually in Las Vegas and different things they do. I forget the name of the Las Vegas show where all the hackers show up. You know, and you see them breaking down IoT devices and different devices, voting machines, et cetera, et cetera. And it's just extraordinary some of the things that can hack, including cars through, like, the Bluetooth and different measures and all that good stuff. Is that all the products? I think there was one more. The last one that we're talking about is the one that talks about IoT consumer products. And this is where we see exactly, you're right, this is the brand risk that we protect against.

The issues that manufacture, one of our customers his slogan internally is to try to stay away from the headlines that's what mine would be if I had a company my CEO would be like I do not want us on the news exactly by the way the show that you mentioned

I think is Defcon yeah Defcon so we are focusing on those markets. Interestingly enough, I started earlier, I said that we started to sell in 2019. And within a year and a half, we already had agreements to protect over 12 million IoT endpoints with multiple marquee Fortune 500 customers. Wow. That's awesome because so many protection you know i mean

i've i've had times where we've had i mean we've had all sorts of weird experiences the chris voss show has been hacked its website over over the years in fact in fact the reports i get were daily pinged and pounded on the website from like china russia and all these weird places around the world and the reports i get of people trying to get through cloud fair and and all that stuff um and it's a real big thing i mean cyber security is even larger now you know we just had the huge russia hack where russia got into the government and you know now it's coming out that they had like admin they even got admin level controls where they could see everything. And from whether it's like you say, enterprise with large companies, or it's down to like users like me who are like, why is my webcam light on?

I've had that actually happen somewhere in the last 10 years where I was like, wait, why is my light on to the webcam? You know, I've gotten notifications from our local network that it's like something is pinging you and trying to get in or something has gotten in. Like we've had, you know, like Firewall, these localized things that monitor the activity. And sometimes little IoT devices decide to go on their own and start dialing out talking and using up a whole lot of bandwidth and you're like what's going on with that thing over there that's true uh it's absolutely true and as a matter of fact so the the most recent attack right with the russian attack on the you know the sources and so on that's a nation-state attack nation presumably presumably nation states uh so youstates, you can call it infinite resources. And although the cloud-based systems are quite well-protected,

they still find ways. And they did. By the way, the most recent attack was super sophisticated in many, many, many aspects. So it's quite, quite an astonishing event. Go ahead. I think it's cool how you guys monitor the behavior so you know if it starts acting differently.

You're like, whoa, there's something going on. So that's exactly my point. My point is that most hackers are not nation states. And they try to find their ways in the easiest way possible. Unfortunately, today, the easiest possible is the IoT device. The IoT device is not well protected. As I said before, either because it takes time to incorporate best practices and measures into the device.

And secondly, there are those physical limitations of the device to try to add more features into it to make sure it's protected. So these problems made the IoT devices more vulnerable to hackers. Not nation states necessarily, but definitely to hackers, you know, mom and pop and more, and even for organized crime. So to give you just an example, there is quite a famous attack on Target. So what happened there at Target is that the hacker's attempt was to try to steal the credit card databases. But they were quite well protected in the cloud.

So what the hackers did was actually to deploy malware on the caching machines. Oh, wow. At the payment, right? So the point of sale. and those so you have no small small call it you know spies small uh malware on those caching machines recording every credit card being swiped wow and every once in a while they all reported it to the hackers through some kind of a relay but still still. So the idea is that, and out of that, they succeeded to get 40 million credit card data. Just because those devices are not well protected, it's a challenge to protect them. And as such, you get more and more attention to those issues.

And not only that, you also see regulation. So given the mass scale of IoT devices and the fact that once you attack one architecture, in essence, you can attack between millions to 10 of millions of devices using the same architecture. So now you have regulations imposing cybersecurity on the IoT manufacturers, on different industries, those that I mentioned before. And that's extraordinary. You know, there's all sorts, I mean, they just look for the weakest point, right, that they can get access to and then try and exploit it. Exactly, exactly. it exactly exactly um what was interesting about the uh nation state uh thing where where we uh

talked about uh the russia uh hacking us uh the u.s um was that they they got in through a through a like an update like no one saw that one coming yes they they hacked the update or or did whatever they do in the update. Everyone's like, I do that a million times. I'm like, Apple, go ahead and update that app. And then you're just like, oh, my gosh. And people don't understand what's going on. So what are some of the key targets for your market?

If people are listening to this and they're thinking, I wonder if this would be good for my company, what are some key maybe industries or company, well, industries that you think would be really good for this and should reach out to you guys? So I appreciate that. So let's talk about this user persona, if you like. Okay. The product security in some organizations is an emerging entity. So you have individuals within the R&D team that were designated the responsibility to protect the device, to protect the next version, software version of that device. Usually we found those individuals, those product security individuals requiring help in identifying problems in the software development lifecycle. And for them, vCode is a very elegant solution. You don't need any cooperation from R&D.

