UDSKRIFT 🔗
1
00:00:02,100 --> 00:00:05,940
Hundreds of domains that were malicious
have been seized and sinkhole that has
2
00:00:05,940 --> 00:00:09,270
allowed additional intelligence gathering
to happen from the traffic that's
3
00:00:09,270 --> 00:00:12,330
going on in there as well,
which has really been great.
4
00:00:19,950 --> 00:00:22,980
Hello and welcome to Healthcare
Strategies. I'm Jill McKeon,
5
00:00:22,980 --> 00:00:27,000
associate editor of Health Tech Security.
Today we're joined by Bob Erdman,
6
00:00:27,420 --> 00:00:30,000
associate Vice President
Research and Development at Fort.
7
00:00:32,910 --> 00:00:33,743
Welcome Bob.
8
00:00:33,780 --> 00:00:34,320
Thank you.
9
00:00:34,320 --> 00:00:37,950
So today we're diving into a really
interesting topic for some background for
10
00:00:37,950 --> 00:00:40,020
our listeners. In 2023,
11
00:00:40,080 --> 00:00:44,550
Fort teamed up with Microsoft's Digital
Crimes Unit and the health Information
12
00:00:44,550 --> 00:00:48,840
Sharing and analysis center or Health
ISAC to crack down on abuse of Cobalt
13
00:00:48,840 --> 00:00:49,230
Strike,
14
00:00:49,230 --> 00:00:53,640
which is a legitimate security tool that
cyber threat actors have been abusing
15
00:00:53,700 --> 00:00:58,320
illegal copies of to perpetrate cyber
attacks against organizations in many
16
00:00:58,320 --> 00:01:03,150
sectors, including Healthcare. Fort
acquired Cobalt Strike back in 2020.
17
00:01:03,630 --> 00:01:05,190
Then in March, 2025,
18
00:01:05,190 --> 00:01:09,540
after two years of this partnership
between Fort Microsoft and Health ISAC
19
00:01:10,140 --> 00:01:14,130
Fort reported that the
number of unauthorized copies
of Cobalt Strike observed
20
00:01:14,130 --> 00:01:17,790
in the wild had decreased by
80% over the last two years.
21
00:01:18,210 --> 00:01:21,480
So today we're going to speak with
Bob about Cobalt strike abuse,
22
00:01:21,480 --> 00:01:26,100
these successful efforts to crack down
on it and just the value of partnerships
23
00:01:26,100 --> 00:01:29,280
like this one in the world
of cybersecurity. So Bob,
24
00:01:29,280 --> 00:01:32,640
it'd be great if you could
start by telling us a little
bit about Cobalt Strike
25
00:01:32,640 --> 00:01:35,460
and what it's traditionally
used for in the security world.
26
00:01:35,820 --> 00:01:36,480
Sure.
27
00:01:36,480 --> 00:01:41,280
So Cobalt Strike is a cybersecurity
tool used by organizations to
28
00:01:41,310 --> 00:01:46,020
test their defenses and harden them
against any kind of malicious activities
29
00:01:46,020 --> 00:01:48,210
that may be directed towards them.
30
00:01:48,780 --> 00:01:52,920
Cobalt Strike's licensing allows for
lawful and ethical penetration testing and
31
00:01:52,920 --> 00:01:57,690
red team activities and actually forbids
use by military law enforcement or
32
00:01:57,690 --> 00:02:02,580
intelligence gathering types of use cases
and cobalt strikes generally used in
33
00:02:02,580 --> 00:02:06,840
an assumed breach type of scenario where
an organization is either we're going
34
00:02:06,840 --> 00:02:10,080
to assume that we've already been breached
or at some point we're going to be
35
00:02:10,080 --> 00:02:10,913
breached.
36
00:02:10,950 --> 00:02:14,190
It differs a little bit from standard
penetration testing where we're just
37
00:02:14,190 --> 00:02:18,450
looking to find as many vulnerabilities
and open doors and windows as we can
38
00:02:18,450 --> 00:02:19,170
find,
39
00:02:19,170 --> 00:02:23,010
and we're actually looking to test fairly
specific scenarios about how a threat
40
00:02:23,010 --> 00:02:25,920
actor might behave once they gain
access to somebody's environment.
