Skip to content
InTechnology Podcast

#91 – The Friendly Hacker: Keren Elazari’s Cyber Career

In this episode of Cyber Security Inside, Camille and Tom dive into the background and career development of Keren Elazari, The Friendly Hacker. The conversation covers:

  • How Keren got into hacking, and how her interests changed to friendly hacking over time.
  • The different varieties of hacking and how someone might get involved or choose a path in the profession.
  • Who has inspired Keren throughout her career, and how the diversity in the field of cybersecurity has increased significantly.
  • Advice for someone wanting to get started in hacking and cybersecurity.

And more. Don’t miss it!

The views and opinions expressed are those of the guests and author and do not necessarily reflect the official policy or position of Intel Corporation.

 

Here are some key takeaways:

  • Keren Elazari became interested in computers at a very young age, using the school computers and robotics lab to learn more. This is how she became inspired.
  • She truly wanted to learn and find out more about the world. But sometimes, information was hidden behind passwords, so she taught herself how to access that information. 
  • Her first inspiration to become a hacker was Angelina Jolie in a movie where she portrayed a high school hacker. The cast was a group of people that was diverse and that became heroes in their own story, and she could see herself in the characters.
  • From there, Keren was to be drafted into the military (there is a mandatory draft in Israel). When asked what she would be good at, she said she wanted to be a hacker for the army. She was sent to the Communication Security Department in the military.
  • This is the first time she saw the opportunity as a hacker to protect things, not just break them. She learned how to use her skills in a structured environment, and to embrace both the protecting and the breaking.
  • Keren has found herself in several situations where she was one of very few women in the room. A hacking conference, a role in the military. However, she was always able to find a role model or a connection with someone and show her talent.
  • Hacking requires a curious mindset. A mind that asks questions, that takes things apart, that pokes holes. And there are ways to cultivate that mindset with puzzles, challenges, and exploration. It also requires technical knowledge, of course.
  • Just like in the medical field, there are many specialities and types of hacking. You can generalize, and you can specialize, but you are exposed to various things along the way. The key is: what grabs your attention?
  • The makeup of people in cybersecurity has changed significantly over time. There are more women and more diversity in general in the cybersecurity field.
  • Recently, Keren has been working in bug bounty research. This is when any company of any size can work with hackers all over the world to raise security across the board. She is also working on a course for students going into management professions to have a security mindset.
  • What has surprised Keren about hackers recently? That they went after systems like healthcare during the pandemic. Although they go where the money is, the lack of ethics was surprising during a time when we needed healthcare so desperately.
  • Security is not about the destination. We will never get to a place where we are done, or that we win. There will always be a new vulnerability and a new criminal business model. However, Keren is optimistic because for the number of criminal hackers out there, there is a large number of friendly hackers helping fight.
  • The Leading Cyber Ladies network is working hard to introduce women to cybersecurity and friendly hacking. Keren recommends that no matter who you are, if you are interested in hacking you should reach out to your local events and meetups.

 

Some interesting quotes from today’s episode:

“As a girl, instead of a bedtime story, I would read the encyclopedia. True story! That’s how much of a nerd I am. And I had so many burning questions that when we received access to the internet in Israel – which happened around 1993 – it was amazing! It was like the world’s largest encyclopedia.” – Keren Elazari

“I had to teach myself how to access all of that information. And to me, it wasn’t a criminal act, it was a really passionate curiosity. I never for once realized that what I was doing could be illegal or wrong.” – Keren Elazari

“It was a group of people that represented hackers, but they looked like all kinds of people. And it really captured my imagination that high school kids could become the heroes of their own story through hacking. So that’s when I realized this is what I am. This is what I want to become. This is the world I belong in. It’s the world of hackers.” – Keren Elazari

“I had to learn how to use it to protect systems and not just break things. I was much better at breaking things and poking holes in systems than I was at building secure systems. And through the military service I had to practice both of those mindsets.” – Keren Elazari

