Cross Examining Cyber EP28: Cross Examining Charles Carmakal

WEBVTT
00:00:01.040 --> 00:00:06.320
Welcome to Cross Examining Cyber, a podcast brought to you by Herbert Smith Free Hills Kramer.
00:00:06.799 --> 00:00:17.519
In this podcast series, we speak to our business leaders about all things cyber, including the legal, governance, technical, regulatory, and policy developments that impact corporates around the world.
00:00:17.760 --> 00:00:22.879
We look at the evolving cyber risk landscape by speaking to those people who are on the front line.
00:00:23.199 --> 00:00:25.600
Today we cross-examine Charles Carmichael.
00:00:25.920 --> 00:00:31.600
Charles is the Chief Technology Officer of Mandient Consulting, the security consulting arm of Google Cloud.
00:00:31.839 --> 00:00:34.399
If you're an incident response, you'll know Charles.
00:00:34.560 --> 00:00:41.600
He oversees a team of incident responders, analysts, and security consultants that have helped thousands of organisations around the world.
00:00:41.920 --> 00:00:49.600
His team is advised on many of the globe's most significant cyber incidents, and he's a globally recognized commentator on cyber threat intelligence.
00:00:49.840 --> 00:00:54.399
We recorded this podcast earlier this year but held it back for Cyber Awareness Month.
00:00:54.719 --> 00:00:55.600
Thank you for listening.
00:00:55.759 --> 00:00:58.000
This is Cross Examining Charles Carmichael.
00:00:58.159 --> 00:00:59.200
Here we go.
00:01:00.560 --> 00:01:03.840
Charles, welcome to Cross-Examining Cyber.
00:01:04.000 --> 00:01:06.799
Where does this podcast find you today?
00:01:07.120 --> 00:01:09.760
I'm in our Virginia, the United States, right now.
00:01:10.159 --> 00:01:11.200
Well, thank you for making the time.
00:01:11.280 --> 00:01:13.040
I know it's an unfriendly time zone.
00:01:13.200 --> 00:01:20.319
One thing we like to do with our guests is help our listeners know a little bit more about who we're speaking to.
00:01:20.959 --> 00:01:22.159
Who are you?
00:01:23.120 --> 00:01:27.840
So I'm Charles Carmichael, the Chief Technology Officer at Mandiant.
00:01:28.000 --> 00:01:34.159
Mandiant is a cybersecurity consulting organization that's been around for just a bit over 20 years.
00:01:34.319 --> 00:01:36.560
And there's really two things that we do.
00:01:36.799 --> 00:01:40.400
Number one, we help companies better prepare for cyber attacks.
00:01:40.560 --> 00:01:44.959
And number two, we help companies actually respond to cybersecurity events when they occur.
00:01:45.200 --> 00:01:49.200
We respond to north of a thousand uh security incidents every year.
00:01:49.359 --> 00:01:52.159
And three and a half years ago, we were acquired by Google.
00:01:52.239 --> 00:01:56.799
And so we are now the cybersecurity consulting practice within Google Cloud.
00:01:57.280 --> 00:02:00.319
Cyber incidents come in various shapes and sizes.
00:02:00.480 --> 00:02:04.480
When you say thousands or over even that's a that's a big number.
00:02:04.640 --> 00:02:08.080
Are we talking extortion style attacks?
00:02:08.240 --> 00:02:13.199
Because we can have BECs, we can have extortion, we can have state, insider, the work.
00:02:13.840 --> 00:02:16.639
How do I quantify that in terms of the work you're doing?
00:02:16.719 --> 00:02:16.879
Yeah.
00:02:17.280 --> 00:02:19.280
Let me try and illustrate it in a few different ways.
00:02:19.520 --> 00:02:28.080
The first way is by saying that collectively, we spent over 500,000 hours providing incident response services to our clients last year.
00:02:28.240 --> 00:02:32.960
And that's just what we're doing with respect to responding to security incidents.
00:02:33.120 --> 00:02:41.360
That doesn't include the offensive security work that we do, the proactive security work, and a variety of the security consulting capabilities that we provide.
00:02:41.599 --> 00:02:46.800
But to your question around what types of incidents do we respond to, it really varies.
00:02:47.039 --> 00:02:55.199
I would say most organizations that engage mandate to respond to a security incident are dealing with a few types of security matters.
00:02:55.360 --> 00:02:58.240
Number one, they're dealing with a nation-state attack.
00:02:58.479 --> 00:03:08.000
So a fairly advanced attack that's hard to detect by the organization, that usually requires some third party to come in and help them scope out the incident.
00:03:08.319 --> 00:03:22.560
Another very common type of attack that we deal with are either ransomware or extortion matters or other financially motivated intrusion activity that could have a large impact on our clients.
00:03:22.719 --> 00:03:31.599
It might happen pretty fast, and it might be pretty obvious to the victim organization that they're dealing with an attack, largely because a threat actor reaches out to them and extorts them.
00:03:31.680 --> 00:03:33.680
So they advertise that they've broken in.
00:03:33.840 --> 00:03:36.240
And then there's other types of cases that we deal with.
00:03:36.400 --> 00:03:38.879
We see a lot of software supply chain attacks.
00:03:39.039 --> 00:03:45.919
We see North Korean IT workers that have obtained jobs at Western organizations or organizations in other parts of the world.
00:03:46.080 --> 00:03:50.960
So it really is a variety of incidents that the team's responding to.
00:03:51.520 --> 00:03:56.319
And in terms of all that, all the work that you do in the space, it's one thing to be in the trenches.
00:03:57.199 --> 00:04:08.560
And being in the trenches does help you, I guess, bring some perspective or at least some intelligence to companies around the world, your clients, whether you're they're retained or otherwise.
00:04:08.800 --> 00:04:10.800
How do you stay ahead of the Intel?
00:04:11.439 --> 00:04:23.040
Or at least at a point in the Intel sort of distribution communication, where it still remains a relevant piece of information because these things are moving at pace.
00:04:23.360 --> 00:04:23.920
Yeah.
00:04:24.240 --> 00:04:28.160
It can be really tricky staying up with the latest and the greatest.
