Securing high-risk communities

Ramesh: [00:00:00] The last thing you want to do, even if you do have some of those skills in your portfolio, is to spend a whole bunch of time setting up infrastructure. You know, taking a fresh computer, imaging it, trying to procure yourself a network to safely go and touch the internet. You don’t want to be doing any of those kinds of jobs because you want to spend All of your time actually doing the thing that’s going to make an impact in your field, which is going out and doing the research.

Jeff: Welcome to NeedleStack. I’m your host, Jeff Phillips.

Shannon: And I’m Shannon Ragan. Today, we’re talking to Ramesh Rajagopal. CEO and co-founder of Authentic8, creators of Silo for Research, the digital investigations platform, and noble benefactors of this show. Ramesh, welcome to NeedleStack.

Jeff: Great to be here. Hi guys.
How you [00:01:00] doing? Doing great. And the reason, one of the reasons we have you here, Ramesh, is, uh, we recently released a program called Silo Shield. And, uh, could you tell us a little bit about that?

Ramesh: Yeah, sure. So, um, We’re pretty excited about this initiative. We, uh, we launched it a few weeks ago in, in partnership with CISA, um, who’s a large, uh, federal organization that works on, uh, national cybersecurity infrastructure initiatives, and we’ve had a product in the market for a number of years that helps people doing digital investigative work.
To maintain full security as well as to manage their identity online. And so it’s a super useful platform and we can dig more into what the platform does and what it enables. But one of the, uh, communities that we’ve, uh, had a long history of trying to support are what we call high risk [00:02:00] communities. So think, you know, people who are either academics, journalists, they work for non profit groups, they’re perhaps activists.
Um, they’re high risk communities because they’re trying to uncover and solve, uh, social justice or equality issues on a global basis. And they don’t necessarily have access to the tools and resources that keep them safe when they’re going about doing that kind of digitally investigative intensive work.
And so, as a vendor who offers solutions to help people manage their security and their privacy, uh, online, We’ve often wanted to actually reach out to this community and make our tools available so that they can do their work more effectively and more safely. Um, and so we’ve been doing that, but the interesting that’s happened recently is that we’ve been given a big boost because the whole platform around.
How do you protect high risk communities was bolstered by the work of CISA. So when they [00:03:00] stepped forward and said, we want to put in place some best practices and make some tools and resources available to these high risk communities, they went out to the marketplace and looked at who was already there trying to help this kind of work.
And, you know, we were happy to be identified and partner with a bunch of other companies, including, you know, Apple and Google and Microsoft to be one of the vendors. That is offering our platform as a pro bono offering to these high risk groups so that they can go about their work.

Shannon: It seems that, you know, obviously journalism, humanitarian aid work, um, Are very dangerous right now.
They have been dangerous for a long time. Do you think that there’s anything behind maybe current events or other, you know, global issues that was kind of pushing SZA to, you know, launch this initiative now?

Ramesh: Yeah, I mean, I think if you look at, let’s, let’s call it the last [00:04:00] decade, maybe it’s a little bit shorter than that, but you know, the availability of information in online digital forums has only gone up and to the right, you know, whether that be on the open web, whether that be on social media platforms, whether that be on the dark web, the, the leading edge of the bleeding edge intelligence that everyone is seeking, um, Um, is online somewhere.
And so the need to go find that information from, uh, wherever it lives is more paramount than ever. If you’re in the business of trying to mitigate risks, go, um, at the same time, it’s kind of a double edged sword because that same digital infrastructure gives bad actors and adversaries the ability to target individuals trying to do this work, uh, disrupt their work.
Perhaps steal the contents of their work, uh, maybe intimidate and silence people trying to uncover inconvenient truths. And so that whole digital playing [00:05:00] field where on the one hand, we have more access to information that we’ve ever had before is a plus, but that same medium gives people who are interested in, uh, silencing or disrupting people, uncovering the truth.
A medium with which you can target individuals or the organizations that those individuals work for and suppress information. And so we’re living in a world now where it could be a local issue, could be a national issue, could be an international issue, but you have people on a global basis. Trying to uncover truths and bring that to light so the world can make the best decisions possible around how to remedy, uh, injustice or solve inequalities.
At the same time, you have bad actors using that very same medium to suppress, control, spread disinformation, or even physically harm individuals trying to uncover that work. And so all of that, that kind of melting pot, that crucible, has meant that. [00:06:00] We rely on, you know, the online world more than we’ve ever had before in terms of figuring out what’s going on.
Uh, but we have more needs to protect ourselves and our identities and our security in the process of going in, uncovering that information. That’s a great point.

Jeff: Ramesh, do you think that the people in these high risk communities themselves are aware of the risks that we’re talking about? Online. Um, and how they could be put in danger or how it can affect their work.
I mean, our audience is typically those and professionals, cyber security folks. They tune in because they’re, you know, this is what their life’s all about. What do you think about these journalists and academics and humanitarians and their understanding?

