OSCAR BELLEI, Agoraverse | Monaco Crypto Summit 2022
>>Okay, welcome back everyone. This is the Cube's coverage here. Monaco took a trip all the way out here to cover the Monaco crypto summit. I'm John feer, host of the cube, a lot of action happening presented by digital bits and this ecosystem that's coming together, building on top of digital bits and other blockchains to bring value at the application. These new app, super apps are emerging. Almost every category's gonna be decentralized. This is our opinion and the world believes it. And they're here as well. We've got Oscar ballet CEO co-founder of Agora verse ago is a shopping metaverse coming out soon. We'll get the dates, Oscar. Welcome to the cube. >>Thank you very much for having me. >>We were just talking before you came on camera. You're a young gun, young entrepreneur. You're a gamer. Yeah, a little bit too old to miss the eSports windows. You said, you know, like 25. It's great until that's you missed the window. I wish I was 25 gaming the pandemic with remote work, big tailwind acceleration around the idea of this new digital VI virtual hybrid world. We're living in where people want to have experiences that are similar to physical and virtual. You're doing something really cool around shopping. Yeah. Take a explain. What's going on when the, I know it's not out yet. It's in preview. Yeah. Take a minute to explain. >>Absolutely. So a goers really is a way to create those online storefront environments, virtual environments that are really much inspired by video games in their usage and kind of how the experience goes forward. We want to recreate the brand's theme, aesthetic storytelling or the NFT project as well. All of that created in a virtual setting, which is way more interesting than looking at a traditional webpage. And also you can do some crazy stuff that you can't do in real life, in a real life store, you know, with some crazy effects and lighting and stuff. So it's, it's a whole new frontier that we are trying to cover. And we believe that there is a real use case for shopping centric S experiences and to actually make the S a bit more than a buzzword than that. It is at the moment. >>Okay. So a Agora is the shopping. Metaverse a Agora verse is the company name and product name. You're on the Solona blockchain. Got my notes here, but I gotta ask you, I mean, people are trying to do this right now. We see a lot of high end clients like Microsoft showroom, showroom vibes. Yeah. Not so much. E-commerce per se, but more like the big, I mean it's low hanging fruit. Yeah. How do you guys compare to some other apps out there? Other metaverses? >>I think compared to the bigger companies, we are way more flexible and we can act way more quickly than they can. They still have a lot of ground to cover. And a lot of convincing to do with their communities of users metaverse is not really the most popular topic at the moment. It's still very much kind of looked at as a trend, as something that is just passing and they have to deal with this community interaction that is not really favorable for them. There are other questions about the metaverse that are not being talked about as often, but the ecological costs, for example, of running a metaverse like Facebook envisions it, of running those virtual headsets, running those environments. It's very costy on, on, on the ecological side of things and it's not as often mentioned. And I think that's actually their biggest challenge. >>Can you get an example for folks that don't are in the weeds on that? What's the what's what do you mean by that? The cost of build the headsets? Is it the >>Servers? It's more of the servers, really? You need to run a lot of servers, which is really costly on the environment and environmental questions are at the center of public debates. Anyways, and companies have to play that game as well. So they will have to find kind of this balance between, well, building this cool metaverse, but doing it in an ecological friendly manner as well. I think that's their toughest challenge. >>And what's your solution just using the blockchain? Well, an answer to that, cause some people say, Hey, that's not that's, that's not. So eco-friendly either, >>That's part of it. And it's also part of why we're choosing an ecosystem such as Lana as a starter. It's not limited to only Salana, but Salala is, is known as a blockchain. That is very much ecological. Inclined transactions are less polluting. And definitely this problem is, is tackled in the fact that we are offering this product on a case by case scenario brands come to us, we build this environment and we run something that is proper to them. So the scale of it is also way less important that what Facebook is trying to build. >>Yeah. They're trying to build the all encompassing. Yeah. All singing old dancing, as we say system, and then they're not getting a lot of luck. They just got slammed dunked this week on the news, I saw the, you know, FTC moved against them on the acquisition of the exercise app. >>It's it's a tough, it's a tough battle for them. Let's say they >>Still have, they got a headwind. I wouldn't say tailwind. They broke democracy. So they gotta pay for it. Right. Exactly. I always say definitely revenge going on there. I'm not a big fan of what they did. The FTC. I think that's bad move. They shouldn't block acquisitions, but they do buy, they don't really build