Alex Stamos

Last updated
Alex Stamos
Alex Stamos at Web Summit 2015 - Dublin, Ireland.jpg
Stamos at Web Summit 2015 in Dublin, Ireland
Born1979 (age 44–45)
Los Angeles County, California [ citation needed ]
Occupation(s) Chief security officer, computer scientist
SpouseKatie Stamos
Children3

Alex Stamos (born 1979) is an American, [1] cybersecurity expert, the former chief security officer (CSO) at Facebook. His planned departure from the company, following disagreement with other executives about how to address the Russian government's use of its platform to spread disinformation during the 2016 U.S. presidential election, was reported in March 2018. [2]

Contents

Early life and education

Born in 1979, Stamos grew up in Fair Oaks, California and graduated from Bella Vista High School in 1997. Stamos attended the University of California, Berkeley, where he graduated in 2001 with a degree in EECS. [3]

Career

Stamos began his career at Loudcloud and, later, as a security consultant at @stake. [4]

iSEC Partners

In 2004, Stamos co-founded iSEC Partners, a security consulting firm, with Joel Wallenstrom, Himanshu Dwivedi, Jesse Burns and Scott Stender. During his time at iSEC Partners, Stamos was well known for his research publications on vulnerabilities in forensics software [5] and MacOS, [6] Operation Aurora, [7] and security ethics in the post-Snowden era. [8]

Stamos was an expert witness for a number of cases involving digital privacy, encryption, and free speech:

iSEC Partners was acquired by NCC Group in 2010. [13]

Artemis Internet

Following the acquisition of iSEC Partners by NCC Group, Stamos became the CTO of Artemis Internet, an internal startup at NCC Group. Artemis Internet petitioned ICANN to host a '.secure' gTLD on which all services would be required to meet minimum security standards [14] Artemis ultimately acquired the right to operate the '.trust' gTLD from Deutsche Post to launch its services. [15]

Stamos filed and received five patents for his work at Artemis Internet. [16]

Yahoo!

In 2014, Stamos joined Yahoo! as CSO. [17] While at Yahoo!, he testified to Congress on online advertising and its impact on computer security and data privacy. [18] He publicly challenged NSA Director Michael S. Rogers on the subject of encryption backdoors in February 2015 at a cybersecurity conference hosted by New America. [19] [20]

Facebook

In 2015, Stamos joined Facebook as CSO. During his time at Facebook, Stamos co-authored a whitepaper (with Jen Weedon and Will Nuland) on the use of social media to attack elections. [21] He later delivered a keynote address at the Black Hat Briefings in 2017 on the need to broaden the definition of security and diversify the cybersecurity industry. [22]

In reviewing the ads buys, we have found approximately $100,000 in ad spending from June of 2015 to May of 2017 — associated with roughly 3,000 ads — that was connected to about 470 inauthentic accounts and Pages in violation of our policies. Our analysis suggests these accounts and Pages were affiliated with one another and likely operated out of Russia.

— Alex Stamos, September 6, 2017, [23]
Stamos at Munich Security Conference in February 2018 Brad Smith, Alex Stamos und Marietje Schaake MSC 2018.jpg
Stamos at Munich Security Conference in February 2018

Following disagreement with other executives about how to address the Russian government's use of its platform to spread disinformation during the 2016 U.S. presidential election, he made plans in 2018 to leave the company [2] to take a research professorship at Stanford University. [24]

Stamos was interviewed about the Russian interference in the 2016 United States elections in the PBS Frontline documentary The Facebook Dilemma. [25] [26]

Controversies

During Stamos's tenure as the Chief Security Officer, Facebook was involved in numerous safety and security controversies including the Russian interference in the 2016 United States elections, failure to remove reported child-abuse images, [27] inaction against disinformation campaigns in Philippines that targeted and harassed journalists, [28] [29] Facebook–Cambridge Analytica data scandal and the Rohingya genocide, for which the company has played a "determining role" according to the UN. [30] Stamos said, as the CSO during the 2016 election season he "deserve as much blame (or more) as any other exec at the company," for Facebook's failed response to the Russian interference. [31] Although the whitepaper Stamos coauthored [21] only mentioned $100,000 ad spend for 3,000 ads connected to about 470 inauthentic accounts, it was later revealed that the Russian influence had reached 126 million Facebook users. [32] While Cambridge Analytica harvested data from 87 million Facebook users before Stamos's tenure, Facebook did not notify its users until 2018, despite knowing about it as early as 2015, the year Stamos joined the company as the CSO. [33] In July 2019, Facebook agreed to pay $100 million to settle with the U.S. Securities and Exchange Commission for misleading investors for more than two years (2015-2018) about the misuse of its users' data. [34]