Ramesh: Yeah, I think, I think it probably, I think the truth is, it probably varies a lot.
Um, I think all of these professionals, uh, whoever they work for, whether it’s for an organization or it’s just as an individual, they are, they are [00:07:00] very careful of the risks that they’re taking on a daily basis because they, they feel those palpably around them. They may or may not be able to link that to the actions and the activities they’re taking when they’re going out online.
And so there’s, there’s probably, uh, a, a, an on level playing field in terms of the level of understanding that they have. I think topically, they will be certainly aware of the fact that, you know, uh, their activities online are probably more surveilled than they’ve ever been before. Uh, they’re topically aware of, Tools and technologies like encryption and, you know, uh, being able to geolocate devices through things like IP ranges or cell phone signals.
So they’re more topically aware of that, but they’re probably, I would imagine also confused by the array of technologies that are out there. Purporting to help them. Right. And so they may not know exactly where one technology or tool, you know, where its scope ends and where [00:08:00] another technology or tool is needed to kind of pick up where it left off.
You know, a good example is VPN technology, right? So people are understanding that if they’re on an encrypted tunnel to access the internet, great, that’s a good thing. You know, it can, it can make sure that there’s no eavesdropping on that network. Potentially allow them to, uh, Place themselves in a different geography, that’s all great, but it may not prevent, you know, a piece of malware coming down that encrypted tunnel and compromising the machine that they’re running.
You know, another example is, you know, private browsing mode or incognito mode that, you know, typical browsers, uh, deliver. Useful in certain regards, but depending on who it is that you’re trying to remain hidden from, it may be completely useless. Right? It might be hiding your history from someone who has access to your device, but it may mean nothing about hiding your activities to somebody sitting on the network upstream of you, you know?
So, uh, similarly with things like two factor [00:09:00] authentication, fantastic tool. Everyone should use it. But, you know, if I’m taking my laptop and I’m an activist sitting in a internet cafe, Uh, using the, uh, public Wi Fi, the hotspot that’s available there, you know, I have a whole new set of risks that two factor authentication doesn’t protect me from at all, right?
And so all of these things are useful, but I can imagine that the people doing this work are very clueful that they are at risk, but they may not be as clueful about what each type of technology in the, in, in the array in front of them actually does and where one ends and another one picks up in terms of holistically protecting them.

Shannon: In, in that vein, could you speak maybe to, you know, kind of why you’re bringing together the solutions to like these, you know, many, you know, seemingly disparate issues into a centralized platform and why that can help these communities or. You know, why anyone performing, you know, a [00:10:00] sensitive or critical, you know, digital investigation would want that consolidation rather than kind of addressing them individually.

Ramesh: You know, when, when we started the company and we came up with this idea, it, our original thought process wasn’t around solving this very specific issue for, you know, digital investigations. But what we did see was a broader class of problem, which really pointed a finger The local browser that we all just wake up and trust blindly on a daily basis, you know, security and privacy were never really in the equation when the initial browsers were built.
And especially from a privacy standpoint, most of the big names that have stood behind pushing browsers actually have an inverse incentive, right? Their goal is to actually identify you from a, from a, from a, you know, Uh, marketing and, uh, business growth standpoint. And so when we looked at the world, we said, look, there’s a real vulnerability here around the [00:11:00] browser, the way it executes, the way it, you know, handles malicious content or untrusted content being delivered to your browser.
Computer, the way in which it’s trying to protect your privacy. So what if we did something to really kind of disrupt security and privacy when it comes to browsing? And that’s the tool we created. We call it Silo. And the idea was we would create and build a browser in a cloud based environment, completely dislocated from your actual computer.
We would take all the risk that might be presented from, from You know, surfing the public Internet, so all of the potential malicious code or untrusted code that could otherwise end up on your machine would instead be contained within our cloud based browsing environment. And as a byproduct or a side product of that, we’re also able to manage the user’s identity on the public Internet.
So, instead of, you know, [00:12:00] you being, uh, Jeff using a MacBook sitting in California touching the public internet, you would use our service to provide you a complete shield. You’re completely isolated from malicious content on the public internet, but your identity is also completely masked from the public internet.
And so that technology there, which we built as a general purpose capability that we could, that we thought could benefit a bunch of use cases and a bunch of users. Turns out. It’s really, really powerful in trying to address these very high risk folks that we’re talking about today, who are doing, you know, investigative work online.
And so when they access the internet through our layer, they get a level of security and privacy that’s unparalleled and completely non comparable to them using the local browser on their phone. On their device, if it’s in their hand, and so that’s how this whole thing started. We were solving a general problem that spoke to the [00:13:00] fundamental vulnerability and insecurity of the browser.
And through that process, we came up with this idea of a cloud based cloud based browser that could not only secure your activity, but also manage your identity.

Shannon: So there’s a lot of, you know, technical and workflow advantages, you know, to, to having this type of, of platform, as you’ve discussed, how does that impact really the, you know, the user is it making, you know, presumably it’s making their job easier, but is it lowering the barrier to entry for just like getting into this type of work period or organizations tackling these types of investigations?