00:04:28.399 --> 00:04:30.079
There's a few ways in which I do it.
00:04:30.319 --> 00:04:32.319
The first way is I read my email.
00:04:32.480 --> 00:04:38.079
I get lots of emails from lots of clients in my team that tell me things that they're dealing with on a day-to-day basis.
00:04:38.240 --> 00:04:41.759
So that is a it's a very good source of information for me.
00:04:42.079 --> 00:04:57.839
Second thing is I talk to my team, the folks that are actually responding to the day-to-day incidents, my threat intel folks that are actively collecting threat intelligence, either because we've got some kind of visibility into some attacker infrastructure or things that they're doing.
00:04:58.160 --> 00:05:05.759
Maybe we have analysts that are actually talking to adversaries and hearing from them what they claim that they're doing.
00:05:06.000 --> 00:05:09.120
You know, we're obviously monitoring the dark web and a variety of things.
00:05:09.199 --> 00:05:17.519
And so I get a lot of that data from my team, but I also get it from the day-to-day incident response work and security consulting work that I do with my team.
00:05:18.480 --> 00:05:33.839
You've been in this game probably longer than me, but I did not intend to be here when I was working for a large, one of the big four consulting firms, and we set up a uh a cyber advisory and digital trust team, we call it, working across the spectrum.
00:05:34.000 --> 00:05:37.040
That was in 2015, so just 11 years ago.
00:05:37.199 --> 00:05:40.800
Yeah, we were dealing with the odd security advisory work.
00:05:40.879 --> 00:05:51.920
Before that, of course, because there were issues, you know, you remember nonpetie and all the those sort of early, early and perhaps less targeted cyber incidents.
00:05:52.240 --> 00:06:05.519
Now, threat intelligence is probably one of the key pieces of information that boards need or companies need in order to make a risk assessment around investment and then how to respond.
00:06:05.759 --> 00:06:07.360
How have you seen this change?
00:06:07.519 --> 00:06:08.879
Has it changed?
00:06:09.199 --> 00:06:22.079
And are we at the right place yet with our management and our board putting enough emphasis on the intelligence component to make a more effective risk-based decision?
00:06:22.560 --> 00:06:29.120
Yeah, so look, there's, you know, years ago there were questions around what is the value of threat intelligence?
00:06:29.279 --> 00:06:38.480
And there's a lot of questions around, or statements around whether or not organizations cared who actually hacked into them, because at the end of the day, they were getting hacked into.
00:06:38.879 --> 00:06:43.920
You know, we were arguing for the concept of threat intelligence for a number of reasons.
00:06:44.079 --> 00:06:58.560
Number one is if you know who the adversary is and you see that adversary at multiple different victim environments, you can anticipate what they've probably done in whatever organization that you are just starting to help with.
00:06:58.720 --> 00:07:10.079
So you can kind of anticipate what systems the attacker go to, what tooling do they use, what infrastructure they maybe use, and it helps accelerate the incident response process.
00:07:10.399 --> 00:07:17.759
Number two, you know, every so often, depending on who the adversary is, uh, you may be able to identify who the threat actor is.
00:07:17.920 --> 00:07:25.920
You may be able to work with law enforcement, and law enforcement might be able to take action on these criminals, whether it's a criminal actor or even a state actor.
00:07:26.079 --> 00:07:35.040
And so a number of things have been done to cause consequences to these adversaries that are, you know, that are causing harm to a number of organizations and individuals.
00:07:35.439 --> 00:07:46.000
Threat intelligence is important from a board perspective because it's important for the directors to understand what are the real world threats to an organization that they sit on the boards of.
00:07:46.240 --> 00:07:57.040
And the real world threats drive a lot of the actual investments so that these organizations can understand what they need to do to draw down risk as best they can.
00:07:57.279 --> 00:08:00.959
But that has to be correlated with what the real world threats are.
00:08:01.199 --> 00:08:26.560
So if you think about maybe what a healthcare organization has to deal with from a threat perspective, versus, say, a manufacturing organization, there's certainly some commonality between threats, but there's also a number of differences that will help the organization figure out what is the right amount of risk to drive down so that an organization can be pragmatic and just smart about the security investments.
00:08:26.879 --> 00:08:30.399
Management will always ask, let me be a little more specific.
00:08:30.560 --> 00:08:35.919
A chief information security officer will always ask for as much budget as they could possibly get.
00:08:36.159 --> 00:08:43.440
It's up to a CFO and other members of management to be practical and pragmatic about what's the right level of investment.
00:08:43.600 --> 00:08:54.799
And from a board perspective, they just need to ensure that the right governance structure, an adequate amount of funding is in place to draw down the risk as much as reasonable.
00:08:55.679 --> 00:08:57.120
Yeah, it's a conundrum, isn't it?
00:08:57.279 --> 00:08:58.320
Where do you start and stop?
00:08:58.559 --> 00:09:04.879
Building a pitch of the threat landscape, though, it necessarily requires sharing.
00:09:05.360 --> 00:09:10.320
And I'd be interested in your take on this because you are a commercial enterprise.
00:09:10.559 --> 00:09:18.799
Uh the information that you know is of value to you financially, actually, if if someone's willing to pay you fair intelligence.
00:09:19.039 --> 00:09:26.080
Yet there is this more sort of holistic need for us to be sharing threat intelligence more broadly.
00:09:26.240 --> 00:09:34.960
Now, different cybersecurity, CISO, CISO, CTO, they set up the little communities to chat around this sort of stuff.
00:09:35.519 --> 00:10:05.440
Governments are trying their best to sort of facilitate it, although I have to say in the US at the moment it's hard to see the Cybersecurity Infrastructure and Security Agency making a huge difference given no one's getting paid over there or it's going through a bit of a hard you know, I I look over at the US and think, gosh, um one of our one of the world's sort of leading lights in terms of helping us with our CVE and our vulnerability and patch protections is maybe more concerned about its ultimate survival.
00:10:05.519 --> 00:10:11.120
Uh but how do we how do you think about that threat sharing world?