much. That's well documented. Facebook really hasn't built anything except for Facebook. That's right. Mean what's the one thing Facebook has done besides Facebook. >>I mean, >>It's everything they've tried is failed except for Facebook. Yeah. >>So we'll see what's going on with the Methodist side. >>Well, so successful, not really one trick bony. Yeah. They bought Instagram. They bought WhatsApp, you know, and not really successful. >>That's true. They do have the, the means though, to maybe become successful with something. So >>You're walking out there, John just said, Facebook's not successful. I meant they don't. They have a one product company. They use their money to buy everything. Yeah. And that's some people don't like that, but anyway, the startups like to get bought out. Yeah. Okay. So let's get back to the metaverse it's coming out is the business model to build for others. Are you gonna have a system for users? What's what's the approach? How do you, how are we view viewing this? What's the, the business you're going after? >>So we are very much a B2B type of service where we can create custom kind of tailor made virtual environments for brands, where we dedicate our team to building those environments, which has been what we have been at the start to really kickstart the initiative. But we're also developing the tool that will allow antibody to develop their own shop themselves, using what we give them to do something kind of like the Sims for those that know, building their environment and building their shop, which will they, they, they will then be to put online and for anybody of their user base customers to have a look at. So it's, it's kind of, yeah, the tailor made experience, but also the more broader experience where we want to create this tool, develop this tool, make it accessible to the public with a subscription based model where any individual that has an idea and maybe a product that is interesting for the metaverse be able to create this virtual storefront and upload it directly. >>How long does it take to build an environment? Let's say I was, I wanna do a cube. Yeah. I go to a lot of venues all around the world. Yeah. MOSCON and San Francisco, the San convention center in Las Vegas, we're here in Monaco. How do I replicate these environments? Do I call you up and say, Hey, I need some artists. Do you guys render it? What's the take us through the process. >>Yeah. It's, it's basically a case by case scenario at the moment, very much. We're working with our partners that find brands that are interested in getting into the metaverse and we then design the shops. Well, it depends on the brands. Some have a really clear idea of what they want. Some are a bit more open to it and they're like, well, we have this and this, can you build something? >>I mean, I mean, I can see the apple store saying, Hey, you know, they're pretty standard apple stores. You got cases of iWatches. Yeah. I mean that's easily to, replicateable probably good ROI for them. >>Exactly. It's it's is that what you're thinking? Their team. Exactly. Yeah. It depends. And we, we want to add a layer of something cuz just replicating the store simply. Yeah. It's it's maybe not as interesting, you know, it just, oh, okay. I'm in the store. It's white, everywhere. It's apple. Right. It's like, oh I'm in at the dentist, but we want to add some video game elements to the, to those experiences. But very subtle ones, ones that won't make you feel, oh, I'm playing one of these games, you know? It's yeah. Very supple. >>You can, you can jump into immersive experience as defined by the brand. Yeah. I mean the brand will control the values. So you're say apple and you're at the iWatch table. Yeah. You could have a digital assistant pop in there with an avatar. Exactly. You can jump down a rabbit hole and say, Hey, I want this iWatch. I'm a bike mountain biker. For example, I could get experience of mountain biking with my watch on I fall off, ambulance sticks me up. I mean, all these things that they advertise is what goes >>On. Yeah. And we can recreate these experiences and what they're advertising and into a more immersive experience is what we're trying to our, our goal is to create experiences. We know that, you know, why does someone is someone spend so much at Disneyland? It's like triple the price of whatever, because you know, it's Mickey mouse around you. It's, that's the experience that comes around. And often the experience is more important than the product. Sometimes >>It's hard. It's really hard to get that first class citizen experience with the event or venue physical. Yeah. Which is a big challenge. I know the metaverse are gonna try to solve this. So I gotta ask you what's your vision on solving that? Okay. Cause that's the holy grail. That's what we're talking about here. Yeah. I got a physical event or place. I wanna replicate it in the metaverse but create that just as good first party citizen like experience. >>Yeah. I mean that's the whole event event type of business side of the metaverse is also a huge one. It's one that we are choosing to tackle after the e-commerce one. But it's definitely something that has been asked a lot by the brands where like we want to create, like, we want to release this store for an event that is in real life, but we want to make it accessible to the largest number. That's why we saw with Fortnite as well. All those events, the