Ramesh: Yeah, for sure. I mean, so I spoke a little bit, um, around the value of the platform, but part of that value. Uh, is definitely the fact that we want to be able to allow people doing this kind of investigative work to very quickly and simply be able to access the tool and start to do research or [00:14:00] analysis as quickly as they possibly can.
If you’re a activist working for a nonprofit, or you’re a, uh, somebody working as part of an academic organization, or you’re a journalist, the last thing you want to do is to mug up on IT security skills. Uh, the last thing you want to do, even if you do have some of those skills in your portfolio, is to spend a whole bunch of time.
Setting up infrastructure, you know, taking a fresh computer, imaging it, trying to procure yourself a network to safely go and touch the internet. You don’t want to do be, be doing any of those kinds of jobs because you want to spend all of your time actually doing the thing that’s going to make an impact in your field, which is going out and doing the research.
So one of the things that we built was this, you know, all of the values, all of the value, you know, uh, that I just mentioned, but all delivered as a cloud made out. Launch an application, get into a secure browsing environment, and start [00:15:00] researching ASAP solution. And that’s when I think about silo for research.
A cool part of the value prop is you just open your laptop, you click a button, you launch a browser in the cloud. It’s configured for the research job at hand. And then you immediately start conducting secure, anonymous digital investigative work. And once you started interacting with content, you should be able to store that content without exposing yourself or, you know, bringing it to your local device.
You should be able to annotate it. You should be able to screenshot it. You should be able to share it with others in your work. There’s all kinds of workflows that then stem from that. But a big part of it is around making it extremely easy for the user. To do what it is that they want to do, which is actually researching and providing intelligence that’s, uh, as, as, as high integrity as they can in the shortest timeframe possible.
And if our platform is 1 piece of accelerating that whole [00:16:00] intelligence life cycle, then I think, you know, we’ve done our job. And so a good part of our value proposition is to take all of that headache away from the investigator and deliver it to them as a cloud native SAS solution. Well,

Jeff: then if we also think about, you mentioned more organizations are realizing the importance of investigative analysis.
Um, how do you think people can think about, I guess, more so formalizing their, their digital investigations?

Ramesh: Yeah, I think, I think, you know, when we talk to organizations, whether they be on the. Government side or the, or the, or the commercial side, the enterprise side, we see all kinds of users within companies and they don’t formally have investigator on their badge or in their title, but they all are in some way or another going out there and they need to securely conduct.
Research or digital investigative work on behalf of their organization. [00:17:00] And it’s ident, the first thing I think any organization can do is to try and identify who their most at risk users are, who are doing this kind of work. Some of them are very easy to spot because they’re sitting in teams like the cyber threat intelligence team or the security operation center team.
And it’s very clear that they’re doing this work. Uh, but others might be more hidden in the organization. It could be, uh, a group of, uh, IP attorneys who are doing, uh, investigative work. It could be, uh, a know your customer team. It could be a financial, uh, uh, fraud and investigations group. It could be a corporate intelligence team.
It could be, uh, anti money laundering and fraud team. You know, it could be a variety of different groups that don’t necessarily think of themselves as technical. They don’t necessarily sit under the CISO’s office in an enterprise environment. Uh, they don’t have the word threat or intelligence in their title, perhaps, but they’re going out and they’re doing [00:18:00] extremely critical work to try and address some risk that the organization is facing.
And in the course of doing their job, They’re exposing their organization to digital risks, and they’re exposing potentially the identity of themselves and their organization to the public Internet, both of which are extremely dangerous things to do. So, to answer your question more directly, I think it’s, you know, look at people who are doing work around you, uh, regardless of their function, and figure out if they’re doing things that, you Compromise your organization in the course of doing their work.
If they do, maybe they could be a candidate for a secure investigative platform like ours.

Shannon: When you were talking about, um, maybe understanding the risks, but not, uh, how to mitigate them properly. I was thinking of the phrase, like when you know enough to be dangerous, like I get the risk, I know there’s technology out there to solve this, like I’ll use. This that I think is right, but it’s not actually doing the thing that you think it’s doing. So letting people focus on what they’re good at, but about being good investigators and good researchers, I think is so really key. We’re all really excited about the silo shield program. We’ve already seen a great amount of interest since it’s been launched a few weeks ago.
Um, if anybody is interested in applying or learning more about the program, you can go to our website at authenticate. com slash silo dash shield. That’s authenticate. com slash silo dash shield. We’ll put this in our show notes as well.

Jeff: Thank you, Ramesh, for being on today and talking about Silo Shield and digital investigations.
We appreciate it.

Ramesh: It was a pleasure. And yeah, please, uh, if you’re in one of these high risk groups, please check out the site that Shannon mentioned. And, uh, you know, we’d love to support

Jeff: your work with our platform. And thank you to our audience for listening. You can view transcripts and other episode info on our website.