00:10:11.200 --> 00:10:18.559
And how do we get past the commercial value of that information to a point where the rising tide of source ships?
00:10:19.519 --> 00:10:20.639
For me, I I struggle.
00:10:21.600 --> 00:10:21.919
Sure.
00:10:22.080 --> 00:10:32.159
So look, most cyber security vendors have some kind of threat intelligence capability, and to some extent, it is a differentiator between certain organizations.
00:10:32.639 --> 00:10:42.960
There's a question that I often ask myself or I ask my team in terms of what do we publish publicly versus what do we publish to our Intel subscribers?
00:10:43.279 --> 00:10:52.799
And to me, if there's something that is broadly valuable to the community, I want to publish it so that the world has the benefit of getting access to it for free.
00:10:53.039 --> 00:11:07.279
And of course, look, when we publish things where and when possible, when it makes sense to privately publish it internally to our subscriber, our Threat Intel subscribers, maybe a day early or a few days early.
00:11:07.919 --> 00:11:09.519
There are times where we do that.
00:11:09.679 --> 00:11:14.399
But we publish a lot of public blogs because we want to get this information out to the community.
00:11:14.639 --> 00:11:21.519
And um, you know, ultimately at the end of the day, yes, there is a commercial aspect to the business, but we do fairly well.
00:11:21.679 --> 00:11:29.519
And so we don't need to hoard and protect threat intelligence from the rest of the world.
00:11:29.679 --> 00:11:34.159
We're happy for the world to consume it, we're happy for other security vendors to consume it.
00:11:34.320 --> 00:11:46.879
And actually, some of our best collaboration comes from sharing information with other security vendors because we have different telemetry, we have different visibility into adversarial behaviors, and we do have a shared goal of disrupting adversaries.
00:11:46.960 --> 00:11:51.279
And so to the extent that we're able to share information with each other, look, we're happy to do that.
00:11:51.600 --> 00:11:52.000
Yeah.
00:11:52.240 --> 00:11:56.960
When you look out now, we talk about the threat landscape sort of evolving almost daily.
00:11:57.200 --> 00:12:06.639
Over the last sort of 12 months, we've dealt with a number of social engineering attacks from, you know, 16-year-old kids that originate from the COM.
00:12:06.799 --> 00:12:14.240
Um, we're seeing more and more brash voice-related fishing exercises or fishing.
00:12:14.559 --> 00:12:35.200
We have seen these American-accented individuals or English-accent deliver a socially engineered package which is so convincing that I just can't work out ha based on pure numbers, how we're going to prevent this continuing.
00:12:35.679 --> 00:12:40.399
Yeah, we've got education, of course, uh, and education is uh is is helpful.
00:12:40.480 --> 00:12:46.480
But I suspect no matter how much you educate, with a bit of persistence on the threat side, they will they will get through.
00:12:46.639 --> 00:12:51.200
I I went to DEF CON last year, and I know you've probably been to DEF CON in the past.
00:12:51.279 --> 00:13:02.720
You'll be familiar with the room in which they give the participants 20 minutes to socially engineer their way into organizations and you watch them doing it, which is just a fascinating project on human behaviors and the like.
00:13:02.799 --> 00:13:07.120
But they're invariably successful uh in some during during that period to some degree.
00:13:07.200 --> 00:13:10.080
But uh first of all, how how we how much of this are you seeing?
00:13:10.320 --> 00:13:15.919
How much of this uh social engineering is sort of taking up your space at the moment?
00:13:16.240 --> 00:13:22.639
And the$64 million question: what do we do to protect ourselves from ourselves?
00:13:22.960 --> 00:13:23.279
Sure.
00:13:23.519 --> 00:13:53.360
To answer you, the first part of your question, we see lots of telephone-based social engineering by native English-speaking actors that have Western accents or or or accents maybe in Australia or the UK, where they sound very convincing, where they pretend to be an employee of an IT help desk, and they can trick people into providing credentials or logging into websites that look very legitimate to the point where they're very successful.
00:13:53.519 --> 00:14:02.480
Every single week we learn about new and new victims that um are dealing with very aggressive extortion events related to certain com-related actors.
00:14:02.639 --> 00:14:12.559
Shiny Hunters is one example, but there's other groups like Pink, like Blackfile, and a variety of others that are out there that are employing a very similar tradecraft.
00:14:12.799 --> 00:14:22.080
They develop scripts, they have native English-speaking callers that essentially read through the scripts and convince people to ultimately surrender their credentials.
00:14:22.320 --> 00:14:24.639
You ask the question about sharing threat intelligence.
00:14:24.799 --> 00:14:31.919
One of the reasons why uh the Manding team, we blog about this, is because we want the world to know about these tradecraft.
00:14:32.080 --> 00:14:41.440
And so we actually first observed this kind of most recent round of telephone-based social engineering, which occurred roughly around November 2025.
00:14:41.600 --> 00:14:46.000
And it continued in December and then January, and it continues to this day.
00:14:46.159 --> 00:14:52.879
You know, we see realistically multiple victims that are um that fall victim to these attacks every single week.
00:14:53.039 --> 00:15:02.080
Now, the fact of the matter is the people, the actual individuals that are falling victim to these social engineering attacks, they're not reading the media blogs.
00:15:02.399 --> 00:15:02.960
We get it.
00:15:03.519 --> 00:15:07.600
But we hope that the organizations that they work for are reading the blogs.
00:15:07.919 --> 00:15:13.120
We want them to be aware of what are the actors doing to compromise credentials.
00:15:13.360 --> 00:15:15.360
And then we provide a number of recommendations.
00:15:15.519 --> 00:15:22.000
Some of them are easy, some of them are very hard to help organizations better defend against these types of attacks.
00:15:22.320 --> 00:15:29.679
I'll tell you, it's a very hard thing to implement, but very effective thing to implement is FIDO2 authentication.
00:15:29.919 --> 00:15:37.840
So having some kind of physical device, which um just maybe I'll if I could quickly pull my uh Google Titan key out.
00:15:38.000 --> 00:15:43.440
I don't know how well you could see this, but this is essentially a device that is always plugged into my laptop.
