The setup / genesis
It started with Craig Schultz and Jeffrey Starr reaching out about a trip to Pacific Northwest National Laboratory, PNNL, with a delegation. The aim was the kind of thing Craig, Jeff, and Mike specialized in, commercializing federally developed technology out of a national lab. My flight was to Pasco, WA, the Tri-Cities airport, PSC, that serves PNNL and Richland. I flew out Aug 12, 2012, and returned Aug 14, 2012.
The delegation was Craig Schultz, Jeffrey Starr, Michael “Mike” Lyons, me, and Andre Gironda. Mike, of Stanford, specialized in building commercial firms by licensing federally developed technology. Andre was someone I tapped again. I bought his ticket out of Phoenix, PHX to SFO to Pasco, and flew up myself from SFO.
At PNNL the group met with lab staff who had built something remarkable: a single 4U server, packed with compute, that emulated the complete computing systems of a nuclear submarine. It was for scenario-based training. It could emulate any station or control on the sub, and could be driven standalone or wired into a physical mockup.
Mike Lyons opened the floor with the commercialization question. What could we do with this in the commercial space? The group bounced ideas around, and Andre Gironda landed the one that mattered. His idea was a MILDEC-style system, MILDEC being military deception, that could emulate the resources of a corporate or other environment at scale. It would be a giant honey-trap to lure in threat actors and live compromises while capturing their TTPs and tradecraft. My genuine belief is that Andre is the originator of at-scale environment-emulation-as-deception in cybersecurity. The internal roadmap shows the platform already underway by late 2011, building device and network simulators and an emulated “World View”. So the concept’s genesis traces to the ~2011 timeframe, and the Aug 2012 PNNL trip is the hard-dated point I remember within that arc.
What I built / did
Two firms came out of the lab-commercialization effort. One I can’t recall. The other became the ZanttZ / Shadow Networks deception business, and Andre and I were both involved in the development.
My technical contribution borrowed the model from my HP key-injection work. I showed how they could boot up Windows hosts and make a handful look like hundreds, each booting with their app exposing fictional services that looked and responded like the real thing. The result was a convincing, populated fake environment rather than a lone honeypot. Andre worked the network detection and routing pieces, and handled QA once the company was funded and moving. This maps directly onto what the company’s own roadmap was building through 2012: device and network simulators such as Cisco and Alcatel, an emulated “World View” of networks, a platform and console, scalability, and behavioral virtualization. In short, deception at scale.
Net result
It worked out. The company raised over $10 million around the time it rebranded to Shadow Networks, per TechCrunch in March 2014, and operated under that name. It had a successful exit when Acalvio Technologies acquired it on Feb 27, 2016. A clean example of the fed-tech-commercialization thesis actually paying off, and of my “make a few look like many” systems trick, straight out of HP, finding a second life in a deception platform.
What I learned
- The best product insight can come from the practitioner in the room, not the principals. The commercial pivot here was Andre’s, off a submarine training rig, and it arguably seeded a whole category of cyber deception.
- A technique travels. “Boot a few hosts, present as hundreds, expose services that behave like the real thing” came from HP and dropped straight into a deception platform. Same trick, new purpose.
Key people
- Andre Gironda proposed the deception concept and was a co-developer on network detection, routing, and QA. Paul credits him as the originator of at-scale emulation-as-deception.
- Michael Lyons, of Stanford, Founder & CEO. He ran the commercialization play and is a recurring collaborator with Paul and Craig on licensing federally developed technology.
- Craig Schultz and Jeffrey Starr organized the PNNL visit, out of the RMS and NeoPrime orbit.
Technologies / methods
PNNL submarine-systems emulator as the seed technology; MILDEC-inspired cyber deception at scale; mass Windows-host emulation, a few machines presenting as hundreds, each exposing realistic fictional services through the HP-derived boot and imaging trick; device and network simulators and an emulated “World View”; network detection and routing; behavioral virtualization; TTP capture from lured attackers.