Alex Stamos

Last updated
Alex Stamos
Alex Stamos at Web Summit 2015 - Dublin, Ireland.jpg
Stamos at Web Summit 2015 in Dublin, Ireland
Born
Los Angeles County, California [ citation needed ]
Occupation(s) Chief security officer, computer scientist
SpouseKatie Stamos
Children3

Alex Stamos is an American [1] computer scientist and adjunct professor at Stanford University's Center for International Security and Cooperation. [2] He is the former chief security officer (CSO) at Facebook. His planned departure from the company, following disagreement with other executives about how to address the Russian government's use of its platform to spread disinformation during the 2016 U.S. presidential election, was reported in March 2018. [3]

Contents

Early life and education

Stamos grew up in Fair Oaks, California and graduated from Bella Vista High School in 1997. Stamos attended the University of California, Berkeley, where he graduated in 2001 with a degree in EECS. [4]

Career

Stamos began his career at Loudcloud and, later, as a security consultant at @stake. [5]

iSEC Partners

In 2004, Stamos co-founded iSEC Partners, a security consulting firm, with Joel Wallenstrom, Himanshu Dwivedi, Jesse Burns and Scott Stender. During his time at iSEC Partners, Stamos was well known for his research publications on vulnerabilities in forensics software [6] and MacOS, [7] Operation Aurora, [8] and security ethics in the post-Snowden era. [9]

Stamos was an expert witness for a number of cases involving digital privacy, encryption, and free speech:

iSEC Partners was acquired by NCC Group in 2010. [14]

Artemis Internet

Following the acquisition of iSEC Partners by NCC Group, Stamos became the CTO of Artemis Internet, an internal startup at NCC Group. Artemis Internet petitioned ICANN to host a '.secure' gTLD on which all services would be required to meet minimum security standards [15] Artemis ultimately acquired the right to operate the '.trust' gTLD from Deutsche Post to launch its services. [16]

Stamos filed and received five patents for his work at Artemis Internet. [17]

Yahoo!

In 2014, Stamos joined Yahoo! as CSO. [18] While at Yahoo!, he testified to Congress on online advertising and its impact on computer security and data privacy. [19] He publicly challenged NSA Director Michael S. Rogers on the subject of encryption backdoors in February 2015 at a cybersecurity conference hosted by New America. [20] [21]

Facebook

In 2015, Stamos joined Facebook as CSO. During his time at Facebook, Stamos co-authored a whitepaper (with Jen Weedon and Will Nuland) on the use of social media to attack elections. [22] He later delivered a keynote address at the Black Hat Briefings in 2017 on the need to broaden the definition of security and diversify the cybersecurity industry. [23]

In reviewing the ads buys, we have found approximately $100,000 in ad spending from June of 2015 to May of 2017 — associated with roughly 3,000 ads — that was connected to about 470 inauthentic accounts and Pages in violation of our policies. Our analysis suggests these accounts and Pages were affiliated with one another and likely operated out of Russia.

— Alex Stamos, September 6, 2017, [24]
Stamos at Munich Security Conference in February 2018 Brad Smith, Alex Stamos und Marietje Schaake MSC 2018.jpg
Stamos at Munich Security Conference in February 2018

Following disagreement with other executives about how to address the Russian government's use of its platform to spread disinformation during the 2016 U.S. presidential election, he made plans in 2018 to leave the company [3] to take a research professorship at Stanford University. [25]

Stamos was interviewed about the Russian interference in the 2016 United States elections in the PBS Frontline documentary The Facebook Dilemma. [26] [27]

Controversies

During Stamos's tenure as the Chief Security Officer, Facebook was involved in numerous safety and security controversies including the Russian interference in the 2016 United States elections, failure to remove reported child-abuse images, [28] inaction against disinformation campaigns in Philippines that targeted and harassed journalists, [29] [30] Facebook–Cambridge Analytica data scandal and the Rohingya genocide, for which the company has played a "determining role" according to the UN. [31] Stamos said, as the CSO during the 2016 election season he "deserve as much blame (or more) as any other exec at the company," for Facebook's failed response to the Russian interference. [32] Although the whitepaper Stamos coauthored [22] only mentioned $100,000 ad spend for 3,000 ads connected to about 470 inauthentic accounts, it was later revealed that the Russian influence had reached 126 million Facebook users. [33] While Cambridge Analytica harvested data from 87 million Facebook users before Stamos's tenure, Facebook did not notify its users until 2018, despite knowing about it as early as 2015, the year Stamos joined the company as the CSO. [34] In July 2019, Facebook agreed to pay $100 million to settle with the U.S. Securities and Exchange Commission for misleading investors for more than two years (2015-2018) about the misuse of its users' data. [35]