00:15:43.600 --> 00:15:59.519
And when I log into a website, any Google resource, I type in my username, my password, and then it asks me to physically tap the button on the side of my computer or that that device that I just showed you to prove that it's actually me logging into this resource.
00:16:00.000 --> 00:16:11.759
So somebody can't log into a resource on their own laptop, even if I give them a user and a password, because they have to have one of these devices and they have to physically touch the device.
00:16:12.000 --> 00:16:19.919
If they ask me to touch the device, that's not going to do anything because um they are not logging into the website for my device.
00:16:20.320 --> 00:16:23.519
So I say this is hard, it's hard from a deployment perspective.
00:16:23.840 --> 00:16:31.120
So for people that all work in a corporation that might go into an office, okay, that might be relatively easy.
00:16:31.360 --> 00:16:36.960
But just look at a retail environment where you have a number of associates that work in a store.
00:16:37.360 --> 00:16:41.120
Realistically, most of these people may not even check a corporate email address.
00:16:41.279 --> 00:16:42.960
Many of them may not even have a laptop.
00:16:43.039 --> 00:16:47.279
And so deploying FIA2 authentication to them is obviously much more difficult.
00:16:47.519 --> 00:16:51.600
And then if you just remember the size of the device that I showed you, it's very small.
00:16:51.840 --> 00:16:55.360
It could easily fall out of, well, maybe it could fall out of a laptop.
00:16:55.440 --> 00:17:00.960
Um it actually hasn't fallen out of mine in the last uh you know, roughly six years or so since I've been using it.
00:17:01.120 --> 00:17:09.920
And one thing that I found is that it is much more convenient for me to log into a website because of this device, as opposed to what I had to do before.
00:17:10.079 --> 00:17:20.960
Before what I had to do is I had to load my phone, use my thumbprint, load up the duo application, get a six-digit code, and then go back to my keyboard and type in that six-digit code.
00:17:21.279 --> 00:17:22.319
That was inconvenient.
00:17:22.400 --> 00:17:27.200
It's a lot easier for me to tap into one of these little keys, a Yubi key or a Google Titan key.
00:17:27.440 --> 00:17:35.119
So, anyway, so the key point here is the end user at some point in time will fall victim to a social engineering attack.
00:17:35.519 --> 00:17:44.480
But what's our responsibility is that we are building enough other controls to minimize the impact of somebody falling victim to a social engineering attack.
00:17:44.640 --> 00:17:59.119
So, for example, if we rolled out FIDO2 authentication, then it becomes very, very hard for somebody to successfully social engineer an employee of a company and actually be able to log into whatever resource they're trying to log into.
00:17:59.839 --> 00:18:00.160
Yeah.
00:18:00.319 --> 00:18:06.720
Like I said, no matter how much you educate, no matter how much you we we speak about this just on pure numbers alone.
00:18:06.880 --> 00:18:10.799
And I've heard the transcripts and I've heard the recordings.
00:18:10.960 --> 00:18:15.359
Uh they're a tough listen, right, when you hear someone being manipulated.
00:18:15.519 --> 00:18:22.799
That's why it's so important for us to acknowledge that no matter what we do, there will still be that five or ten percent that will still uh fall through it.
00:18:22.960 --> 00:18:31.279
I mean I bought four tickets to Coldplay uh about a year and a half ago of someone who never delivered them, actually through my daughter.
00:18:31.440 --> 00:18:34.160
My daughter was doing it, but I was like, yeah, we should definitely do that.
00:18:34.400 --> 00:18:37.279
So it's disappointing for a lot of reasons.
00:18:37.359 --> 00:18:38.000
Uh yeah, yeah.
00:18:38.799 --> 00:18:40.640
It would have been a great show if you had a chance to go.
00:18:41.200 --> 00:18:41.680
That's true.
00:18:42.960 --> 00:18:50.880
One one thing I'm I'm grappling with a little bit at the moment, Charles, is whether whether I think fatigue is building it in around cyber.
00:18:51.039 --> 00:18:52.400
This thing goes in waves.
00:18:52.480 --> 00:19:01.279
Um and quite often it is it goes through a lull where perhaps we haven't seen as much in the media as what's actually occurring.
00:19:01.519 --> 00:19:13.440
We start to get a bit jaded about not seeing return on investment and in relation to cyberspend, uh, because it's it's a little bit like trying to see a return on investment by seeing nothing occur.
00:19:13.599 --> 00:19:17.519
That that's a key to a success, and how do you measure that success?
00:19:18.240 --> 00:19:19.599
Are you are you seeing that?
00:19:19.680 --> 00:19:28.319
And if so, uh how do we keep boards, senior management teams energized about this risk?
00:19:28.720 --> 00:19:29.119
Yeah.
00:19:29.359 --> 00:19:46.079
Uh so what one thing that I I try my best to do when I speak to management or boards or or or chief information security officers is I don't want them to feel that no matter what they do, they'll still be compromised.
00:19:46.319 --> 00:19:54.480
Because then we start to develop this defeatist mentality and we start to kind of throw our hands up in the air and we just kind of give up and we we stop putting in the effort.
00:19:55.279 --> 00:20:00.880
There are a lot of things that we can do to mitigate the risk and the impact of cyber attacks.
00:20:01.200 --> 00:20:03.599
There's a number of layers of controls that we could put in place.
00:20:03.759 --> 00:20:07.279
There's a number of defenses, there's increased telemetry.
00:20:07.440 --> 00:20:11.759
And the fact of the matter is, many adversaries are opportunistic.
00:20:11.920 --> 00:20:15.759
You know, many adversaries don't wake up in the morning saying, I want to hack into Company X.
00:20:16.240 --> 00:20:18.400
It's a bit of an opportunity for them.
00:20:18.559 --> 00:20:24.640
They're scanning the internet looking for vulnerabilities, they're sending hundreds of thousands of phishing emails to people.
00:20:24.880 --> 00:20:31.039
There are times where certain threat actors say, hey, I'm going to try to social engineer employees of a so-and-so company.