fashion week in the central land. And >>Sand's a Cub in the Fortnite too. >>There you go. And so the, the event aspect is super important and we want those meta shops to be places where a brand can organize an event. Let's say they want to make the entrance paid. They can do an NFD for that if they want. And then they have to, the user has to connect the NFD to access the event with an idea. Right. But that's definitely possible. And that's how we leverage blockchain as well with those companies and say, you know, you're not familiar with >>This method. You're badging, you know, you're the gaming where we were talking earlier. Yeah. Badging and credentials and access methods. A tech concept can be easily forwarded to NFTs. Yeah, >>Exactly. Exactly. And brands are interested in that. >>Sure. Of course. Yeah. By being the NFT. That's cool. Yeah. Yeah. So I gotta ask you the origination story. Take me through the, the, how this all started. Yeah. Was it a seat of an idea you and your friends get together? Yeah. It was an it scratch. And when you're really into this, what's the origination story and where you're at now. >>So we started off in January really with a, quite a, a different idea. It was called the loft business club. It's an NFT collection on the Salina blockchain. And the whole idea beyond it is that NFT holders would have access to their virtual apartments that we called the lofts. It got very popular. We got a really big following at the start. It was really the trend back in January, February. And we managed to, to sell out successfully the whole collection of 5,000 NFTs. And yeah, we started as a group of friends, really like-minded friends from my hometown in, in, met in France who are today, the co-founders and the associates with different backgrounds. Leo has the marketing side of things. A club has the 3d designing. We had all our different skills coming into it. Obviously my English was quite helpful as well cause French people in English it's, it's not often the best French English. Yeah. And I was, the COO has been doing amazing on the kind of the serious stuff. You know, the taxis lawyers >>Operational to all of trains running on time. >>Exactly >>Sure. People get their jobs done. >>Yeah, exactly. So >>It's well too long of a lunch cuz you know, French would take what, two hour lunches. Yeah. You >>Have to enjoy it. Yeah. >>Coffee and stuff. That's wine, you know about creative, >>But yeah, it's, it's a friend stuff that started as a, as a passion project and got so quick. And today I'm here talking to you in this setting. It's like, >>You're pretty excited. >>I mean it's super excited. It's such a we're you know, we feel like we're building something that's new and our developer team, we're now a team of 15 in total with developers based in Paris, mostly. And everybody is, is feeling like, you know, they're contributing to something new and that's, what's exciting about it. You know, it's something that's not really done or it's trying to be done, but nobody really knows the way >>It's pioneering days. But the, but the pandemic has shifted the culture faster because people like certainly the gen Zs are like, I don't wanna reuse that old stuff. Yeah. And, but they still want to go to like games or events or go to stores. Yeah. But once to go to a store, I mean, I go to apple store all the time where I live in Palo Alto, California. And it's like, yeah, I love that store. And I know it by heart. I don't, I don't have to go there. Yeah. Walking into the genius bar virtually I get the same job done. Yeah, >>Exactly. That's that's what we want to do. And the other pandemic is just it's it's been all about improving, you know, people's condition, life conditions at home, I think. And that's what kind of boosted the whole metaverse conversation and Facebook really grabbing onto it as well. It's just that people were stuck at home and for gamers, that's fine. We used to be stuck at home playing video games all day. Yeah. We survived the pandemic fine. But for other people it was a bit more of a new >>Experience. Well, Oscar, one of the cool things is that you said like mind you and your founding team, always the secret to success. But now you see a lot of old guys like me and gals coming in too, your smart people are like-minded they get it. Especially ones that have seen the ways before, when you have this kind of change, it's a cultural shift and technology shift and business model shift at the same time. Yeah. And to me there's gonna be chaos, but at the end of the day, >>I mean there's fun and >>Chaos. That's opportunity. There's a fun and fun and opportunity. >>It's fun and chaos, you know, and yeah. Likeminded people and the team has really been the driving factor with our company. We are all very much excited about what we're doing and it's been driving us forward. >>Well, keep in touch. Thanks for coming on the cube and sharing, sharing a story with us in the world. We really appreciate we'll keep in touch with you guys. Do love what you do. Oscar ballet here inside the cube Argo verse eCommerce shop. The beginning of this wave is happening. The convergence of physical virtual is a hybrid mode. It's a steady state. It is not gonna go away. It's only gonna get bigger, more cooler, more relevant than ever before. Cube covering it like a blanket here in Monaco, crypto summit. I'm John furrier. We'll be right back after this short break.