Stanford University

As of August 2019, Stanford University's Center for International Security and Cooperation lists Stamos as an adjunct professor, visiting scholar at the Hoover Institution, and director of the Stanford Internet Observatory. [2] [36]

Krebs Stamos Group

At the beginning of 2021, Stamos joined former CISA director Chris Krebs to form Krebs Stamos Group, a cybersecurity consultancy, which quickly landed its first customer, the recently-beleaguered SolarWinds. [37] [38] [39]

Related Research Articles

ATstake, Inc. was a computer security professional services company in Cambridge, Massachusetts, United States. It was founded in 1999 by Battery Ventures and Ted Julian. Its initial core team of technologists included Dan Geer and the east coast security team from Cambridge Technology Partners.

Brian Krebs is an American journalist and investigative reporter. He is best known for his coverage of profit-seeking cybercriminals. Krebs is the author of a daily blog, KrebsOnSecurity.com, covering computer security and cybercrime. From 1995 to 2009, Krebs was a reporter for The Washington Post and covered tech policy, privacy and computer security as well as authoring the Security Fix blog.

A supply chain attack is a cyber-attack that seeks to damage an organization by targeting less secure elements in the supply chain. A supply chain attack can occur in any industry, from the financial sector, oil industry, to a government sector. A supply chain attack can happen in software or hardware. Cybercriminals typically tamper with the manufacturing or distribution of a product by installing malware or hardware-based spying components. Symantec's 2019 Internet Security Threat Report states that supply chain attacks increased by 78 percent in 2018.

SolarWinds Corporation is an American company that develops software for businesses to help manage their networks, systems, and information technology infrastructure. It is headquartered in Austin, Texas, with sales and product development offices in a number of locations in the United States and several other countries. The company was publicly traded from May 2009 until the end of 2015, and again from October 2018. It has also acquired a number of other companies, some of which it still operates under their original names, including Pingdom, Papertrail and Loggly. It had about 300,000 customers as of December 2020, including nearly all Fortune 500 companies and numerous agencies of the US federal government.

Trellix is a privately held cybersecurity company that was founded in 2022. It has been involved in the detection and prevention of major cybersecurity attacks. It provides hardware, software, and services to investigate cybersecurity attacks, protect against malicious software, and analyze IT security risks.

Trustwave is an American cybersecurity subsidiary of The Chertoff Group. It focuses on providing managed detection and response (MDR), managed security services (MSS), database security, and email security to organizations around the globe.

Mandiant is an American cybersecurity firm and a subsidiary of Google. It rose to prominence in February 2013 when it released a report directly implicating China in cyber espionage. In December 2013, Mandiant was acquired by FireEye for $1 billion, who eventually sold the FireEye product line, name, and its employees to Symphony Technology Group for $1.2 billion in June 2021.

A bug bounty program is a deal offered by many websites, organizations, and software developers by which individuals can receive recognition and compensation for reporting bugs, especially those pertaining to security exploits and vulnerabilities.

Cozy Bear, classified by the United States federal government as advanced persistent threat APT29, is a Russian hacker group believed to be associated with one or more intelligence agencies of Russia. The Dutch General Intelligence and Security Service (AIVD) deduced from security camera footage that it is led by the Russian Foreign Intelligence Service (SVR), a view shared by the United States. Cybersecurity firm CrowdStrike also previously suggested that it may be associated with either the Russian Federal Security Service (FSB) or SVR. The group has been given various nicknames by other cybersecurity firms, including CozyCar, CozyDuke, Dark Halo, The Dukes, Midnight Blizzard, NOBELIUM, Office Monkeys, StellarParticle, UNC2452, and YTTRIUM.