00:20:31.119 --> 00:20:39.759
But but in general, there's a lot of opportunistic attacks that you could avoid dealing with an opportunistic attack with a number of foundational security controls.
00:20:39.839 --> 00:20:42.240
So I think that continues to be really important.
00:20:42.640 --> 00:20:48.160
Now, to your point about the fatigue around breach disclosures, look, we hear about a breach disclosure all the time.
00:20:48.480 --> 00:20:50.480
Do we really think that much about it?
00:20:50.720 --> 00:21:01.519
Sometimes, maybe if it's a brand that we use a lot or we care a lot about, maybe if it's um, you know, an organization that lost very sensitive information, maybe.
00:21:01.839 --> 00:21:02.799
But yeah, you're right.
00:21:02.880 --> 00:21:04.799
There is a little bit of a sense of fatigue.
00:21:04.960 --> 00:21:08.400
Now, what I'll tell you, just so you have a view into the US.
00:21:08.559 --> 00:21:14.960
So, as I'm sure you know, a few years ago there was a major health payer in Australia that had a security event.
00:21:15.200 --> 00:21:20.799
Very, very sensitive data was unfortunately released, data that should have never been published to the world.
00:21:21.039 --> 00:21:30.400
And as you think about that, the people who were impacted said the harm was imposed upon us as the insureds, as opposed to the company.
00:21:30.720 --> 00:21:34.559
And that actually drove a lot of change in the United States.
00:21:34.720 --> 00:21:51.200
What I found was for about two years after that healthcare payer incident in Australia, in the U.S., we found that a number of healthcare organizations ended up paying extortion demands to reduce the likelihood of very sensitive health information being published on the internet.
00:21:51.759 --> 00:21:56.240
That was somewhat of a direct reaction to what actually happened in Australia.
00:21:56.400 --> 00:21:57.759
We paid attention in the U.S.
00:21:57.920 --> 00:21:59.759
So there have been major security events.
00:22:00.160 --> 00:22:07.440
In the US, where other health payers lost very sensitive data for a large portion of Americans.
00:22:07.839 --> 00:22:15.519
And unfortunately, extortion payments had to be made again to reduce the likelihood of that stolen data being published on the internet.
00:22:16.960 --> 00:22:22.799
I wonder whether that company, if it had its time again, Charles, would do things slightly differently.
00:22:23.279 --> 00:22:33.279
Because to so publicly go out with the messaging, which was that messaging in and of itself was troublesome, but that payment would not be made.
00:22:33.519 --> 00:22:49.440
And then for individuals, news agencies, journalists to trawl the dark web and find this information and then use it as a rolling headline, it was sort of catastrophic, really, f uh in many respects.
00:22:49.519 --> 00:22:51.440
It brought out the worst in all of us.
00:22:52.000 --> 00:22:55.519
We've got many other mitigation things to put in place nowadays to sort of help with that.
00:22:55.680 --> 00:23:00.000
So I'm saying here in Australia that that company did a great thing.
00:23:00.240 --> 00:23:08.720
They stared down, notwithstanding the sensitivity, and set the bar for when a company would pay or not pay.
00:23:09.440 --> 00:23:10.640
Rightly or wrongly.
00:23:10.880 --> 00:23:12.640
From your experience, it's the opposite.
00:23:12.720 --> 00:23:19.279
It's actually moved the dial the other way for organizations in the US where they say, look, you know what, it's actually worth paying here.
00:23:19.680 --> 00:23:20.079
Yeah.
00:23:20.559 --> 00:23:26.000
The bottom line is this a lot of people were negatively impacted by these cyber attacks.
00:23:26.160 --> 00:23:28.720
It was tough on the insurer, it was tough on the insureds.
00:23:28.880 --> 00:23:30.880
It's an awful situation for a lot of folks.
00:23:31.839 --> 00:23:47.519
And by the way, you know, the the other thing that maybe perpetuated this problem was that because it became known that health insurers and healthcare providers ended up paying extortion demands, it actually increased the frequency of a number of attacks against other healthcare organizations.
00:23:47.680 --> 00:23:51.039
And so ultimately, look, what's the right and wrong answer?
00:23:51.119 --> 00:23:51.680
I don't know.
00:23:52.000 --> 00:23:54.880
It depends on each situation.
00:23:55.119 --> 00:23:59.599
And ultimately, what you're trying to do is you're trying to minimize the amount of negative impact.
00:23:59.759 --> 00:24:12.480
But there's always going to be some level of negative impact to somebody, whether it's the actual company themselves or the customers, the insurance, the business partners, it usually there's some negative consequences to some some number of people.
00:24:12.880 --> 00:24:14.480
Yeah, it's fascinating, isn't it?
00:24:15.119 --> 00:24:20.480
People often ask me, do you think we're sort of winning the war here with this particular adversary?
00:24:20.559 --> 00:24:29.440
And it's And I look at it and think, well, you know, we've been fighting physical crime since time immemorial, and I don't think we've managed to crack that yet.
00:24:29.599 --> 00:24:34.480
And not suggesting we don't we're not making good headway, whether it's disruptive activity or otherwise.
00:24:34.640 --> 00:24:37.599
But people talk to me and they said, Well, what about the sanctions?
00:24:37.680 --> 00:24:40.079
We've arrested Vladimir.
00:24:40.240 --> 00:24:43.440
He's been arrested based on this analysis.
00:24:43.599 --> 00:24:58.799
And my response is, well, it's a little bit like saying we've managed to arrest a burglar who's burgled a house in our suburb, and I think we've now got a pretty good handle on the global burglary problem that we have.
00:24:59.200 --> 00:25:05.440
Look, from my perspective, I feel like there are periods of time where there's a lot of great law enforcement actions.
00:25:05.599 --> 00:25:05.759
Yeah.
00:25:05.920 --> 00:25:17.519
A number of disruptions of adversaries, disruptions of threat campaigns, seizures of funds and threat actor infrastructure, maybe arrests, indictments, sanctions, whatnot, of actors.
00:25:17.759 --> 00:25:26.799
And I don't think that's year-round, but there are periods of time where I get really excited by the actions that law enforcement takes against uh threat actors.