Stanford University

As of August 2019, Stanford University's Center for International Security and Cooperation lists Stamos as an adjunct professor, visiting scholar at the Hoover Institution, and director of the Stanford Internet Observatory. [35] [36]

Krebs Stamos Group

At the beginning of 2021, Stamos joined former CISA director Chris Krebs to form Krebs Stamos Group, a cybersecurity consultancy, which quickly landed its first customer, the recently-beleaguered SolarWinds. [37] [38] [39]

Related Research Articles

<span class="mw-page-title-main">InfraGard</span> FBI Initiative for Public-Private Sector Infrastructure protection

InfraGard is a national non-profit organization serving as a public-private partnership between U.S. businesses and the Federal Bureau of Investigation. The organization is an information sharing and analysis effort serving the interests, and combining the knowledge base of, a wide range of private sector and government members. InfraGard is an association of individuals that facilitates information sharing and intelligence between businesses, academic institutions, state and local law enforcement agencies, and other participants dedicated to preventing hostile acts against the United States.

ATstake, Inc. was a computer security professional services company in Cambridge, Massachusetts, United States. It was founded in 1999 by Battery Ventures and Ted Julian. Its initial core team of technologists included Dan Geer and the East Coast security team from Cambridge Technology Partners. Its initial core team of executives included Christopher Darby, James T. Mobley, and Christina Luconi.

Brian Krebs is an American journalist and investigative reporter. He is best known for his coverage of profit-seeking cybercriminals. Krebs is the author of a daily blog, KrebsOnSecurity.com, covering computer security and cybercrime. From 1995 to 2009, Krebs was a reporter for The Washington Post and covered tech policy, privacy and computer security as well as authoring the Security Fix blog.

A supply chain attack is a cyber-attack that seeks to damage an organization by targeting less secure elements in the supply chain. A supply chain attack can occur in any industry, from the financial sector, oil industry, to a government sector. A supply chain attack can happen in software or hardware. Cybercriminals typically tamper with the manufacturing or distribution of a product by installing malware or hardware-based spying components. Symantec's 2019 Internet Security Threat Report states that supply chain attacks increased by 78 percent in 2018.

SolarWinds Corporation is an American company that develops software for businesses to help manage their networks, systems, and information technology infrastructure. It is headquartered in Austin, Texas, with sales and product development offices in a number of locations in the United States and several other countries. The company was publicly traded from May 2009 until the end of 2015, and again from October 2018. It has also acquired a number of other companies, some of which it still operates under their original names, including Pingdom, Papertrail, and Loggly. It had about 300,000 customers as of December 2020, including nearly all Fortune 500 companies and numerous agencies of the US federal government.

Trellix is a privately held cybersecurity company that was founded in 2022. It has been involved in the detection and prevention of major cybersecurity attacks. It provides hardware, software, and services to investigate cybersecurity attacks, protect against malicious software, and analyze IT security risks.

Trustwave is an American cybersecurity subsidiary of The Chertoff Group. It focuses on providing managed detection and response (MDR), managed security services (MSS), database security, and email security to organizations around the globe.

<span class="mw-page-title-main">Palo Alto Networks</span> American technology company

Palo Alto Networks, Inc. is an American multinational cybersecurity company with headquarters in Santa Clara, California. The core product is a platform that includes advanced firewalls and cloud-based offerings that extend those firewalls to cover other aspects of security. The company serves over 70,000 organizations in over 150 countries, including 85 of the Fortune 100. It is home to the Unit 42 threat research team and hosts the Ignite cybersecurity conference. It is a partner organization of the World Economic Forum.

