Cybersecurity is about to become decentralized! Why does it need to be?
The current digital and online environment are characterized by several issues.
- The first is that the world is becoming more interconnected and digital.
- The second is that bad actors, ransomware and other online threats are on the rise. This is also fuelled by the fact that talented cybersecurity experts are often tempted by the economic rewards of Black Hat rather than White Hat activity.
The threat is also exacerbated by a protection environment that is notoriously “backward” rather than “emerging threat” focussed. The result? A global marketplace where bad behaviour is frequently more lucrative than good.
One blockchain startup wants to change all that. PolySwarm intends to create a unique, decentralized cybersecurity platform and marketplace that incentives good if not White Hat behavior.
We recently sat down with Steve Bassi, the founder of PolySwarm to have a chat with him about the project as well as finding out his thoughts and insights.
Hi, Steve. Thanks for joining us today. Can you tell us more about yourself and PolySwarm?
Sure, I grew up in a small farming town in California. Broke into a company’s computers when I was like, 11, they caught me but some of the IT guys took me under their wings and gave me a summer job through high school. That’s how I got started in security. From there, my team and I have built up Narf Industries and done a lot of cool projects for everyone from DARPA to Commercial clients. We’ve also played a lot of hacking competitions or CTFs at Defcon and the like.
PolySwarm grew out of frustration we had doing work on Narf. We’d developed all these cool tools that had narrow, but, deep applications to cyber threat detection and mitigation but didn’t have a way to get them looking at real stuff the enterprise was facing. That’s why we made PolySwarm, we knew there were other small security shops like us that had tools that could protect users. Additionally, there was no good way to get access to all of these tools through one interface. That’s also where PolySwarm comes in: it serves as one big umbrella built from a collection of the best security expertise.
First off, please quantify the real threat “bad actors” pose to an increasingly digital economy.
I’ll cite some stats that others have put out and then qualify the risk. First CSO online claims damaged from cybercrime hit $6 trillion annually. We see this reflected in spending on cyber risk insurance, it’s growing at 28% (CAGR) a year and is expected to hit $14B by 2022. So that gives you an idea of how serious the bad actor problem is.
The problem with insurance is that businesses and people still get hurt by bad actors. It’s tough to quantify the actual losses: proprietary designs, financial information, and credit scores are all at risk when bad actors are successful. Our position at PolySwarm is that insurance plays a role, sure, but we’re really focused on creating better threat detection so users don’t get hit in the first place.
How did you come up with the idea and what was the thought process behind it?
I covered this a bit in an earlier question, but I’ve been involved in bitcoin since 2010. When Ethereum came onto the scene I got really excited for this ability to, literally, build markets to old problems without intervention by anyone, really.
We came up with PolySwarm mainly out of frustration, as described previously, but we quickly got excited about coupling an economic solution with micropayments and smart contracts to *actually* solve this frustration of making a bunch of security solutions available through a cohesive platform.
What is the biggest problem within the industry or do you think there is a gap in the market for PolySwarm to fill?
I think it’s that for the past 20 years we’ve had the same economic model for threat detection: centralize, hire a small team of developers locally, and de-prioritize R&D and addressing current threats once the company achieves customer stability. Our thesis has always been that security expertise works better in a competitive environment where they’re incentivized to stay up to date. That’s the gap we’re trying to fill: make it continually profitable to protect users.
What do you think is the biggest problem PolySwarm will solve and why is the problem important to solve?
This economics problem: always incentivizing security experts to keep their solutions up to date for better protecting users against new threats. The problem is important because it ultimately increases costs for attackers by increasing compensation and vigilance for the defense across a wide range of viewpoints.
Where did you come up with the inspiration of rewarding experts who could potentially turn into “Black Hat” operators because of prevailing local economic conditions?
I’m not sure I’d call it inspired, but thank you. Maybe it’s just the courage to point out that this is probably happening? If we want to truly solve the problem, maybe fixing the economics of threat detection would help? That’s what we’re going with, we actually think most people are inherently good which I’m sure is rare for a security group.
In the whitepaper, you talk about the role of “Ambassadors” who will post bounties for determining the maliciousness of a file, URL or other digital assets. How did you come up with the concept of this, as well as bounties and rewards? It all feels a bit “Dungeons and Dragons.”
There’s a great book called “Who Gets What and Why” by Alvin Roth. He talks about market design for a ton of things: organ donation, public school lotteries, and how doctors get picked for residency. We felt that bounties and offers were the best ways to incentivize experts to do what we wanted, detect threats, while still providing the ability to reward them.
For bounties, specifically, they’re based on the prediction market concept. We needed a way to have multiple security experts weigh in on the malintent of files without shrinking the reward pile each time one weighed in. So if it feels dungeons and dragons, blame market design and game theory! This is also why we’ve hired a Chief Economist, Evelyn, who is here to monitor the performance of the marketplaces and suggest bounty amounts, fees, and other settings that will help the market be both thick (read: enough transactions to be interesting) and safe for participants.
Regulation-wise, what are the toughest challenges you will have to overcome (on a global basis)? And from where?
Explaining this technology to people is challenging in the first place. Try explaining a blockchain to your parents, etc. I think there’s this natural tendency for regulators for look for harm in new tech and not benefits. So our strategy is to show the benefits.
The way we plan to overcome this is by, first, developing PolySwarm into something that actually *helps* protect users. Our focus is on demonstrating the value of the model for regulators for actually protecting the people and sectors they care about from harm.
I think our biggest challenge will come from our home, the US, as they clarify how PolySwarm and Nectar fit in our markets. We’re actively, and civically, engaged here but it’s going to take time which is why we’re doing the token sale from our Japanese subsidiary to non-US residents. We’re going to start building.
What are the services you plan to offer that excite you the most?
Post token-sale we plan on spinning up identification and vetting services for security experts. These services are focused on vetting high-performing experts so that enterprises can work with them at higher volumes. I’m personally excited about this because we’ll, necessarily, get to meet a ton of our experts who are very smart. I’m excited to have a beer with these guys and hear about how they’ve approached building their micro engines and maybe a bit more about their secret sauce.
What has been your happiest moment so far working on PolySwarm?
Watching my team connect with the community online and at conferences. Working in R&D its rare that ideas see the light of day, getting support from people in public and getting *actually constructive* criticism from people has been really cool for me.
On the flipside, what has been the most painful, or perhaps the most regretful decision you’ve made with PolySwarm?
Having to close the public sale to US residents. This is my home and I wish my government was interested in providing more expedient clarity here.
Editors Pick: PolySwarm ICO
PolySwarm – A Decentralized Cyber Threat Intelligence Market Enabled and Enhanced by the Blockchain
Cybersecurity threats are only growing in an increasingly digital and interconnected world. Blockchained threat response might help alleviate some of the risk and vulnerabilities of individuals and businesses alike. Experts in the cybersecurity space expect a continuing and dramatic increase and risk from cyber threats. The world is becoming increasingly