00:25:27.039 --> 00:25:32.799
And I hear a lot of criticism of law enforcement for not doing enough.
00:25:33.359 --> 00:25:34.480
Now, could they do more?
00:25:34.640 --> 00:25:42.960
Look, I think we all want more actions to be taken, especially when there's a number of actors that we know who exactly they are, where they where they live.
00:25:43.119 --> 00:25:47.039
I get it, it's complicated, but I would like to see a little bit more actions.
00:25:47.440 --> 00:25:49.119
But I do celebrate the wins.
00:25:49.279 --> 00:25:51.359
I do celebrate the law enforcement actions.
00:25:51.519 --> 00:26:00.799
And from my perspective, I feel that if there were no law enforcement actions, the amount of crime that we deal with would be exponentially higher than what we're dealing with today.
00:26:01.440 --> 00:26:06.720
Look, I'll tell you, if you remember back, it was 2021 when Colonial Pipeline had a security event.
00:26:06.799 --> 00:26:06.960
Yep.
00:26:07.200 --> 00:26:18.240
And then R Eagle had compromised a technology company in the United States, and they they ultimately encrypted somewhere between 1,000 and 1,500 companies.
00:26:18.480 --> 00:26:22.640
There are so many really positive law enforcement actions that occurred.
00:26:23.200 --> 00:26:30.960
The extortion payment that Colonial Pipeline made to the threat actor was obtained by law enforcement.
00:26:31.039 --> 00:26:35.920
So they basically stole the funds, the cryptocurrency from the threat actor.
00:26:36.160 --> 00:26:41.119
Our evil campaign against that technology company that impacted about a thousand or 1,500 companies.
00:26:41.359 --> 00:26:52.079
Law enforcement was able to get access to a universal decryptor for that particular threat campaign and gave it to as many victims as they could get a hold of for free to decrypt data.
00:26:52.319 --> 00:26:56.559
They made a lot of arrests, they indicted a number of people, they seized a lot of infrastructure.
00:26:56.799 --> 00:27:03.599
By the end of 2021, there were a number of adversaries that were really questioning whether they should continue doing this.
00:27:03.759 --> 00:27:06.720
Because some of these folks, you know, they had families, they have kids.
00:27:06.880 --> 00:27:08.160
This is a job for them.
00:27:08.319 --> 00:27:10.720
And this job became very risky.
00:27:11.039 --> 00:27:23.440
Now, I believe that if law enforcement continued to take actions all throughout the years in 2022 and onward, I think a number of threat actors would be too scared to continue doing their operations.
00:27:23.680 --> 00:27:25.839
Unfortunately, there's a lot of starts and stops.
00:27:26.000 --> 00:27:36.400
And I am I'm very hopeful and optimistic that there will see a number of really good, notable arrests and law enforcement actions which will curb the intrusion activity to some extent.
00:27:36.880 --> 00:27:37.519
Yeah, okay.
00:27:37.680 --> 00:27:38.640
I'm hopeful too.
00:27:38.880 --> 00:27:40.480
Quick question on geopolitics.
00:27:40.720 --> 00:27:42.559
What do I mean by geopolitics?
00:27:42.720 --> 00:27:44.400
Uh it means a lot of things, doesn't it?
00:27:44.559 --> 00:28:04.000
Whether it's conflicts, whether it's sort of unstable economies, whether it's East and West, you know, authoritarian regimes, whether it's the mood of the White House when it wakes up in the morning, uh where do you see the largest challenge on the on the geopolitical front coming from?
00:28:04.240 --> 00:28:14.960
When you see something occur, what what what is that something that says, look, we're probably going to be in for a little bit of a spike in what we uh in the attacks for this reason.
00:28:15.519 --> 00:28:19.039
Let me focus on the ANZ part of the world first.
00:28:19.920 --> 00:28:29.359
If China invades Taiwan, I think ANZ and a few other parts of the world will probably deal with a surge in cyber intrusion activity.
00:28:29.599 --> 00:28:40.000
And part of that could just be because uh the PRC is really focused on understanding what would Australia would do if uh China invaded Taiwan.
00:28:40.240 --> 00:28:47.200
Same thing with the United States, the United Kingdom, and a variety of other nations that don't want China to invade Taiwan.
00:28:47.599 --> 00:28:53.200
So I think that is something that could potentially increase the amount of intrusion activity.
00:28:53.599 --> 00:29:01.599
The other thing that it could potentially do, and the big thing that we're worried about in the United States, is we know that the PRC has access to a lot of critical infrastructure in the US.
00:29:02.079 --> 00:29:08.160
And we know that they technically have the access to cause disruptions to critical infrastructure.
00:29:08.720 --> 00:29:09.599
They haven't done that.
00:29:10.240 --> 00:29:12.559
They operate under strict rules of engagement.
00:29:13.039 --> 00:29:15.359
Now, will something change?
00:29:15.519 --> 00:29:19.359
Will the rules change if there's a current war going on?
00:29:19.759 --> 00:29:22.400
That is a question that a number of us are pretty concerned about.
00:29:22.559 --> 00:29:27.599
Um you'll find that the White House is is increasingly concerned about uh about that.
00:29:28.720 --> 00:29:35.680
Other things that could potentially impact the ANZ part of the world, or really any other conflict that's going on.
00:29:35.839 --> 00:29:46.880
I think right now Australia may not have felt a lot of the outcomes of increased geopolitical tensions in the Middle East or in Russian Ukraine because other parts of the world were dealing with that.
00:29:47.119 --> 00:29:56.720
So when Russia invaded Ukraine, what we found was that Russia was mostly putting all their effort, all their cyber effort, against organizations in Ukraine.
00:29:56.799 --> 00:30:00.480
And there's only so much offensive cyber capacity that they had.
00:30:00.559 --> 00:30:04.559
Um so we didn't really see a whole lot of cyber attacks anywhere else in the world.
00:30:04.799 --> 00:30:18.480
With what's going on in the Middle East right now, we see a lot of intrusion activity in the Middle East, a lot of intrusion activity targeted towards Israeli organizations and other organizations in other countries, neighboring countries.