Mandiant, Inc. is an American cybersecurity firm and a subsidiary of Google. Mandiant received attention in February 2013 when it released a report directly implicating China in cyber espionage. In December 2013, Mandiant was acquired by FireEye for $1 billion, who eventually sold the FireEye product line, name, and its employees to Symphony Technology Group for $1.2 billion in June 2021.

A bug bounty program is a deal offered by many websites, organizations, and software developers by which individuals can receive recognition and compensation for reporting bugs, especially those pertaining to security exploits and vulnerabilities.

Cozy Bear is a Russian advanced persistent threat hacker group believed to be associated with Russian foreign intelligence by United States intelligence agencies and those of allied countries. Dutch signals intelligence (AIVD) and American intelligence had been monitoring the group since 2014 and was able to link the hacker group to the Russian foreign intelligence agency (SVR) after compromising security cameras in their office. CrowdStrike and Estonian intelligence reported a tentative link to the Russian domestic/foreign intelligence agency (FSB). Various groups designate it CozyCar, CozyDuke, Dark Halo, The Dukes, Midnight Blizzard, NOBELIUM, Office Monkeys, StellarParticle, UNC2452 with a tentative connection to Russian hacker group YTTRIUM. Symantec reported that Cozy Bear had been compromising diplomatic organizations and national governments since at least 2010. Der Spiegel published documents in 2023 purporting to link Russian IT firm NTC Vulkan to Cozy Bear operations.

In 2013 and 2014, the American web services company Yahoo was subjected to two of the largest data breaches on record. Although Yahoo was aware, neither breach was revealed publicly until September 2016.

Election cybersecurity or election security refers to the protection of elections and voting infrastructure from cyberattack or cyber threat – including the tampering with or infiltration of voting machines and equipment, election office networks and practices, and voter registration databases.

<span class="mw-page-title-main">Cybersecurity and Infrastructure Security Agency</span> Agency of the United States Department of Homeland Security

The Cybersecurity and Infrastructure Security Agency (CISA) is a component of the United States Department of Homeland Security (DHS) responsible for cybersecurity and infrastructure protection across all levels of government, coordinating cybersecurity programs with U.S. states, and improving the government's cybersecurity protections against private and nation-state hackers. Cybersecurity is now considered as important part of individuals and families, as well as organizations, governments, educational institutions and our business. It is essential for families and parents to protect the children and family members from online fraud. The term cyber attack covers a wide variety of actions ranging from simple probes, to defacing websites, to denial of service, to espionage and destruction.

<span class="mw-page-title-main">Chris Kubecka</span> American computer programmer and computer security researcher

Chris Kubecka is an American computer security researcher and cyberwarfare specialist. In 2012, Kubecka was responsible for getting the Saudi Aramco network running again after it was hit by one of the world's most devastating Shamoon cyberattacks. Kubecka also helped halt a second wave of July 2009 cyberattacks against South Korea. Kubecka has worked for the US Air Force as a Loadmaster, the United States Space Command and is now CEO of HypaSec, a security firm she founded in 2015. She lives and works in the Netherlands.

<span class="mw-page-title-main">Chris Krebs</span> American cybersecurity and infrastructure security expert (born 1977)

Christopher Cox Krebs is an American attorney who served as Director of the Cybersecurity and Infrastructure Security Agency in the United States Department of Homeland Security from November 2018 until November 17, 2020, when President Donald Trump fired Krebs for contradicting Trump's claims of election fraud in the 2020 presidential election.

Jack Cable is an American computer security researcher and software developer who currently serves as a Senior Technical Advisor at the Cybersecurity and Infrastructure Security Agency. He is best known for his participation in bug bounty programs, including placing first in the U.S. Department of Defense's Hack the Air Force challenge. Cable began working for the Pentagon's Defense Digital Service in the summer of 2018.

SentinelOne, Inc. is an American cybersecurity company listed on NYSE based in Mountain View, California. The company was founded in 2013 by Tomer Weingarten, Almog Cohen and Ehud ("Udi") Shamir. Weingarten acts as the company's CEO. Vats Srivatsan is the company's COO. The company has approximately 2,100 employees and offices in Mountain View, Boston, Prague, Tokyo, and Tel Aviv. The company uses machine learning for monitoring personal computers, IoT devices, and cloud workloads. The company's platform utilizes a heuristic model, specifically its patented behavioral AI. The company is AV-TEST certified.