41
00:02:26,190 --> 00:02:30,240
Definitely. Yeah, so it sounds like a
really useful tool on the defense side,
42
00:02:30,300 --> 00:02:34,260
but I know that there's been a history
of threat actors abusing legitimate
43
00:02:34,260 --> 00:02:37,770
tools, not just Cobalt Strike,
but other tools as well.
44
00:02:37,920 --> 00:02:41,100
So I'm curious what makes
those tactics successful?
45
00:02:41,250 --> 00:02:45,510
How does abusing a legitimate tool like
Cobalt Strike allow threat actors to
46
00:02:45,510 --> 00:02:47,460
really succeed in their efforts?
47
00:02:48,030 --> 00:02:50,010
As you mentioned, unfortunately,
48
00:02:50,070 --> 00:02:53,670
there's always malicious use of all of
the different tools that are out there.
49
00:02:53,670 --> 00:02:57,600
Cobalt Strike included, the heavy
lifting is being done by somebody else.
50
00:02:57,600 --> 00:03:00,730
So we're developing a tool being
used for certain types of scenarios,
51
00:03:00,730 --> 00:03:02,890
and if they can get ahold
of it and repurpose it,
52
00:03:02,890 --> 00:03:05,860
they're going to use those
tools for malicious uses.
53
00:03:06,010 --> 00:03:10,270
Just like when they would abuse email
service deliveries for phishing or
54
00:03:10,270 --> 00:03:14,410
offensive tools for pen testing or
cobalt strike tools for red teaming,
55
00:03:15,040 --> 00:03:18,940
the way that they're being breached is
very similar to the way that they're
56
00:03:18,940 --> 00:03:22,480
being tested. So those threat actors,
if they can get ahold of these tools,
57
00:03:22,480 --> 00:03:25,480
then of course can repurpose
them for their malicious designs.
58
00:03:25,750 --> 00:03:27,790
And that's definitely something
that we're doing our best,
59
00:03:27,790 --> 00:03:29,830
along with many other
entities to crack down on.
60
00:03:30,280 --> 00:03:35,050
So the use of these tools that
makes it harder for teams to
61
00:03:35,050 --> 00:03:37,060
detect when these threat
actors are there. It.
62
00:03:37,120 --> 00:03:38,620
Makes it harder to defend, of course.
63
00:03:38,630 --> 00:03:40,780
So it makes it easier on the
threat actors of course, too,
64
00:03:40,780 --> 00:03:44,380
because they don't have to necessarily
develop as much of their own
65
00:03:44,380 --> 00:03:46,330
Load full transcript
infrastructure around these things.
66
00:03:46,330 --> 00:03:50,440
If they can insert commercial pieces or
open source pieces that do some of the
67
00:03:50,440 --> 00:03:51,273
same things,
68
00:03:51,550 --> 00:03:54,430
that just makes it a little easier
for them to do what they're doing.
69
00:03:54,730 --> 00:03:57,970
For sure. And I'm curious with
Cobalt Strike specifically,
70
00:03:58,360 --> 00:04:03,220
how widespread was abuse of this
tool before that partnership formed
71
00:04:03,220 --> 00:04:04,750
in 2023?
72
00:04:05,260 --> 00:04:09,430
How did it really impact organizations
across all sectors including healthcare?
73
00:04:09,490 --> 00:04:13,780
I think there's always been some level
of abuse of all of these types of tools
74
00:04:14,080 --> 00:04:18,280
where we really saw anything more than
zero to us is too much, of course,
75
00:04:18,280 --> 00:04:22,930
but where we really saw it starting
to become more prolific was as the
76
00:04:22,930 --> 00:04:27,160
ransomware, as a service ecosystem
started to grow and move around it.
77
00:04:27,160 --> 00:04:31,990
So more and more times we were seeing
as part of an attack chain Cobalt strike
78
00:04:31,990 --> 00:04:35,440
would be included or some tool
very similar to Cobalt Strike.