SUMMARY :
I'm John feer, host of the cube, a lot of action happening presented by digital bits big tailwind acceleration around the idea of this new digital VI virtual hybrid and kind of how the experience goes forward. You're on the Solona blockchain. And a lot of convincing to do with their It's more of the servers, really? Well, an answer to that, cause some people say, So the scale of it is also way less important that what Facebook is trying to build. news, I saw the, you know, FTC moved against them on the acquisition of the exercise It's it's a tough, it's a tough battle for them. I'm not a big fan of what they did. Yeah. you know, and not really successful. They do have the, the means though, to maybe become successful with something. the startups like to get bought out. idea and maybe a product that is interesting for the metaverse be able to create this virtual storefront MOSCON and San Francisco, the San convention center in Las Vegas, that are interested in getting into the metaverse and we then design the shops. I mean, I mean, I can see the apple store saying, Hey, you know, they're pretty standard apple stores. It's like, oh I'm in at the dentist, I mean the brand will control the values. the price of whatever, because you know, it's Mickey mouse around you. I know the metaverse are gonna try to solve this. But it's definitely something that has been asked a lot by the brands where like we want to create, like, we want to release this store for the event with an idea. You're badging, you know, you're the gaming where we were talking earlier. And brands are interested in that. So I gotta ask you the origination And the whole idea beyond it is that NFT holders would have access So It's well too long of a lunch cuz you know, French would take what, two hour lunches. Yeah. That's wine, you know about creative, And today I'm here talking to you in this setting. And everybody is, is feeling like, you know, they're contributing to something new and that's, what's exciting about it. like certainly the gen Zs are like, I don't wanna reuse that old stuff. And the other pandemic is just it's it's been all about improving, always the secret to success. There's a fun and fun and opportunity. It's fun and chaos, you know, and yeah. Thanks for coming on the cube and sharing, sharing a story with us in the world.
SENTIMENT ANALYSIS :
ENTITIES
Entity | Category | Confidence |
---|---|---|
John | PERSON | 0.99+ |
Paris | LOCATION | 0.99+ |
France | LOCATION | 0.99+ |
ORGANIZATION | 0.99+ | |
Microsoft | ORGANIZATION | 0.99+ |
January | DATE | 0.99+ |
Monaco | LOCATION | 0.99+ |
Oscar | PERSON | 0.99+ |
two hour | QUANTITY | 0.99+ |
Las Vegas | LOCATION | 0.99+ |
apple | ORGANIZATION | 0.99+ |
San Francisco | LOCATION | 0.99+ |
OSCAR BELLEI | PERSON | 0.99+ |
today | DATE | 0.99+ |
John feer | PERSON | 0.99+ |
Leo | PERSON | 0.99+ |
ORGANIZATION | 0.99+ | |
iWatch | COMMERCIAL_ITEM | 0.99+ |
Palo Alto, California | LOCATION | 0.98+ |
Agoraverse | ORGANIZATION | 0.98+ |
Mickey mouse | PERSON | 0.97+ |
this week | DATE | 0.97+ |
iWatches | COMMERCIAL_ITEM | 0.97+ |
English | OTHER | 0.97+ |
John furrier | PERSON | 0.97+ |
5,000 NFTs | QUANTITY | 0.97+ |
Agora | ORGANIZATION | 0.96+ |
ORGANIZATION | 0.95+ | |
Monaco Crypto Summit 2022 | EVENT | 0.95+ |
Disneyland | LOCATION | 0.94+ |
FTC | ORGANIZATION | 0.94+ |
one | QUANTITY | 0.94+ |
one product company | QUANTITY | 0.94+ |
pandemic | EVENT | 0.93+ |
French | OTHER | 0.92+ |
February | DATE | 0.9+ |
15 | QUANTITY | 0.88+ |
Solona | ORGANIZATION | 0.87+ |
Lana | ORGANIZATION | 0.87+ |
apple store | ORGANIZATION | 0.85+ |
25 | TITLE | 0.83+ |
Salana | ORGANIZATION | 0.83+ |
Monaco | ORGANIZATION | 0.82+ |
wave | EVENT | 0.8+ |
Sims | TITLE | 0.79+ |
Fortnite | TITLE | 0.79+ |
Monaco crypto summit | EVENT | 0.77+ |
San convention center | LOCATION | 0.74+ |
first party | QUANTITY | 0.73+ |
triple | QUANTITY | 0.72+ |
Salala | ORGANIZATION | 0.72+ |
first class | QUANTITY | 0.7+ |
one trick | QUANTITY | 0.69+ |
Methodist | ORGANIZATION | 0.67+ |
ballet | ORGANIZATION | 0.66+ |
25 | QUANTITY | 0.64+ |
a Cub | TITLE | 0.62+ |
Sand | TITLE | 0.62+ |
Salina | ORGANIZATION | 0.6+ |
NFT | ORGANIZATION | 0.56+ |
metaverse | TITLE | 0.54+ |
Argo | ORGANIZATION | 0.53+ |
MOSCON | ORGANIZATION | 0.43+ |
Oscar | EVENT | 0.4+ |
Jason Kent & Shreyans Mehta, Cequence Security | CUBE Conversation May 2021
>>Mhm Yes. Welcome to this cube conversation. I'm john Kerry host of the cube here in Palo alto California. We've got two great guests all the way from Ohio and here in the bay area with sequence securities is our focus on cloud growth companies. Sri and met a co founder and CTO of sequence security and Jason Kent hacker in residence at sequence security. We're gonna find out what that actually means in the second but this is a really important company in the sense of A P. I. S. As they are starting to be the connective tissue between systems and and data. Um you're starting to see more vulnerabilities, more risk but also more upside. So risk, reward is high. And anyone who's doing things in the cloud obviously deals with the A. P. I. So Trey and Jason. Thanks for let's keep conversation. >>Happy to be here >>guys. Let's let's talk about A P. I. Security. And but first before we get there trans what does sequence security do? What do you guys specifically build? And what do you sell >>sequences in the business protecting your web and um A P. I. S from various kinds of attacks? Uh We protect from business logic attacks, A P. I. Uh do your api inventory, uh also the detect and defend against things like a town taker. Where's fake account creation, scraping pretty much anything and everything. An application on a PDA is exposed to from from the Attackers. >>Jason. What do you what do you do there as hacker and residents? I also want to get your perspective on api security from the point of view of, you