<span class="mw-page-title-main">2020 United States federal government data breach</span> US federal government data breach

In 2020, a major cyberattack suspected to have been committed by a group backed by the Russian government penetrated thousands of organizations globally including multiple parts of the United States federal government, leading to a series of data breaches. The cyberattack and data breach were reported to be among the worst cyber-espionage incidents ever suffered by the U.S., due to the sensitivity and high profile of the targets and the long duration in which the hackers had access. Within days of its discovery, at least 200 organizations around the world had been reported to be affected by the attack, and some of these may also have suffered data breaches. Affected organizations worldwide included NATO, the U.K. government, the European Parliament, Microsoft and others.

References

  1. ↑ "Greek-American Alex Stamos to Appear on Niall Ferguson's Networld on PBS". The National Herald. Archived from the original on 6 September 2021. Retrieved 6 September 2021.
  2. 1 2 Perlroth, Nicole; Frenkel, Sheera; Shane, Scott (19 March 2018). "Facebook Security Chief Said to Leave After Clashes Over Disinformation". The New York Times. Retrieved 19 March 2018.
  3. ↑ "Newton Lecture Series: Alex Stamos - UC Berkeley Sutardja Center". UC Berkeley Sutardja Center. 2015-09-24. Retrieved 2018-03-20.
  4. ↑ Shandrow, Kim Lachance (2014-03-11). "4 Things to Know About Yahoo's New Information Security VP Alex Stamos". Entrepreneur. Retrieved 2018-07-16.
  5. ↑ Stamos, Alexander (July 16, 2018). "Breaking Forensics Software: Weaknesses in Critical Evidence Collection" (PDF).
  6. ↑ Stamos, Alexander (July 16, 2018). "Macs in the Age of APT" (PDF). Archived from the original (PDF) on May 28, 2018. Retrieved July 16, 2018.
  7. ↑ Stamos, Alexander (July 16, 2018). "Aurora Response Recommendations" (PDF).
  8. ↑ DEFCONConference (2013-12-21), DEF CON 21 - Alex Stamos - An Open Letter The White Hat's Dilemma , retrieved 2018-07-16
  9. ↑ Halderman, J. (July 16, 2018). "Lessons from the Sony CD DRM Episode" (PDF).
  10. ↑ Stamos, Alexander (July 16, 2018). "Declaration of Alexander Stamos" (PDF).
  11. ↑ "Declaration of Alexander Stamos in Reply of Defendant Hotz to 103 SCEA's Opposition Brief filed byGeorge Hotz for Sony Computer Entertainment America LLC v. Hotz et al :: Justia Dockets & Filings". Justia Dockets & Filings. Retrieved 2018-07-16.
  12. ↑ "The Truth about Aaron Swartz's "Crime"". Unhandled Exception. 2013-01-12. Retrieved 2018-07-16.
  13. ↑ "UPDATE 1-NCC Group buys U.S. security testing firm". Reuters. 14 October 2010. Retrieved 2018-03-20.
  14. ↑ . "My own private Internet: .secure TLD floated as bad-guy-free zone". Ars Technica. Retrieved 2018-07-16.
  15. ↑ ".trust - ICANNWiki". icannwiki.org. Retrieved 2018-07-16.
  16. ↑ "Google Patents". patents.google.com. Retrieved 2018-07-16.
  17. ↑ Wagner, Kurt (3 October 2017). "Who is Alex Stamos, the man hunting down Russian political ads on Facebook?". Recode. Retrieved 19 March 2018.
  18. ↑ "Online Advertising and Consumer Security". C-SPAN.org. Retrieved 2018-07-16.
  19. ↑ CNBC (2015-02-28), Yahoo Security Officer Confronts NSA Director | CNBC , retrieved 2018-07-16
  20. ↑ "Here's how the clash between the NSA Director and a senior Yahoo executive went down". Washington Post. Retrieved 2018-07-16.
  21. 1 2 "An Update On Information Operations On Facebook | Facebook Newsroom" . Retrieved 2018-07-16.
  22. ↑ Black Hat (2017-09-13), Black Hat USA 2017 Keynote , retrieved 2018-07-16
  23. ↑ "Facebook Says Russian Accounts Bought $100,000 in Ads During the 2016 Election". Time. 6 September 2017.
  24. ↑ Frenkel, Sheera; Conger, Kate (August 2018). "Facebook's Security Chief to Depart for Stanford University". The New York Times. Retrieved 2018-08-07.