“It was quite equalizing, because as a woman, I was serving with other young men and women. And it wasn’t about my gender in that particular role. It was just about the talent and the passion that everybody could bring to the job. And oftentimes I would be the only woman in the room or the youngest person in the room, or both. And I believe that through my passion for technology, I was able to overcome those odds and present a point of view that hacking is valuable and the hacker mindset is valuable.” – Keren Elazari

“I have more than 25 yeras of perspective in the cybersecurity world. The days of when I was the only girl there, those days have absolutely changed. Nowadays I see women all across different positions in cybersecurity; whether it’s entry-level positions, students at Tel Aviv University where I’m a researcher, or at different parts of our community… I see women all across the cybersecurity realm.” – Keren Elazari

“I do believe that we need all the help we can get. That security is a team sport. It’s not just up to one government agency or a technology company to solve on their own. My vision for the security world is one of a digital immune system where hackers play their part by helping identify vulnerabilities.” – Keren Elazari

“That’s the challenge, I think, with cybersecurity. We have to really keep our optimism… Cybersecurity and achieving security, it’s not a destination. It’s not a train that you get on, and then at the end, you say ‘I’m secure. I’m done.’ It’s a journey that’s continuous.” – Keren Elazari

Share on social:

Facebook
Twitter
LinkedIn
Reddit
Email

[00:00:38] Camille Morhardt: Welcome to What That Means, I’m Camille Morhardt.  And thanks for joining me for part 2 of our discussion on Non-Fungible Tokens – better known as NFTs.  If you missed Part 1, I suggest you go back and listen or watch that episode first so you can get a good grounding in what NFTs are.  As in Part 1, my guest is Mic Bowman, a Senior Principal Engineer at Intel Labs who runs the Trustworthiness Distributed Systems lab. For part two of our conversation, the talk turns to potential uses of NFTs beyond artwork, video clips or collectibles.

[00:01:18] Mic Bowman: Let’s speculate outside of media. Let’s say that what I want to do is create a trained machine learning model. I’ve got a classifier, right? And it does some really cool things, and I’m going to create an NFT for that. You buy the classifier and now you can use that classifier in your application. And if I do it right, maybe I can allow you to use the classifier, but you don’t have the right to see the model that’s inside the inferencing engine.

But you have some additional data and you take the original model that I gave you and you add your data and you retrain that model. So it’s a better classifier, right? And then you turn around and sell it, your new model. We could create a marketplace for those kinds of things, where even though you’ve created this new model, I get a portion of the sales when you sell yours, because I contributed to yours.

Those new ideas for what constitutes ownership and monetization and what is an economy is in this space. That’s the power of the NFT, that transactions can get a whole lot more interesting than me giving you $3 for a cup of coffee. There’s a lot more that can be about inside those transactions.

So, back to the technology. NFTs are really boring, it’s an identifier and an owner that goes along with it. But the interesting part is that we can expand that transfer operation to do a lot more interesting stuff, that it really is a smart contract. And that means that we can code entirely new behaviors in ownership transfer. It also means that we can define new ways for determining what ownership pose. 

[00:03:11] Camille Morhardt: Okay. Say more about that. How was ownership changing? 

[00:03:16] Mic Bowman: So let’s go back to an image, right? When you purchase an image, I’ve got a painting on my wall that I have, what am I allowed to do with that? Well, I can actually turn around and resell the physical art that way, but I have not purchased the copyright to that image for it, but with an NFT it might be possible to encode in that the right for me to purchase, not just the art, but to purchase the copyright that goes along with the art. There was one company that was talking about taking all of their patents, creating NFTs for the patents. And ownership of the NFT would convey certain rights to use the intellectual property that was part of the patent that way. So there becomes a very concrete license for what you can do with this idea that’s been patented. We can code up in these smart contracts simple licenses, complex licenses, or in some cases, no licenses at all for it. We can encode sort of downstream transactional value and derive the value of derived products from it, all of this can be encoded in the smart contract that goes along with the NFT. 