The Internet service company Yahoo! was subjected to the largest data breach on record. Two major data breaches of user account data to hackers were revealed during the later half of 2016. The first announced breach, reported in September 2016, had occurred sometime in late 2014, and affected over 500 million Yahoo! user accounts. A separate data breach, occurring earlier around August 2013, was reported in December 2016. Initially believed to have affected over 1 billion user accounts, Yahoo! later affirmed in October 2017 that all 3 billion of its user accounts were impacted. Both breaches are considered the largest discovered in the history of the Internet. Specific details of material taken include names, email addresses, telephone numbers, encrypted or unencrypted security questions and answers, dates of birth, and hashed passwords. Further, Yahoo! reported that the late 2014 breach likely used manufactured web cookies to falsify login credentials, allowing hackers to gain access to any account without a password.

Election cybersecurity or election security refers to the protection of elections and voting infrastructure from cyberattack or cyber threat – including the tampering with or infiltration of voting machines and equipment, election office networks and practices, and voter registration databases.

<span class="mw-page-title-main">Cybersecurity and Infrastructure Security Agency</span> Agency of the United States Department of Homeland Security

The Cybersecurity and Infrastructure Security Agency (CISA) is a component of the United States Department of Homeland Security (DHS) responsible for cybersecurity and infrastructure protection across all levels of government, coordinating cybersecurity programs with U.S. states, and improving the government's cybersecurity protections against private and nation-state hackers.

<span class="mw-page-title-main">Russian interference in the 2020 United States elections</span>

Russian interference in the 2020 United States elections was a matter of concern at the highest level of national security within the United States government, in addition to the computer and social media industries. In 2020, the RAND Corporation was one of the first to release research describing Russia's playbook for interfering in U.S. elections, developed machine-learning tools to detect the interference, and tested strategies to counter Russian interference. In February and August 2020, United States Intelligence Community (USIC) experts warned members of Congress that Russia was interfering in the 2020 presidential election in then-President Donald Trump's favor. USIC analysis released by the Office of the Director of National Intelligence (DNI) in March 2021 found that proxies of Russian intelligence promoted and laundered misleading or unsubstantiated narratives about Joe Biden "to US media organizations, US officials, and prominent US individuals, including some close to former President Trump and his administration." The New York Times reported in May 2021 that federal investigators in Brooklyn began a criminal investigation late in the Trump administration into possible efforts by several current and former Ukrainian officials to spread unsubstantiated allegations about corruption by Joe Biden, including whether they had used Trump personal attorney Rudy Giuliani as a channel.

Chris Kubecka is an American computer security researcher and cyberwarfare specialist. In 2012, Kubecka was responsible for getting the Saudi Aramco network back up and running after it was hit by one of the world's most devastating Shamoon cyberattacks. Kubecka also helped halt a second wave of July 2009 cyberattacks against South Korea. Kubecka has worked for the US Air Force as a Loadmaster, the United States Space Command and is now CEO of HypaSec, a security firm she founded in 2015. She lives and works in the Netherlands.

<span class="mw-page-title-main">Chris Krebs</span> American cybersecurity and infrastructure security expert (born 1977)

Christopher Cox Krebs is an American attorney who served as Director of the Cybersecurity and Infrastructure Security Agency in the United States Department of Homeland Security from November 2018 until November 17, 2020, when President Donald Trump fired Krebs for contradicting Trump's claims of election fraud in the 2020 presidential election.

Jack Cable is an American computer security researcher and software developer. He is best known for his participation in bug bounty programs, including placing first in the U.S. Department of Defense's Hack the Air Force challenge. Cable began working for the Pentagon's Defense Digital Service in the summer of 2018.

SentinelOne, Inc. is an American cybersecurity company listed on NYSE based in Mountain View, California. The company was founded in 2013 by Tomer Weingarten, Almog Cohen and Ehud ("Udi") Shamir. Weingarten acts as the company's CEO. Vats Srivatsan is the company's COO. The company has approximately 2,100 employees and offices in Mountain View, Boston, Tokyo, and Berlin. The company uses machine learning for monitoring personal computers, IoT devices, and cloud workloads. The company's platform utilizes a heuristic model, specifically its patented behavioral AI. The company is AV-TEST certified.