  25. ↑ "The Facebook Dilemma". www.pbs.org. Retrieved 2020-12-13.
  26. ↑ "The Facebook Dilemma: Alex Stamos". www.youtube.com. Retrieved 2020-12-13.
  27. ↑ "Facebook failed to remove sexualised images of children". bbc.com. Retrieved 2020-12-12.
  28. ↑ "Philippine journalist Maria Ressa talks Facebook, truth on Recode Decode - Vox". vox.com. 26 November 2018. Retrieved 2020-12-13.
  29. ↑ "Journalists like Maria Ressa face death threats and jail for doing their jobs. Facebook must take its share of the blame". edition.cnn.com. 30 June 2020. Retrieved 2020-12-13.
  30. ↑ "U.N. investigators cite Facebook role in Myanmar crisis". reuters.com. Archived from the original on March 13, 2018. Retrieved 2020-12-12.
  31. ↑ "Departing Facebook Security Officer's Memo: "We Need To Be Willing To Pick Sides"". buzzfeednews.com. Retrieved 2020-12-12.
  32. ↑ "Russian content on Facebook, Google and Twitter reached far more users than companies first disclosed, congressional testimony says". washingtonpost.com. Retrieved 2020-12-12.
  33. ↑ Facebook–Cambridge Analytica data scandal § Overview
  34. ↑ "SEC.gov | Facebook to Pay $100 Million for Misleading Investors About the Risks It Faced From Misuse of User Data". www.sec.gov. Retrieved 2020-12-13.
  35. ↑ "FSI - CISAC - Alex Stamos". Center for International Security and Cooperation. Archived from the original on 11 September 2019. Retrieved 5 August 2019.
  36. ↑ "FSI - Cyber - Internet Observatory - About IO". Freeman Spogli Institute . Retrieved 5 August 2019.
  37. ↑ Sebenius, Alyza (2021-01-08). "SolarWinds Taps Krebs, Stamos to Help Investigate Hack". Bloomberg. Retrieved 19 June 2021. SolarWinds Corp. has tapped prominent security experts Chris Krebs and Alex Stamos to review its practices after suspected Russian hackers compromised the company's software and conducted a sprawling hack across the U.S. government and private sector. The contract with SolarWinds is the first for a newly formed venture Krebs and Stamos have created together. The Krebs Stamos Group will advise clients on cybersecurity, with a focus on areas including foreign threats and crisis situations. The group will work toward 'national and economic security,' Krebs said in a statement Friday.
  38. ↑ Hamilton, Isobel Asher (2021-01-08). "SolarWinds has hired ex-CISA chief Chris Krebs and Facebook's former security lead Alex Stamos months after its huge hack". Business Insider. Retrieved 19 June 2021. SolarWinds has hired two of the biggest names in cybersecurity, following the gigantic breach, which meant it acted as the gateway for hackers to penetrate US government systems. SolarWinds announced on Thursday it was retaining a new security consulting business founded by Chris Krebs, a former Homeland Security cybersecurity official, and ex-Facebook security chief and Stanford University professor Alex Stamos.
  39. ↑ Whittaker, Zach (2021-01-08). "Chris Krebs and Alex Stamos have started a cyber consulting firm". TechCrunch. Retrieved 19 June 2021. Former U.S. cybersecurity official Chris Krebs and former Facebook chief security officer Alex Stamos have founded a new cybersecurity consultancy firm, which already has its first client: SolarWinds. The two have been hired as consultants to help the Texas-based software maker recover from a devastating breach by suspected Russian hackers. Krebs was one of the most senior cybersecurity officials in the U.S. government, most recently serving as the director of Homeland Security's CISA cybersecurity advisory agency from 2018, until he was fired by President Trump for his efforts to debunk false election claims — many of which came from the president himself. Stamos, meanwhile, joined the Stanford Internet Observatory after holding senior cybersecurity positions at Facebook and Yahoo. He also consulted for Zoom amid a spate of security problems.

Patents

This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.