know, uh attack standpoint from a vector. How are people doing it? So first explain what you do and uh love the title hacker and residents. But also what does that actually mean from a security standpoint? >>Yeah. So we can't be in the business that we're in without having an adversarial approach to where our customers are deployed and how we look at them. So a lot of times I spend my time trying to be on the client's backdoors and and try to hit their A. P. I. S. With as many kinds of attacks that I can. It helps us understand how an attacker is going to approach a specific client as well as helps us tune for our machine learning models to make sure that we can defend against those kinds of things. Um as a hacker and residents, my mostly my position is client facing. But I do spend an awful lot of time being research and looking for the next api threat that's out there. >>You gotta stay ahead of the bad guys. But let's bring up some kind of cutting edge relevant topics. One is all over the news cycle. You heard peloton, very highly visible company, It represents that new breed of digital companies that have a new approach and it's absolutely doing very, very well. The new consumers like this product and you're seeing a lot more peloton, like companies out there that are leveraging technology, so they're fully integrated, they had an A. P. I. Issue recently. Um what does it mean? Is that, is that something we're gonna see more of these kind of leaks in these kind of vulnerabilities? What do you guys think about this political thing, >>You know, from an attacker's perspective as a really boring attack? Um, but it led to a huge amount of data leaking out. Same with, you know, the news has been been right with this lately, right, john Deere got hit. Um We've seen yet another credit bureau got hit right. Um and these attacks are coming off as fairly simple attacks that are dumping huge amounts of data, just proving that the FBI attack surface is really a great place to get a rich amount of data, but you have to have a good understanding of how the application works so you can spend a little bit of time on it. But once you've taken a look at how the data flows, you end up with, you know, pretty rich data set as an attacker. I go after them just by simply utilizing their products, utilizing the programs and understanding how they work. And then I drag out all the pieces that I think are going to be interesting and start plucking away at it. If I see a like a profile, for instance, that I can edit, I wonder can I edit someone else's profile. And this is how the peloton attack work. I'm logged in, I'm allowed to see my things, what other things can I see? And it turns out they can see everything. >>So we also saw a hack with clubhouse, which is the hot app now I think just opened up to android users, but they were simply calling it back and Agora, which is, you know, I've seen china, but once you've understood that the tokens work, once you understood what they were doing, you could essentially go in and figure things out. There seems to be like pretty like trivial stuff, but it gets exposed. No one kind of thinks it through. How does someone protect themselves against these things? Because that's the real issue, like just make it less secure. Our Api is gonna be more secure in the future. What can customers do about what do you guys to think about this? >>Yeah, but the reality is, I mean that's just uh too many babies out there. I mean if you see the transition that is happening and that is the transformation where it used to be like a one app or two apps before and now there are like hundreds and thousands of applications driven by the devops world, a child development and and what matters is, I mean the starting point really is you cannot protect what, you cannot see what used to be. Uh an up hosted in your data center is now being hosted in the cloud environments, in the virtual environments, in several less environments and coordinators, you name it, they're out there. So the key is really to understand your attack surface, that's your starting point. So you're you're tooling your applications need to uh I need to be able to provide that visibility that that that is needed to protect these applications and you can't rely just on your developers to do this for you. So you need a right tool that can secure these applications, >>Jason what's the steps that an attacker takes to uncover vulnerabilities? What goes through the mind of the attacker? Um I mean the old days you used to just do port scans and try to penetrate you get through the perimeter. Now with this no perimeter mindset, the surface area Schramm was talking about is huge. What what's going on the mind of the attacker here and the A P I S and vulnerabilities. >>So the very first thing that we do is we sign up for an account, we use the thing, right? We look at all the different endpoints. Um I've got scripts running in my attack tools that do things like show me comments uh in case the developer left some comments in there to tell me where things are. Um I basically I'm just going to poke around using it like a regular user, but in that I'm going to look for places. That makes sense to try to do an attack. So the login screen is a really easy thing. Everybody understands that you put in a user name, you put in a password, you can't go. What I'm gonna do is put in a bad username and a bad password. I'm gonna put in a good user name and a bad password and I'm gonna see what changes, what are the different things that your application is telling me. And so when we look at an application for flaws and ways to get to the data on the back end, all we're doing is seeing what data do you present me on standard use. And then I'm going to look at, well, how can I change these parameters or what are the things that I can change in my requests to get a different response? So in the