You get immediate visibility to the various components comprising your software. You can show your customers a report with the security posture of the next release, and so on and so forth. So that user persona is product security person within the R&D team. So that is one. But the next is more interesting or as interesting, and that is now we're talking about corporations that have designated a product security officer, someone on a corporate level that must ensure that the company is safe. They live safe in terms of brand protection, in terms of adherence to standards,

making sure that if there are attacks, that they're being addressed fast, and also to ensure that they can market those security features as differentiators. This title is called product security officer and sometimes chief product security officer. We enable them to protect the device, to meet those customer requirements, to meet those standards without requiring any change from R&D. Why it's important? Because R&D usually pushes back.

You want security, it means I'm going to delay the time to market. And you don't want to delay time to market because it has quite significant commercial consequences. So for them, we provide the XCAD protect and the XCAD monitor. So in essence, I didn't want to talk about the industry per se, but rather on the user persona. If you are one of those profiles, then we welcome an engagement. We welcome to show, to learn about the needs.

And probably we may have a good solution for you to meet your accountability, to meet your KPIs within your organization. There you go. Get those goals done so that products can get to market. I mean, it's so important with products. They need to get to market quick, fast, and to be able to capture the moment. So what's the best way to reach out to you guys, to get in contact with you folks? So we have our booth, a virtual booth, obviously, at CES, and

guests could look up for Karamba Security with a K at CES. If they want, then they can also go to email us at contact at karambasecurity.com and

ask to, they can even ask to talk to me, and we can continue the discussion from there. And obviously we can, we have the, but I don't want to be the bottleneck. So in essence, what's going to happen is that we're also going to assign the right account manager for them by geography and by vertical.

And are you guys going to have some videos or some assets? This is kind of weird this year because it's all virtual so i'm like yes it's even confusing because people write me and they're like you come by your booth and i'm like wait what and you know you know i'm so used to the old way and my brain has to go there's a new way uh do you guys have some videos or different things up there absolutely so uh first of all, unfortunately, we were limited by CES to upload only three videos. Oh, really? Yes, yes, apparently.

So you have three videos, one for automotive security and another for the enterprise edge, like printers and routers, and another one for the smart factories and smart homes. So three videos on the website, oh, sorry, on the virtual booth. And you also have their white papers

and shorter documents, like two pages, for each of the products, in case you want to learn more and to see, indeed, that there is of interest for you before you contact us directly. There you go. And it looks like I'm looking at your blog here on your website, Karamba Security. You guys keep updated on some of the latest stuff that's

going on. Like there's an article here that you guys have about how vehicles right to repair will expose Massachusetts residents to cyber attacks. So you guys are keeping your thumb on the pulse of different legislative changes, different things that you're looking out for for your clients. Yeah, I have to say that's quite a painful matter because we very much understood the need. So to give some background to the listeners, in Massachusetts, there was a bill that indeed made a lot of commercial sense.

It extended right to repair to anyone, right, to any kind firmware of those controllers to anyone that wants to receive it, right? In order to presumably maintain and offer the right to repair. The problem is that, in essence, it makes hackers' life much simpler. You just hand the code over. You want the code. It's actually the binaries, but it's fine. Give me the binaries. So the idea is that they try to repair

that was overwhelmingly approved by the public and the voters. In essence, it's going to make hackers life a little easier or more than just easier, giving them the firmware to try to find vulnerabilities in. And automotive cybersecurity is a serious thing. You know, the former Assistant Attorney General for National Safety said that connected cars were the administration's biggest problem,

given the scale of attacks, and so on. So in essence, yeah, we try to keep our customers up to date, and we're quite vocal about observations, which are not necessarily Caramba related. It's much more about the domain of the IoT product security. There you go. And I like how it drops into a box where you don't have to sit down and work with them and spend a lot of time to work with them typing out their code. They can have it checked and easily dropped in, which makes sense. Anything we haven't covered about you guys so far?

I think we're quite excited. I have to say one thing which was quite surprising to us. We started the talk here talking about the COVID-19 and how it changed CS. But obviously it changed the life of all of us. So first of all, we wish everybody health here. It's so important and it gave us the proportions of what's important and what's less important and things that were taken somewhat straightforward as health

are not so straightforward. And we very much, you know, need to make sure that everybody is healthy and safe. The thing that surprised us was that 2020 was a great year for us. And also, we realized that the product security, the IoT manufacturers didn't want to change their plans. And they wanted to continue

delivering the products on schedule. Security is a matter of importance to them. And this, I think, explains why the momentum intensified in 2020 versus 2019. But all in all, I would like to take this opportunity to wish everybody health and safety to all those that are listening to us and all those that are coming to see us and you know all around us there you go thank you we we need as much health as we can here in america you guys are in israel so is the covid19 going better over there than it is over here i think everywhere is going better than i don't want to go into details everybody suffers from covid 19 well yeah the whole world we're all just in it with humanity um but uh no the the uh this is probably even more important like you say with covet because