[00:04:39] Camille Morhardt: And part of the benefit of the smart contract is it self polices in a sense. How are you ever going to get something back if it’s stolen or you misused. It’s like good luck, but you’re saying you’re going to code it in so it may… 

[00:04:55] Mic Bowman: It doesn’t right. I mean, ownership, the NFT does, but recall what we said is that the asset is the separate thing out here, the picture. I may try to resell the picture, even though the NFT doesn’t necessarily give me the rights to do that. And honestly that distinction between the two and sort of these open markets, maybe the biggest barrier in extending NFTs out into new assets.

We do it right now. I mean, these things work really well with media right now because there’s some standard. External recourse through copyright law, that sort of sets what you can and can’t do with things. There’s some fairly standard creative commons licenses that define some basic sets of rights for access to simple media.

But as we extend these things out and start representing complex things like patents, for example, or there were a couple of bizarre things that have shown up recently, there was a woman who was selling eggs for an in-vitro fertilization through an NFT, which has got to be the most bizarre thing I’ve seen in the space so far. We don’t know what rights ownership of the NFTs actually conveys. That one to me feels like there’s a set up for some really complicated legal discussions about what constitutes ownership and the rights to define that. 

[00:06:25] Camille Morhardt: Wouldn’t it just kind of follow like stock market and rights to portions of securities. 

[00:06:33] Mic Bowman: those are well-defined by the government has really well-defined those and what the ownership parts of it are, but people are throwing stuff out and random ways about what they’re trying to get access to, and they’re doing it without any sort of standard legal vernacular to apply to those transactions in those relationships. 

[00:06:56] Camille Morhardt: To venture out on the like extreme speculative side of things here. We have all kinds of data that’s been collected through internet of things. And obviously some of that data or much of the data has privacy concerns, but let’s talk about data that’s just valuable information for people like sensor data of anything, whether nutrients in the soil, anything like that. Nobody has really a mechanism to release because they’re not going to gain anything from it. I know we’re way out in the future and we’re speculating, but can you let us know about how NFT might change something like that? 

[00:07:38] Mic Bowman: So again, we were talking about some of the kind of excitement what NFT facilitates that way. And to me, in some sense, this is the most exciting and most speculative kind of aspect and usage for NFT is can we really start to monetize the data?

As you pointed out, we have sensors collecting information in so many different ways. But the cost of getting that data to an open market of individuals who might find it valuable is just prohibitive right now. And so if we can find a way of connecting data providers or data creators to those who want to consume the data again, through some kind of an open market; that begins to justify the collection and publication of things we would not have done before. On the social good side of things, it opens us up to the potential for doing much more interesting queries over sort of large collections of information. Things like if a vineyard decides that they’re going to export the information about the soil type and climate information and how they manage the grapes and what the yield was that was collected as a result of their management type. That information suddenly becomes useful to somebody else who is trying to potentially start a new field. Can I find others that have done similar things, so I can configure mine in a way that will optimize the yield and the quality of the grapes that I’m getting. In individual vineyard the value of that data is disproportionately small to the cost of making it available. But if we can now start to create these NFTs around it, if there’s a way for us to tokenize that data, now we can create this marketplace and potentially make consumers of the data connected to the providers of the data in a way that justifies collection of and publication of that data. And that would be really exciting. 

[00:09:53] Camille Morhardt:  It’s interesting because it’s making me think about people who put up a YouTube of something that they’re doing. And if somebody else finds it valuable or many, many people find it valuable eventually whoever posted the video that who received nothing from it at the time becomes monetized and now, or they have a following and then somehow they get to monetize and make money contingent on the number of people who like it and they’re not in charge of the content. You’re not pairing people together, you are now getting advertisers involved or platforms involved.

I think what you’re talking about is a bit of a paradigm shift might be a little strong, but you’re talking about this decentralized way of connecting the content producer with the current consumer. 

[00:10:43] Mic Bowman:Yeah, exactly. And I love the YouTube analogy, right? Because what YouTube did by making it easy to publish videos is that it makes everyone who’s got some expertise an opportunity to monetize that expertise either through advertisements or subscriptions or whatever. When we collect data right now, there’s no easy way for us to get the value back for the data that we’re collecting. If there was some opportunity to make it as easy to collect the value on the data, as it is to get value for our expertise through YouTube, then maybe we would see a lot more people collecting more information and sharing it, which means that we will get a better understanding of what’s happening.