<span class="mw-page-title-main">2020 United States federal government data breach</span> US federal government data breach

In 2020, a major cyberattack suspected to have been committed by a group backed by the Russian government penetrated thousands of organizations globally including multiple parts of the United States federal government, leading to a series of data breaches. The cyberattack and data breach were reported to be among the worst cyber-espionage incidents ever suffered by the U.S., due to the sensitivity and high profile of the targets and the long duration in which the hackers had access. Within days of its discovery, at least 200 organizations around the world had been reported to be affected by the attack, and some of these may also have suffered data breaches. Affected organizations worldwide included NATO, the U.K. government, the European Parliament, Microsoft and others.

<span class="mw-page-title-main">Jen Easterly</span> American government official

Jen Easterly is an American intelligence and former military official who is serving as the director of the Cybersecurity and Infrastructure Security Agency in the Biden administration. She was confirmed by a voice vote in the Senate on July 12, 2021.

References

  1. ↑ "Greek-American Alex Stamos to Appear on Niall Ferguson's Networld on PBS". The National Herald. Archived from the original on 6 September 2021. Retrieved 6 September 2021.
  2. 1 2 "FSI - CISAC - Alex Stamos". Center for International Security and Cooperation. Archived from the original on 11 September 2019. Retrieved 5 August 2019.
  3. 1 2 Perlroth, Nicole; Frenkel, Sheera; Shane, Scott (19 March 2018). "Facebook Security Chief Said to Leave After Clashes Over Disinformation". The New York Times. Retrieved 19 March 2018.
  4. ↑ "Newton Lecture Series: Alex Stamos - UC Berkeley Sutardja Center". UC Berkeley Sutardja Center. 2015-09-24. Retrieved 2018-03-20.
  5. ↑ Shandrow, Kim Lachance (2014-03-11). "4 Things to Know About Yahoo's New Information Security VP Alex Stamos". Entrepreneur. Retrieved 2018-07-16.
  6. ↑ Stamos, Alexander (July 16, 2018). "Breaking Forensics Software: Weaknesses in Critical Evidence Collection" (PDF).
  7. ↑ Stamos, Alexander (July 16, 2018). "Macs in the Age of APT" (PDF).
  8. ↑ Stamos, Alexander (July 16, 2018). "Aurora Response Recommendations" (PDF).
  9. ↑ DEFCONConference (2013-12-21), DEF CON 21 - Alex Stamos - An Open Letter The White Hat's Dilemma , retrieved 2018-07-16
  10. ↑ Halderman, J. (July 16, 2018). "Lessons from the Sony CD DRM Episode" (PDF).
  11. ↑ Stamos, Alexander (July 16, 2018). "Declaration of Alexander Stamos" (PDF).
  12. ↑ "Declaration of Alexander Stamos in Reply of Defendant Hotz to 103 SCEA's Opposition Brief filed byGeorge Hotz for Sony Computer Entertainment America LLC v. Hotz et al :: Justia Dockets & Filings". Justia Dockets & Filings. Retrieved 2018-07-16.
  13. ↑ "The Truth about Aaron Swartz's "Crime"". Unhandled Exception. 2013-01-12. Retrieved 2018-07-16.
  14. ↑ "UPDATE 1-NCC Group buys U.S. security testing firm". Reuters. 14 October 2010. Retrieved 2018-03-20.
  15. ↑ . "My own private Internet: .secure TLD floated as bad-guy-free zone". Ars Technica. Retrieved 2018-07-16.
  16. ↑ ".trust - ICANNWiki". icannwiki.org. Retrieved 2018-07-16.
  17. ↑ "Google Patents". patents.google.com. Retrieved 2018-07-16.
  18. ↑ Wagner, Kurt (3 October 2017). "Who is Alex Stamos, the man hunting down Russian political ads on Facebook?". Recode. Retrieved 19 March 2018.
  19. ↑ "Online Advertising and Consumer Security". C-SPAN.org. Retrieved 2018-07-16.
  20. ↑ CNBC (2015-02-28), Yahoo Security Officer Confronts NSA Director | CNBC , retrieved 2018-07-16
  21. ↑ "Here's how the clash between the NSA Director and a senior Yahoo executive went down". Washington Post. Retrieved 2018-07-16.
  22. 1 2 "An Update On Information Operations On Facebook | Facebook Newsroom" . Retrieved 2018-07-16.
  23. ↑ Black Hat (2017-09-13), Black Hat USA 2017 Keynote , retrieved 2018-07-16
