Jan 2, 2019, 12:37 AM ETConference Presentation, Fireside Chat, Panel

a16z Podcast | Securing Infrastructure and Enterprise Services

Mobile-First Workforce Enablement: Dominic Schein (CIO) prioritizes enabling journalists to create and distribute content from any location while maintaining strict security controls without hindering workflow.
- The organization balances autonomy for its 10+ distinct business units with a unified deployment of common API frameworks and platforms to reduce redundant security testing.
Election Cycle Threats: News Corp mitigated risks related to the recent US election, specifically anticipating repeat denial-of-service (DoS) attacks rather than data tampering by foreign entities.
- The company implemented contingency plans to switch DNS providers rapidly, maintaining operational continuity despite potential infrastructure vulnerabilities.
Supply Chain Resilience: The recent IoT-based DNS attack served as a "wake-up call," crystallizing the necessity to hold external vendors to rigorous security standards.
- News Corp is moving toward stricter partner due diligence, requiring proof of rehearsed contingency plans rather than relying solely on internal controls.
Security Spend Allocation: Over the past 18 months, News Corp has increased investment in data loss prevention, endpoint management, vulnerability scanning, and internal red teaming (active hacking simulations).

Shift to Distributed Architecture: Brad Peterson (CFO) predicts a transition from centralized record-keeping (relying on mainframes/DTCC) to distributed systems, leveraging blockchain to lower costs and accelerate settlement speeds.
- This shift aims to move trading data centers away from high-risk, high-latency zones like Manhattan toward safer, lower-cost global locations to improve resiliency and security.
Re-engineering the Exchange: NASDAQ is modernizing both consumer-facing products and issuer-facing services, acknowledging that the physical proximity-based trading model is obsolete.
- The strategy involves balancing speed with security, fairness, and resiliency, effectively resetting the "skis" of the industry to focus on robust infrastructure rather than just latency.
Critical Infrastructure Status: As a designated US critical infrastructure entity, NASDAQ cannot operate in a direct internet-facing environment; it maintains a permissioned environment for core exchanges while managing indirect application access.
- The organization relies on rapid information sharing within a coalition of financial institutions to receive early warnings regarding state actor campaigns linked to foreign policy events.
Risk vs. Efficiency Trade-off: While high-frequency trading previously drove physical data center proximity, the future of finance prioritizes distributed security over raw speed, reducing the vulnerability to natural disasters or targeted terrorist attacks.

IoT and Supply Chain Risks: The discussion highlighted that the Mirai-style DNS attack demonstrated the fragility of the original internet design when applied to billions of insecure IoT devices (e.g., cameras, smart appliances).
- Experts warned that future attacks could escalate to critical infrastructure levels, such as coordinated manipulation of smart meters to strain power grids.
Mobile Security Evolution: Frederick Karest (COO) noted that modern OS capabilities (iOS/Android) allow for richer user profiles, enabling seamless access to business tools on employee-owned devices.
- Security strategies now emphasize leveraging native OS security features to provide a "supercomputer" experience for users without compromising enterprise data integrity.
User Behavior Analytics: Okta identifies privileged access and user behavior analysis as high-growth investment areas, specifically monitoring for anomalies linked to employee stress, financial distress, or trauma.
Vendor Consolidation vs. Best-of-Breed: Both News Corp and NASDAQ reject strict vendor consolidation, preferring a portfolio of "best-of-breed" tools under a unifying security standard to avoid single points of failure.
- News Corp explicitly stated that diversifying vendors acts as a de-risking strategy, ensuring that no single security posture failure impacts the entire organization.