everyone's at home now they're all using more iot devices than ever before i mean all of my friends and companies and i know anyone who's making like things that make your home life better uh of internet of Things. I know robots, vacuum, robo-vacuums have been really hot. The webcams have been really hot. Just about anything that just makes your life better at home because people are trapped at home, and they're using, like I say, more IoT devices than ever before. And the sales of these products are just going off the chart this is a real huge

impact point and uh and potential point for hackers to get in do whatever they're doing especially because a lot of these people are working from you know i just thought of this actually a lot of these people are working from home but they're interacting with their corporate um accounts and their corporate data and stuff like that through their home computers. So there's definitely some security concerns there that never really occurred to me. But I have friends that work for VMware or different other companies, and, yeah, I mean, they're logging into their accounts from home, and, geez, man, maybe if you get through a light bulb or a lamp or something,

who knows what sort of crap you could rot. So this is pretty awesome, and I'm excited to see the show this year. light bulb or a lamp or something who knows what sort of crap you could you could rot um so this is pretty awesome and i'm i'm excited to see the show this year it's going to be kind of weird like i'm used to walking the show and interviewing people and putting a mic in their face and and filming and you know doing all that crazy stuff but this year it's like really weird it's like i'm actually going to watch press day today sitting here in my chair and just uh i don't know eating cheetos and and watching the thing and this is kind of weird like you know what i mean and and it really freaked me out the first time i got the the pr uh uh things from people from cs because they're like come by

our booth and i'm like wait there's booths did i'm did i understand the virtual nature so it's kind of funny but it's it's gonna be it's to be, it's going to be a great year. What I love about this year is we talked about this Gary Shapiro when he was on, is there leaving the assets up for 30 days? So people are going to be able to access the, the assets, the videos, everything. I believe the keynote speeches, all that sort of stuff is going to be up there for 30 days, so if you're hearing this anytime in that time period, you should be able to

get to some of these different assets and be able to see what's going on with the show, so be sure to check those out anything you want to say in parting, David, any last bit of information you want to give us? That's all, I very much hope that 2021 will be a much better year for everybody and, you know, with

lots of personal prosperity and professional prosperity to all of us, it's going to be quite, you know, probably relatively to 2020 on a personal level, it's going to be better. And hopefully, on all measures, it's going to be better to all of us. Well, we only have up to go from here. So there you go. David, give us your guys's.com is where to contact you and all that good stuff. Yes,

please. Thank you very much. So the, the, the website, as I said, was, is www.karambasecurity.com.

Within it, there's also the contact us button. You can also visit us at the booth and the virtual booth and look at the It's alambasecurity.com. Within it, there's also the Contact Us button. You can also visit us at the booth, at the virtual booth, and look at the videos. You can leave contacts for us to chat with you live and learn about your needs and how to help you address them successfully. There you guys go. Be sure to check it out, guys. We'll be doing coverage all week of CES.

We'll probably be talking about it all month because we can. I love how the assets are up for 30 days because I try to cover everything at CES. Like every year, that's my goal to hit every booth, to at least see every booth. And I just always fall. I get like about two-thirds of it in the can. So this is going to be kind of exciting because I have more time to play with stuff, you know, instead of just cramming into four days. So I'm really excited about it. Be sure to check it out, guys. CES show 2021. It's going to be virtual. There's going to be all sorts of really cool things that are happening. We'll

be talking about you to go to our Facebook group. I believe Gary Shapiro is in there. He comments every now and then on different stuff and different staff at the CES show. You can go check that out. I believe it's facebook.com forward slash CES show or just Google it there. We'll let you in. We'll be showing videos and different announcements like that here. Thanks to David for being with us.

Thanks for spending some time with us, sir. Thank you very much, Chris. Thank you for this great opportunity. Appreciate that. And I'll look forward to 2022. We'll be meeting in person, buddy. In person. Yeah, no more of this virtual stuff.

It was good for one year, but we're not doing this anymore. I want to be able to meet people and not get COVID in 2022, which looks like we'll be able to. Anyway, guys, thanks so much for tuning in. Be sure to give us a like. Subscribe to us on YouTube. Go to YouTube.com. Forge us, Chris Voss. Hit that bell notification.

You can see all the great interviews we'll be having this week at there. And it's free for an unlimited time. You can just watch all those videos. Oh, my gosh. There's over 700 podcasts on The Chris Voss Show. Go to thecvpn.com. You can see online podcasts over there. Go to goodreads.com, Forge has Chris Voss.

You can see the authors that we've interviewed on the show. We've got some great authors coming up. FBI director or FBI, I think it was assistant director, Frank Fuguzi is going to be on. Several great authors of a series of books and different things that we've had on. Some radio folks. I believe Tom Hartman will be on the show. Be sure to watch for those coming up in the weeks after we do see a show this week.

Anyway, guys, we certainly appreciate you guys tuning in, and we'll see you next time.