Building a parallel Internet, security buzzwords that should be retired, and the news – Barrett Lyon – ESW #482
Interview with Barrett Lyon
Why do we need a Parallel Internet? Barrett details his journey to build truly private access to the Internet. My first thought was, "why not VPN? Why not TOR?" He has good answers to both. To get there, he had to ship his own hardware all over the world. He had to stand up a CDN. DNS. BGP. Anti-DDoS.
This is more than just a safer, more secure way to access the Internet - it is an API-driven, optionally agent-controlled software-defined network. And it's a consumer-priced product that starts at $6 a month? My head is spinning.
Note: this is NOT a sponsored segment, I'm just legitimately fascinated by it! When this was pitched to me, it sounded so outlandish, I almost passed on it. Then I saw that Barrett created and sold 5 companies, two of which were major anti-DDoS vendors. Clearly, this guy knows how to build serious, scalable infrastructure. Enjoy the conversation!
Segment Resources:
- The main website: https://doxx.net
- Doxx.net Discord channel: https://discord.gg/595hAxHH4
- Barrett's previous work mapping the internet for the Opte project: https://www.opte.org
Vibe Check
Which security acronym/phrases deserves to be retired?
- 38% - XDR
- 25% - Zero Trust
- 25% - UEBA
- 6% - CNAPP
- 6% - Non-Human
- 0% - Other (leave a comment)
Nothing like some acronym soup and buzzwords to really get people out to vote! Shared anger can be a powerful thing, and I’m here for the rants.
I have to agree with the top three votes: XDR, Zero Trust, and UEBA (User and Entity Behavior Analytics). CNAPP can see ya later, and since agents outnumber humans 100-1,000 to 1 now, can we call our user accounts “Pro-Human” instead of calling service accounts and agent IDs “Non-Human”?
I’m currently raising on this business concept - pre-revenue, pre-TAM, pre-founder, and pre-idea. Expecting to close a $150M pre-seed at a $100B post-money valuation in the next few weeks. Let me know if you want in. ????
Top Comments
- “Other - The “AI TRiSM” term can go kick the biggest of rocks”
- “Other - Shift left”
- “My god I have always hated zero trust and would love to see it die. What a stupid, over-the-top & exaggerated phrase to just basically mean that having a bunch of unauth/flat user roles things is bad… how an entire category of the industry managed to piggyback off cloud to make ZTNA a thing I’ve no idea. Also led to the annoying trend of overly segmenting all the things. rant over”
Enterprise Weekly News
Finally, in the enterprise security news,
- We check out funding
- There are a lot of acquisitions
- And a round of layoffs
- A tech startup goes out of business after two breaches
- Private keys should be larger than “4”
- PHP2Shell disrupts everyone’s plans this week
- Want to impress your friends with the quirkiest 2FA authenticator ever? Stick around until the end of the news.
All that and more, on this episode of Enterprise Security Weekly.
Barrett Lyon is a serial founder with over 20 years experience building internet infrastructure and tracking threat actors. He founded Prolexic Technologies, one of the first DDoS mitigation networks, acquired by Akamai. He then went on to found BitGravity (acquired by Tata Communications), XDN (acquired by Fortinet), and Defense.net (acquired by F5). Lyon helped build WireSlammer, a stealth transport protocol used by journalists operating online in Iran, and has worked with law enforcement to track extortion crews across continents.
Quick reality check. Your network isn't getting smaller. It's getting more distributed.
Cloud, SaaS, remote users, third-party integrations... every new connection creates another decision about trust. And every decision adds complexity.
Join us for the Network Security Virtual Summit on October 28 to learn how enterprise security teams are improving visibility, modernizing segmentation, and building network architectures that reduce risk without slowing the business.
Security Weekly get a free pass! Register now at https://securityweekly.com/netsec using the discount code CSS26-SW!
Adrian Sanabria
- FUNDING/M&A courtesy of the Security, Funded newsletter #266 – Varonis & Chill
FUNDING
- Harmonic Security (GB) · $50.0M Series B | DLP for AI applications, led by Crosspoint Capital Partners
- Reach Security (US) · $50.0M Series B | security operations AI copilot platform, led by Top Tier Capital Partners
- Pluto Security (US) · $34.0M Series A | AI workspace security platform, led by Jump Capital
ACQUISITIONS
- Varonis Systems (US) · data security platform | acquisition by Proofpoint, $6.3B
- Elisity (US) · identity-based microsegmentation | acquisition by IonQ, $1.3B
- AISLE (US) · automated vulnerability triage platform | acquisition by Cohere, undisclosed
- C1 (formerly ConductorOne) (US) · identity and access management for AI agents | acquisition by Workday, undisclosed
- Opaque Systems (US) · confidential computing platform | acqui-hire by Anthropic, undisclosed
- Torii (IL) · SaaS posture management | acquisition by Freshworks, undisclosed
LAYOFFS
- XM Cyber, an Israel-based risk-based vulnerability management platform, reportedly reduced its Israeli workforce after selling its technology assets to CrowdStrike. The continuing business remains with Schwarz Group.
- DESTROYED BY BREACH: Zeabur shutting down after second security breach in two months
The latest addition to the Destroyed by Breach list at https://destroyedbybreach.com
After two thorough compromises in a short amount of time, the Developer Platform company decided to just shut down the company.
- DRAMA: Passkeys are a trap. Do not use them.
Well, THIS headline caught my eye. This isn't even the first anti-Passkey post we've discussed. This one, however, got a lot of attention and resulted in some swift feedback from some industry experts, like:
- Scott Helme: https://scotthelme.co.uk/passkeys-are-not-a-trap/
- Ricky Mondello: https://hachyderm.io/@rmondello/117428258722253709
- BIG OOF: Eight Bits of Trust; eMudhra’s CA keys cracked in milliseconds
A CA generated intermediate certs with laughably bad private keys. One of the private keys was "4". Mostly looks like no real damage done here, bad certs were revoked immediately, no signs of maliciousness. If you want to dig in deeper:
- Boost Security made a tool called emBarrass that can wrap CI/CD/CLI tools to see if they respond appropriately to the bad certs.
- eMudhra's official response
- A handy site with all the essential details, which also tests your browser to ensure it doesn't trust the problematic certs
- VULNERABILITIES: Today’s PHP Security Release, and How We’re Strengthening PHP Security
The fires from PHP2Shell are still burning bright as of the time we're recording this podcast and we don't expect them to die down any time soon. In some ways, this is worse than Log4Shell, as PHP is embedded in even more devices and is more accessible to exploit.
We also have a bit of drama with this one as well. Apparently Chainguard broke the embargo and decided to release the PHP foundations' patches over 6 hours early, potentially putting anyone who wasn't their customers, in unnecessary danger.
The PHP Foundation was not pleased. The big question now is, will anyone trust Chainguard in the future with pre-disclosure material?
Some more details on the vulnerabilities and some recommendations from us:
- there’s a critical PHP vulnerability that impacts all versions from PHP 5 to the latest version, functional exploits exist, and exploitation has been observed
- Only the latest version (PHP 8) will be patched - versions prior to 8.2 don’t get it
- Everyone needs to check for webshells, regardless of patch state/application
- Make sure the patch is actually working, not just applied - restarting services will be necessary
- PHP is in everything, this is also an asset management challenge and a vendor risk challenge. If you have any on-prem managed free tools with a web front-end, and the project has existed for more than a decade, it’s probably PHP-based
If you're wondering what runs PHP, Jonathan Cran has an excellent list
- SQUIRREL: TOTP authenticator for Game Boy
Ayman Elsawah