  24. ↑ "Facebook Says Russian Accounts Bought $100,000 in Ads During the 2016 Election". Time. 6 September 2017.
  25. ↑ Frenkel, Sheera; Conger, Kate (August 2018). "Facebook's Security Chief to Depart for Stanford University". The New York Times. Retrieved 2018-08-07.
  26. ↑ "The Facebook Dilemma". www.pbs.org. Retrieved 2020-12-13.
  27. ↑ "The Facebook Dilemma: Alex Stamos". www.youtube.com. Retrieved 2020-12-13.
  28. ↑ "Facebook failed to remove sexualised images of children". bbc.com. Retrieved 2020-12-12.
  29. ↑ "Philippine journalist Maria Ressa talks Facebook, truth on Recode Decode - Vox". vox.com. 26 November 2018. Retrieved 2020-12-13.
  30. ↑ "Journalists like Maria Ressa face death threats and jail for doing their jobs. Facebook must take its share of the blame". edition.cnn.com. 30 June 2020. Retrieved 2020-12-13.
  31. ↑ "U.N. investigators cite Facebook role in Myanmar crisis". reuters.com. Retrieved 2020-12-12.
  32. ↑ "Departing Facebook Security Officer's Memo: "We Need To Be Willing To Pick Sides"". buzzfeednews.com. Retrieved 2020-12-12.
  33. ↑ "Russian content on Facebook, Google and Twitter reached far more users than companies first disclosed, congressional testimony says". washingtonpost.com. Retrieved 2020-12-12.
  34. ↑ Facebook–Cambridge Analytica data scandal § Overview
  35. ↑ "SEC.gov | Facebook to Pay $100 Million for Misleading Investors About the Risks It Faced From Misuse of User Data". www.sec.gov. Retrieved 2020-12-13.
  36. ↑ "FSI - Cyber - Internet Observatory - About IO". Freeman Spogli Institute . Retrieved 5 August 2019.
  37. ↑ Sebenius, Alyza (2021-01-08). "SolarWinds Taps Krebs, Stamos to Help Investigate Hack". Bloomberg. Retrieved 19 June 2021. SolarWinds Corp. has tapped prominent security experts Chris Krebs and Alex Stamos to review its practices after suspected Russian hackers compromised the company's software and conducted a sprawling hack across the U.S. government and private sector. The contract with SolarWinds is the first for a newly formed venture Krebs and Stamos have created together. The Krebs Stamos Group will advise clients on cybersecurity, with a focus on areas including foreign threats and crisis situations. The group will work toward 'national and economic security,' Krebs said in a statement Friday.
  38. ↑ Hamilton, Isobel Asher (2021-01-08). "SolarWinds has hired ex-CISA chief Chris Krebs and Facebook's former security lead Alex Stamos months after its huge hack". Business Insider. Retrieved 19 June 2021. SolarWinds has hired two of the biggest names in cybersecurity, following the gigantic breach, which meant it acted as the gateway for hackers to penetrate US government systems. SolarWinds announced on Thursday it was retaining a new security consulting business founded by Chris Krebs, a former Homeland Security cybersecurity official, and ex-Facebook security chief and Stanford University professor Alex Stamos.
  39. ↑ Whittaker, Zach (2021-01-08). "Chris Krebs and Alex Stamos have started a cyber consulting firm". TechCrunch. Retrieved 19 June 2021. Former U.S. cybersecurity official Chris Krebs and former Facebook chief security officer Alex Stamos have founded a new cybersecurity consultancy firm, which already has its first client: SolarWinds. The two have been hired as consultants to help the Texas-based software maker recover from a devastating breach by suspected Russian hackers. Krebs was one of the most senior cybersecurity officials in the U.S. government, most recently serving as the director of Homeland Security's CISA cybersecurity advisory agency from 2018, until he was fired by President Trump for his efforts to debunk false election claims — many of which came from the president himself. Stamos, meanwhile, joined the Stanford Internet Observatory after holding senior cybersecurity positions at Facebook and Yahoo. He also consulted for Zoom amid a spate of security problems.

Patents

This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.