00:30:18.640 --> 00:30:21.680
And then we also obviously see targeting of U.S.
00:30:21.920 --> 00:30:22.559
organizations.
00:30:22.799 --> 00:30:36.799
And the really important thing to note is uh some of these Iranian actors, uh, while they certainly have cyber offensive capabilities, they also really embellish what they've done and what they have access to.
00:30:37.039 --> 00:30:39.279
And so they operate in half-truths.
00:30:39.359 --> 00:30:46.640
So we have to be careful when we investigate to try to really understand what actually did they do versus what they said they did.
00:30:46.799 --> 00:30:51.039
And it's usually a portion of what they said they did, that they actually did.
00:30:51.440 --> 00:30:52.079
Yeah.
00:30:52.720 --> 00:31:00.880
It's pretty scary stuff, isn't it, when you think about a nation-state positional attacks, someone in your organization quietly waiting for something.
00:31:01.119 --> 00:31:03.039
And who really knows what that is.
00:31:03.519 --> 00:31:07.680
Just to take a step back for a second, uh, two more questions for you, Charles.
00:31:07.759 --> 00:31:09.200
Uh we talked about social engineering.
00:31:09.359 --> 00:31:14.079
Social engineering is in many respects one of the most basic ways of getting yourself into an organization.
00:31:14.160 --> 00:31:20.640
It's and it is being done by the the the kid in the hoodie in mum's basement again, th the the back.
00:31:20.799 --> 00:31:27.200
Um but so too is basic security and physical security, like tailgating into businesses and the like.
00:31:27.599 --> 00:31:43.680
Have you been sort of surprised to see the simplification of these attacks down to what really kind of existed 20, 30 years ago, the social engineering and sort of physical tailgating intrusions?
00:31:44.319 --> 00:31:54.240
So for social engineering, when we first started seeing the surge in it, it was roughly when Scattered Spider started targeting organizations.
00:31:54.319 --> 00:32:00.640
And then I forget exactly what year that was, but it was you know, roughly around 2021, 2022-ish time frame.
00:32:01.599 --> 00:32:09.599
And I remember thinking at the time they were employing this tradecraft that was very effective.
00:32:09.920 --> 00:32:18.480
And they were doing things that a lot of us used to do back when we were doing penetration tests against organizations many years ago.
00:32:18.640 --> 00:32:31.119
And I remember at the time thinking, you know, and this is roughly around, you know, when I was doing a lot of offensive security work and penetration testing, it was roughly around like the 2002 to maybe 2012 time frame.
00:32:31.440 --> 00:32:37.440
I remember thinking when I pick up the phone and I call somebody to socially engineer them as part of a penetration testing engagement.
00:32:37.599 --> 00:32:40.480
I kind of thought to myself at times, who's actually going to do this?
00:32:40.559 --> 00:32:46.240
Like what adversary is actually gonna pick up the phone and try to trick somebody into providing their credentials?
00:32:46.480 --> 00:32:52.400
And so there was a part of me that felt like, look, it's helpful that we're doing this, but look, real world adversaries don't do this.
00:32:52.640 --> 00:33:04.880
And realistically, I don't think I ever saw any real world adversary at any scale, actually, from like 2002 to I don't know, 2021, actually pick up the phone and call somebody.
00:33:05.519 --> 00:33:12.000
And there was this period of time where I actually started telling my team, I don't know if we need to keep picking up the phone and calling people.
00:33:12.079 --> 00:33:16.480
It's just, it's not a really and by the way, this is around like maybe 2017, 2018.
00:33:16.559 --> 00:33:19.759
So this is not really how adversaries are actually breaking into networks.
00:33:20.000 --> 00:33:22.400
And so I was kind of right, but I was also kind of wrong.
00:33:22.480 --> 00:33:26.400
I I I didn't anticipate that this would become a really become a thing.
00:33:26.559 --> 00:33:27.519
And it has become a thing.
00:33:27.599 --> 00:33:34.960
Obviously, it's become a very big thing, and it's been it's increasingly becoming a more and more important thing for us to defend against.
00:33:35.440 --> 00:33:42.240
As it relates to physical access to buildings, in the early 2000s, we saw a decent amount of that.
00:33:42.400 --> 00:34:05.039
I mean, people were sitting in a parking lot of a retail store pointing a Yagi antenna, which is a long antenna, and just literally pointing it at, you know, from their car, pointing it at a retail store and capturing credit card numbers that were traversing through a point of sale system to what's usually called an in-store processor, which is a server in the back of the store with unencrypted credit card numbers.
00:34:05.119 --> 00:34:11.039
And so they were physically acquiring credit cards by physically sitting in a parking lot at a retail store.
00:34:11.199 --> 00:34:14.880
And a number of these folks were over time, they were caught and arrested.
00:34:15.119 --> 00:34:20.719
And then we didn't see too much physical related or proximity-based intrusion activity.
00:34:20.880 --> 00:34:21.599
We saw some of it.
00:34:21.760 --> 00:34:31.840
I mean, APT-28 was a good example where we saw them physically in hotels, compromising hotel networks, and then using that to get access to high-value target systems.
00:34:31.920 --> 00:34:34.559
Um, and there are a few other public cases around that.
00:34:34.719 --> 00:35:09.519
But recently, uh, and this might be what you were alluding to, um, there's a there's a situation where we saw a particular threat actor targeting a number of professional services organizations, where for a small percentage of them, there are humans that kind of trick their way into a building, pretended to be part of the IT help desk, and physically get access to victim computers, plug in thumb drives, external hard drives, and then copy over data from the laptops of the individuals working at these professional services organizations.
00:35:09.760 --> 00:35:11.280
So we saw that this year.
00:35:11.599 --> 00:35:20.800
And as we started seeing that a little bit more often, we thought to ourselves, hey, we saw this last year, but we weren't sure if this was actually directly connected to these security incidents.
00:35:20.960 --> 00:35:31.440
So we started going back and realizing, hey, actually, this happened a few other times that we didn't quite have enough concrete data to tie it to these security incidents.