early phases of an attack, Attackers are very difficult to a seat. Right. They just look like a regular user just doing regular things. It's when we decide. All right. I've found something that starts to get actually interesting and we start to try to pull data out. >>What are some of the common vulnerabilities and risks that you guys see in the A. P. I is when you look when you poke at them that people are are doing is that they're not really doing their homework. Doing good. Security designers are just more of tech risk. What's the most common vulnerabilities and risks? >>Well, so for me, I I've noticed a lot of the OAS KPI top 10, the first couple of things you see them on almost all applications, so broken object level authorization is the first one. It's mouthful. Um but basically all it is is I log onto the platform, I'm authorized to be there, but I can see someone else's stuff and that's exactly what happened in peloton. Um that and what we call insecure direct object reference where I don't have to be logged in, I can just make the request without any authentication and get information back. So those are pretty common areas um that you know people need to focus on, but there's a few others that are outside the top 10 that really make a lot more sense as a defender strains probably has a little better answer to me. >>Yeah. So um I'm like like we said um creating that inventories is key, but where are they being hostess? Another another aspect of things. So so when when Jason spoke about um like hackers are actually probing, trying to figure out what are the different entry points? It could be your production environment, it could be your QA environment staging environment and you're not even aware of, but once you've actually figured out those entry points, the next step of attack was like at peloton and and other places is really eggs filtering. Exfiltrate ng that that information. Right. Is it, is it the O P II information, ph I information um and and you don't want to exfiltrate as a hacker, just one person's information. You you're automating that business logic that is behind it ability to protect and defend against those kinds of attacks, giving that visibility, even though you might not have instrumented that application for for that kind of visibility is key. Once you are bubbling up those behaviors, then you can go ahead and and and protect from these kinds of attacks. And it could be about just simply enumerating through I. D. S. Uh that paladin might have or uh experience might have and just enumerate through that and exfiltrate the information behind it. So the tools need to be able to protect from those kinds of attacks out there. >>Yeah, I think I was actually on clubhouse when um that went down that hole enumerating through the I. D. S. Room I. D. S. And then the people just querying once they got an I. D. They essentially just sucked all the content out because they were just calling the back end. It was just like the most dumbest thing I've ever seen, but they didn't think about, I mean, you know, they were just rushing really fast. So So the question I have for transit and on a defense basis, people are going first party um with a P. I. S. A. P. I. First strategies because it's just some benefits there as we were talking about what do I need to do to protect myself? So I don't have that clubhouse problem or the pelton problem. Is there a Is there a playbook or is their software tools that I could use? How do I build? My apologies from day one and my principles around it to be good hygiene or good design? What's the what's the >>yeah. So aPI security is sort of a looking uh less known given that it's constantly evolving and changing. And the adoption of A P. S. Have gone up significantly. So what you need to start with effectively is the runtime security aspect of things. When a an aPI is live, how do I actually protected? And it ranges from simple syntactic protection things around people. Can can go ahead and break these ap is by providing sort of uh going after endpoints that you don't think exist anymore or going after certain functions by giving large values that they're not sort of coded to accept and so on so forth. Once you've done that runtime protection from a syntactic aspect, you also need to protect from a business logic aspect. I mean, mps will will expose uh information, interact with the customers and partners, what what business logic are they actually exposing and how can it be abused? Understanding that is another big aspects and then you can go ahead and protect from a runtime uh from a long time security perspective, once you've done that and understood that, well then you can start shifting lap things, invest in your uh sort of uh Dass tools or static analysis tools which can catch these things early so that they don't bubble up all the way, but none of them are actually silver bullets, right? So that you have a good uh time security tools, so I don't need to invest in dust or assessed whatever I have invested in my shift left aspect of things and uh and nothing will flow through. So you you need to start shifting left uh but covered all your bases properly, >>you can't shift left, there's nothing to shift from. I mean if you don't have that baseline foundation, what does that even mean to shift left and get that built into the Ci cd pipeline? So that's a great point. How does how does someone and some companies and teams set that foundation with the run time? Do you think it's a critical problem right now or most people are do a good job or they just get get lazy or just lose track of it or you know what, what's what's the common um, use case? Do you see behavior behaviorally inside these enterprises? >>Yeah. So what, what we're seeing is adoption of new technologies and environments um, and they're not um, well suited for the traditional way of doing that time. Security. Like if if