[00:11:25] Camille Morhardt: You have to also agree that this could be frightening. 

[00:11:29] Mic Bowman: It’s terrifying, actually. The biggest barrier for me on the technical side is how do we make it possible to do this monetization of data and preserve the appropriate use of that data? And there are some technologies that we could bring to bear on it, but it’s very much an open question. This is why we do research and forward-thinking and development in this space. 

[00:11:58] Camille Morhardt: Pay attention to the ethics side and the privacy side.  

[00:12:01] Mic Bowman: Absolutely you have to. 

[00:12:04] Camille Morhardt: I want to ask two questions on the security side. One is how do you protect your NFT? And the other one is more interesting to me; are NFTs going to allow us to protect things differently than we’ve been able to in the digital word.

[00:12:21] Mic Bowman: Protection is an interesting word. The NFTs themselves, to a certain degree, don’t need to be protected. They are a very standard representation, they’re well-defined with the smart contract platforms that we have and to a certain degree, every one of these new marketplaces that builds their own blockchain around it is defining a certain set of rules for it, they’re all trying to be relatively public about what transactions and exchanges mean? So the NFT part of it is not that interesting to me. It’s how do you protect the asset that goes along with it? So let’s go back to that classifier. I give you a model that has been trained by some machine learning algorithm. That model may have confidential information and what I give you is the right to use this model to do interesting inferencing and potentially to derive new models. It doesn’t mean that I’ve given you the right to see all the data that went into training, the model that I gave you. So how do I protect that? How do I prevent you from taking this interesting asset, copying it out and then selling it independently without giving me my cut of the derived goods? 

[00:13:37] Camille Morhardt: I’m also saying you may have personal information or private privacy concerns. 

[00:13:43] Mic Bowman: Exactly, or things that have been derived from that.  And right now the answer is we just don’t do it if there’s going to be private information in there, which is a very safe thing to do that’s appropriate.

But if we have technologies that allow us to protect the confidentiality of it and whether that’s zero-knowledge proofs or homomorphic encryption or trust that execution environments or whatever. Are there ways that we can protect the intellectual property and those assets to create digital scarcity and to protect the assets more rigidly than we currently have, more formally than what we have with existing kind of media parts of it. If we can do it, that opens up some doors for some really interesting new applications for NFTs that we can create new markets for data, not just for media.

[00:14:37] Camille Morhardt:  I have heard of scenarios where it’s at least being explored that NFTs are helping verify the authenticity of a physical object. I heard Nike does it for sneakers to verify that there are certain kinds of sneakers.

[00:14:58] Mic Bowman: Let’s be a little careful to differentiate between the NFTs which are the kind of tradable representation and having a serial number registered in a blockchain or in a database someplace. I think we’ve talked about this last time that there were a couple of times to do diamond registries where you could actually add some identifier and the diamond and then you could track its progress. There are already systems to be able to do that, you don’t need an NFT in order to track the uniqueness of shoes. What you need is a way of creating a unique identifier in the shoe, and then registering that identifier someplace else. 

[00:15:42] Camille Morhardt: But that could create the need for digital items or digital assets to self-generate IDs that are non vulnerable, non hackable, 

[00:15:55] Mic Bowman: Do we have the ability to generate unique identifiers? Yes. Do we have an ability to generate unique identifiers that are unforgeable for physical goods? It’s not all that easy, but it can be done. Do we need NFTs in order to make those unique identifiers? Yes, it might be a nice way to do it, especially for thinking about moving into these secondary markets. But if you buy a pair of Nike shoes and I buy those Nike shoes from you and somebody else wants to buy them from me and verify that they are a unique real Nike product unless when I bought them from you, we did an NFT transaction that transferred ownership then what’s the point? 

There’s a lot of this stuff about, we know how to trade NFTs. But we don’t necessarily know how to update the NFT as we trade the physical goods. There’s a new space of digital twinning where you’re binding a physical object to a digital representation of that. And the synchronization of those two in a continuous synchronization of those two, if you build it that way can be done. But for a lot of these physical goods, if you’re not building it that way, it’s going to be really hard to maintain those relationships. 