00:35:31.519 --> 00:35:38.960
Um, but now that we see the bigger picture and we see more cases, now we are tying it back to um uh back to the cyber activity.
00:35:39.199 --> 00:35:43.599
Now, the reason why I'm surprised is because there's real physical consequences.
00:35:43.760 --> 00:35:46.719
You know, your face is getting caught by cameras.
00:35:46.880 --> 00:35:49.599
You're physically entering a building that has security in it.
00:35:49.760 --> 00:35:54.159
And so at some point in time, you are going to increase the likelihood of you getting arrested.
00:35:54.320 --> 00:35:58.159
Now, the people that are doing this, we don't think they're actually the hackers.
00:35:58.320 --> 00:36:07.840
We think that they might be outsourced mules that are coming in, that are following a script and doing what it is that the threat actor is telling them to do, and they're getting paid some cut.
00:36:07.920 --> 00:36:10.320
So do they know that they're doing something really illegal?
00:36:10.480 --> 00:36:18.079
I think they know they're doing something illegal, but I don't think they're actually the guys or or gals that are on keyboard actually doing the hacking activity.
00:36:18.559 --> 00:36:19.119
Yeah.
00:36:19.440 --> 00:36:26.880
Remember the days when you'd you'd chuck the old USB outside the front of the building to see who picked it up and put it in their laptop as part of your pen physical picture.
00:36:27.119 --> 00:36:28.559
We did that in pen tests, yeah.
00:36:28.719 --> 00:36:28.960
Yeah.
00:36:29.679 --> 00:36:30.159
Crazy.
00:36:30.400 --> 00:36:31.519
Hey, final question.
00:36:31.679 --> 00:36:32.960
You must deal with a lot of lawyers.
00:36:33.360 --> 00:36:34.159
America was.
00:36:34.400 --> 00:36:34.559
Yeah.
00:36:34.800 --> 00:36:36.719
Yeah, well, congratulations.
00:36:37.760 --> 00:36:54.239
The role of the lawyer has changed a lot over the last five or six years, and the role of the lawyer has moved from sort of pure legal advice and sort of and also this illusion of legal professional privilege, which has largely been the power of it has been dispelled somewhat.
00:36:54.480 --> 00:37:00.400
But I still find myself often at the center of a an incident.
00:37:00.719 --> 00:37:06.400
So my question to you in that circumstance, what should I be doing?
00:37:06.480 --> 00:37:08.480
What what does a good lawyer look like?
00:37:08.639 --> 00:37:08.960
Yeah.
00:37:09.199 --> 00:37:10.639
In an incident response?
00:37:11.199 --> 00:37:42.480
The the lawyers that I love working with can have a very plain English language conversation with executives at the victim organization, and in just very plain English, help them understand what's going on, what's the risk associated with the security event, and talk to them in a very rational way, where you're thinking about protecting your client, but you're talking to them in a way that they could just simply understand what's going on.
00:37:42.719 --> 00:37:56.559
What I find that sometimes since in a response companies struggle with is they're so obsessed with the technical bits and bytes that they sometimes struggle to communicate in just a plain old English language to somebody who's not a cyber expert.
00:37:56.719 --> 00:38:03.280
And being able to talk at the right level in the language that people understand is really important.
00:38:03.440 --> 00:38:08.320
And I find that lawyers like yourself and you know members of your team do a great job of.
00:38:08.880 --> 00:38:09.840
Yeah, really important.
00:38:10.000 --> 00:38:11.440
It's a great takeaway, isn't it?
00:38:11.599 --> 00:38:21.440
We we often find that if one of our most significant contributions in the room can just bring a calmness to a room which is otherwise sort of chaotic.
00:38:21.679 --> 00:38:30.800
And and and maybe there's something inherent in the logic of how we've been trained to deal with crises, you know, logically work our way through a crisis.
00:38:30.960 --> 00:38:41.760
And I'm pleased it's acknowledged actually, because there have certainly been meetings where I've felt the technology or forensic teams have left the board and the board have left, and neither have really fully understood one another.
00:38:42.639 --> 00:38:44.239
I can guarantee they didn't, you know.
00:38:44.320 --> 00:38:46.559
It's like, I think we might need another briefing here.
00:38:46.800 --> 00:38:59.119
Anyway, hey uh Charles, congratulations on not just a remarkable career, but building a profile around your name, which is obviously respected by the community, but also sort of generates interest.
00:38:59.280 --> 00:39:04.800
Your emails, your contributions that you make when you push your notifications out mean a lot to people.
00:39:04.880 --> 00:39:12.000
And it's because what you've done in the past is you've built credibility by delivering things which are of use.
00:39:12.559 --> 00:39:16.079
Thank you very much for that broader contribution that you bring to the industry.
00:39:16.159 --> 00:39:23.760
It's you may well be sitting over there in the US, but your contribution is felt very deeply and and you're deeply respected in this part of the world too, and I'm sure in other parts.
00:39:23.920 --> 00:39:24.800
So thank you very much.
00:39:24.880 --> 00:39:32.639
And that and that's why it's always a privilege for us to have a guest of your quality on our podcast, and our uh our listeners will be very grateful too.
00:39:32.719 --> 00:39:34.639
So thank you very much, Charles.
00:39:34.800 --> 00:39:36.719
I very much appreciate it.
00:39:36.880 --> 00:39:37.760
All right, all the best.
00:39:38.559 --> 00:39:38.800
Thank you.
00:39:38.960 --> 00:39:39.599
You take care.
00:39:39.760 --> 00:39:40.559
Bye-bye.
00:39:41.840 --> 00:39:47.360
Thanks again for tuning in to Cross Examining Cyber, a podcast brought to you by Herbert Smith Free Hills Kramer.
00:39:47.760 --> 00:39:54.719
In our next episode, we cross-examine David Gonsky, one of Australia's most respected business leaders and board directors.
00:39:54.960 --> 00:39:59.039
David brings a clarity to cybersecurity like very few directors can.
00:39:59.199 --> 00:40:00.559
It's a great episode.
00:40:00.880 --> 00:40:04.880
Thank you again, Charles, for your time today, and thank you all for listening.