you have an app running in your kubernetes environment, if you have an app running in in in a serval less environment, how do you actually protected with the traditional appliance based approach? So I think being able to get that visibility into these environments, understanding the the user behavior, how these applications are interacted with being able to differentiate from that uh, normal human behavior or even sometimes legitimate automation uh from from the malicious intents or or the the probing and the business logic attacks is key to understanding and defending these applications. >>Before we wrap up, I want to just get your expert opinion since you guys are both here around, you know, the next level of of innovation. Also you got cloud public cloud showed us a P. I. S are great. Now you're starting to see cloud operations, they call day two operations or whatever you call it A IOP. There's all kinds of buzz words are for it, but hybrid cloud and multi cloud, Edge five G. These are all basically pointing to distributed computing systems, basically distributed cloud. So that means more A P. I. Is gonna be out there. Um So in a way the surface area of a piece is increasing. What's your what's your view on this as a market? I mean, early days developing fast and what's, what's the, what's the landscape look like? What do you guys see from a attack and defense standpoint? >>Well, just from the attacker's perspective, you know, I see a lot more traffic going, what we call east west traffic, where it's traveling inside the application, it's a P is feeding a ps more data. Um, but what is really happening is we're trying to figure out how to hook third parties into our api is more and more. The john Deere attack was just simply their development api platform that they open up for other organizations to integrate with them. Um, you know, it's, it's very beneficial for John Deere to be able to say I planted this seed at an inch and a half of depth and later, uh, I harvested 280 bushels of corn off that acres. So I know that's perfect. I can feed that back to my seed guy. Well that kind of data flow that's going around from AP to AP means that there's far more attack surface and we're going to see it more and more. I I don't think that we're going to have less Ap is communicating in the near future. I think this is the foundation that we're building for what it's gonna look like for almost every business in the near term. >>I mean this is the plumbing of integration. I mean as people work with each other data transfer, data knowledge format, you mentioned syntax and all these basic things in computer science are coming to A PS which was supposed to be just a dumb pipe or just, you know, rest api those glory days now it's not there. They're basically, it's basically connections. >>Yeah. You're absolutely right. John, I mean like what Jason mentioned earlier, uh, in terms of the way the A. P. I. S are going to grow and the bad guys are going to go after it. You need to think like a bad guy, what are they going to go after? Uh, these assets that are going to be in the cloud, in your hybrid environment, in in your own prem environment. And, and it's, it's a flip of a switch where an internal API can be externally exposed or, or just a new api getting rolled out. So all those things you need to be able to protect, um, and get that visibility first and then being then protect these environments. >>That's awesome. You guys represent the new kind of company that's going to take advantage of the cloud scale and as people shift to the new structural change and people are re factoring security, This is an area that's going to be explosive in development. Obviously the upside is huge. Um Quickly before to end, you guys take a minute to give a plug for the company. Um This is pretty cool. I love love what you guys do. I think it's very relevant and cool at the same time. So sequence security. What are you guys doing funding hiring? What's the plug? Tell folks about it. >>Yeah. So uh we we we started about six years ago but we like starting in the the body defense space by focusing on obscenity ice. And from then we we've grown and we've grown significantly in terms of our customer base, the verticals that we're going after in financial retail social media, you name it, we are there because pretty much all these these uh articles depends on A. P. I. S. To interact with their customers. Uh We've we've raised our cities we last year we've we've grown our customer base. Uh Just in the last year when there was a lockdown people were all these retailers were transforming from brick and mortar to online. Social media also also grew and we grew with them. So >>Jason your thoughts. >>I think that sequence is his ability to scale out to any size environment. We've got a customer that does a billion and a half transactions a month. Um That are ap is from 1000 other clients of theirs. Being able to protect environments that are confusing and cloudy like that. Um Is really it makes what we do shine. We use a lot of machine learning models and ai in order to surface real problems. And we have a lot of great humans behind all of that, making sure that the bad guy maybe they're right now, but they're going away and we're going to keep them away. >>It's super, super awesome. I think it's a combination of more connections, distributed computing at large scale with a data problem. That's, that's playing out. You guys are solving great stuff and hey, you know when the cube studio ap I gets built, we're gonna need to call you guys up to to help us secure the cube data. >>Absolutely right. Absolutely. >>Hey, thanks for coming on the q Great uh, great insight and thanks for sharing about sequence. Appreciate you coming on, >>appreciate the time. >>Okay. It's a cube conversation here in Palo alto with remote guests. I'm john for your host. Thanks for watching. Yeah.