[00:17:25] Camille Morhardt: Well, okay, that’s one of the hottest topics in NFTs right now. Are there any other kind of barriers or major things that people are arguing about? 

[00:17:38] Mic Bowman: We just talked about interoperability as being one of them, partial ownership is another thing. And you can kind of understand that again from an investor’s viewpoint, rather than an owner.

What does partial ownership of an image mean from a practical terms? Does it mean I own a slice of pixels out of that image? What can I do with that slice of pixels? I don’t know. Right? I mean, there’s that part of it. But if I’m treating the NFT as a security in which I am purchasing it for an investment for resale, then partial ownership is a very interesting concept. Especially when these NFTs are going for a hundred thousand dollars, and being able to get into the NFT marketplace becomes so expensive. So in those situations, how a collective goes together to purchase the NFT, that becomes important as the values are going up.

[00:18:32] Camille Morhardt: A most basic question is which is why create scarcity when it’s not needed? Why create digital scarcity? Anything digital can be reproduced essentially for free. Forever. So why create the scarcity? 

[00:18:55] Mic Bowman: Can we make digital assets that can’t be copied arbitrarily? That is an interesting question here that that supports the scarcity, but why scarcity is valuable because it makes them collectible it’s back to that Onus Wagner card. What makes that card valuable is that there were only a very, very small number of them originally produced. And Onus Wagner happens to be a really good, popular baseball player.

And my understanding is that the card came out before he became a popular baseball player. And there were certain mistakes made in the card run. Whatever it is, there are very, very few of this particular card, as opposed to some mass-produced card. Even though it’s 110 years old, a mass produced card because they’re available the marketplace doesn’t support high value.

[00:19:53] Camille Morhardt: It’s just the human nature of valuing what’s scarce, we’re going to create that in the digital world so that we can essentially replicate the system of trading money value as we know it, but in the digital space as well. 

[00:20:10] Mic Bowman: And there’s all the sociology and psychology that goes behind possessing something unique. The whole point is that we can own something that nobody else does or that very, very few other people do. What is the cost or what is the value to you of owning that thing? In some cases it’s like owning a Monet, what’s the value of owning the original Monet?

It’s a painting, right? And I can get digital prints that are very, very good copies of that Monet. But owning the digital print is not owning the Monet. The digital print may look just as good on my wall, but it’s not a Monet. It’s not the original Monet. The print on my wall is worth $25 bucks. The Monet, the painting Waterfront just sold at Christie’s for what, $60 million or some ridiculously high number. It’s worth that much to somebody. Is it worth it because they are a collector. Is it worth it because they value seeing the paintbrush strokes on the Monet? I don’t know. Those are good questions and probably all of them are a little bit true. 

[00:21:20] Camille Morhardt: All right. Thank you, Mic. Good conversation. I appreciate it. I feel smarter and also have 25 more questions than I came in with. 

[00:21:31] Mic Bowman: It is a very exciting space.  I’m really excited to see what happens over the next few years as we start to realize more value. 

[00:21:39] Camille Morhardt: Thanks again for your time. 

[00:21:40] Mic Bowman: Thanks Camille.

[00:21:42] Camille Morhardt: Thanks again for joining me for our two-part look at NFTs.  Again, if you missed part 1, I suggest you check it out because Mic gives a good explanation of what NFTs are and we explore the nuances of what people are actually buying when they purchase an NFT and what they can and can’t do with it.  Thanks for listening.

 

Stay tuned for the next episode of Cyber Security Inside. Follow @TomMGarrison and Camille @Morhardt on Twitter to continue the conversation. Thanks for listening. 

The views and opinions expressed are those of the guests and author, and do not necessarily reflect the official policy or position of Intel corporation.

More From

#103 – What That Means with Camille: Interactive AI (NLP)

#102 – Cloud Security: Resiliency and Shared Responsibility

#101 – How to Protect Against Cyber Attacks? RSA Panelists Say Collaboration