SUMMARY :
all the way from Ohio and here in the bay area with sequence securities is our focus on And what do you sell sequences in the business protecting your web and um A P. from the point of view of, you know, uh attack standpoint from a vector. for our machine learning models to make sure that we can defend against What do you guys think about this political thing, just proving that the FBI attack surface is really a great place to get a rich amount of data, that the tokens work, once you understood what they were doing, you could essentially go in and figure things I mean the starting point really is you cannot protect what, Um I mean the old days you used to just do port So the very first thing that we do is we sign up for an account, we use the thing, What are some of the common vulnerabilities and risks that you guys see in the A. P. I is when you look when you poke at them that people are 10, the first couple of things you see them on almost all applications, so broken and and you don't want to exfiltrate as a hacker, just one person's information. like the most dumbest thing I've ever seen, but they didn't think about, I mean, you know, So what you need to start with effectively is the runtime security aspect of things. I mean if you don't have that baseline foundation, or the the probing and the business logic attacks is key to What do you guys see from a Well, just from the attacker's perspective, you know, I see a lot more traffic going, are coming to A PS which was supposed to be just a dumb pipe or just, you know, rest api those glory days So all those things you need to be able to protect, I love love what you guys do. Uh Just in the last year when there was a lockdown making sure that the bad guy maybe they're right now, but they're going away and and hey, you know when the cube studio ap I gets built, we're gonna need to call you guys up to Absolutely right. Appreciate you coming on, I'm john for your host.
SENTIMENT ANALYSIS :
ENTITIES
Entity | Category | Confidence |
---|---|---|
Jason | PERSON | 0.99+ |
john Kerry | PERSON | 0.99+ |
John | PERSON | 0.99+ |
Ohio | LOCATION | 0.99+ |
Jason Kent | PERSON | 0.99+ |
May 2021 | DATE | 0.99+ |
FBI | ORGANIZATION | 0.99+ |
two apps | QUANTITY | 0.99+ |
280 bushels | QUANTITY | 0.99+ |
last year | DATE | 0.99+ |
Shreyans Mehta | PERSON | 0.99+ |
android | TITLE | 0.99+ |
first one | QUANTITY | 0.99+ |
Palo alto California | LOCATION | 0.99+ |
china | LOCATION | 0.99+ |
second | QUANTITY | 0.99+ |
Sri | PERSON | 0.99+ |
first | QUANTITY | 0.98+ |
both | QUANTITY | 0.98+ |
one app | QUANTITY | 0.98+ |
first couple | QUANTITY | 0.98+ |
Schramm | PERSON | 0.97+ |
first thing | QUANTITY | 0.97+ |
John Deere | ORGANIZATION | 0.96+ |
day one | QUANTITY | 0.96+ |
Palo alto | LOCATION | 0.95+ |
two great guests | QUANTITY | 0.95+ |
First strategies | QUANTITY | 0.95+ |
one person | QUANTITY | 0.94+ |
hundreds and thousands of applications | QUANTITY | 0.94+ |
a billion and a half transactions a month | QUANTITY | 0.94+ |
top 10 | QUANTITY | 0.93+ |
about six years ago | DATE | 0.93+ |
Trey | PERSON | 0.92+ |
Api | ORGANIZATION | 0.92+ |
first party | QUANTITY | 0.86+ |
top 10 | QUANTITY | 0.85+ |
john | PERSON | 0.85+ |
One | QUANTITY | 0.85+ |
an inch and | QUANTITY | 0.83+ |
1000 other clients | QUANTITY | 0.78+ |
I. D. S. | LOCATION | 0.78+ |
two | QUANTITY | 0.76+ |
A. P. I. | ORGANIZATION | 0.7+ |
john Deere | PERSON | 0.69+ |
babies | QUANTITY | 0.64+ |
Agora | TITLE | 0.63+ |
uh time | ORGANIZATION | 0.57+ |
minute | QUANTITY | 0.56+ |
A P. | ORGANIZATION | 0.52+ |
day | QUANTITY | 0.51+ |
john Deere | ORGANIZATION | 0.49+ |
OAS | ORGANIZATION | 0.47+ |
a half | QUANTITY | 0.47+ |