79
00:04:36,100 --> 00:04:39,910
So we really started to look at
how those tools were being shared,
80
00:04:39,910 --> 00:04:43,690
where they were being acquired from and
how these licenses were being abused.
81
00:04:44,380 --> 00:04:47,530
As we started to dig into that
led us to all these other efforts.
82
00:04:47,980 --> 00:04:51,070
It's not every attack, like I
said, if it's more than no attacks,
83
00:04:51,070 --> 00:04:52,690
then of course we're taking notice,
84
00:04:53,080 --> 00:04:56,200
but it was definitely being favored
among some of the adversary toolkits,
85
00:04:56,200 --> 00:05:00,070
especially coming out of some of the
usual geographic areas that you'd imagine.
86
00:05:00,160 --> 00:05:00,460
Right.
87
00:05:00,460 --> 00:05:05,380
So you started to notice that pattern
kind of increasing of threat actors
88
00:05:05,380 --> 00:05:06,400
abusing this tool,
89
00:05:06,940 --> 00:05:10,450
and then your organization teamed
up with Microsoft and Health isac.
90
00:05:10,750 --> 00:05:14,620
Can you tell me a bit more about how
that partnership came about and what each
91
00:05:14,620 --> 00:05:17,200
of those entities roles
were in this effort?
92
00:05:17,290 --> 00:05:19,300
Yeah, I think this was a really great,
93
00:05:19,510 --> 00:05:23,320
great partnership to have and we saw
some great effects as we were starting to
94
00:05:23,320 --> 00:05:26,410
see those kinds of things happening.
After we acquired Cobalt Strike,
95
00:05:26,860 --> 00:05:31,510
we added a lot of additional security
controls inside of the product
96
00:05:31,510 --> 00:05:33,640
itself to make it harder to abuse,
97
00:05:33,640 --> 00:05:36,430
and we started tracking where these
different channels were that things were
98
00:05:36,430 --> 00:05:41,080
being shared and proliferated and some
of the techniques being used and Fort
99
00:05:41,350 --> 00:05:46,090
was cracking down and engaging with law
enforcement and working through the DMCA
100
00:05:46,090 --> 00:05:49,960
digital Millennium Copyright Act to go
after the places the tools were being
101
00:05:49,960 --> 00:05:54,670
passed around. So social media
sites, telegram, Twitter file,
102
00:05:54,670 --> 00:05:58,700
hosting locations, the magazines
and non files and places like that.
103
00:05:59,270 --> 00:06:01,100
It was definitely a bit of
whack-a-mole. Of course though,
104
00:06:01,100 --> 00:06:04,700
as we'd take down two telegram channels
and you'd see three Twitter feeds pop up
105
00:06:04,700 --> 00:06:06,500
sharing the files, it was having effect,
106
00:06:06,500 --> 00:06:10,040
but of course not as great as we would've
liked to have seen. And around that
107
00:06:10,040 --> 00:06:14,840
same time, Microsoft had started their
own internal process and effort to
108
00:06:15,170 --> 00:06:17,660
track down in the malicious
usage of these types of tools,
109
00:06:18,080 --> 00:06:21,380
and they reached out to us and actually
wanted to know if we'd like to partner
110
00:06:21,380 --> 00:06:25,640
up and combine our efforts,
share some data and DCU,
111
00:06:25,730 --> 00:06:29,120
the Digital Crimes unit had an interesting
legal theory that they wanted to
112
00:06:29,120 --> 00:06:34,070
pursue based around intellectual
property abuse and allowing us to go
113
00:06:34,070 --> 00:06:35,690
through the civil side
of the court system,
114
00:06:35,690 --> 00:06:39,050
which is much faster than going
through the criminal side efforts.
115
00:06:39,740 --> 00:06:41,840
So we started working together.
116
00:06:41,840 --> 00:06:45,500
We spent a lot of time building
out processes and pipelines,
117
00:06:45,500 --> 00:06:48,770
so the ability to quickly share
information between ourselves,
118
00:06:49,250 --> 00:06:52,520
we each had unique visibility into
different places on the internet,
119
00:06:53,570 --> 00:06:58,070
and we're able to combine that different
data and fort as the license holder of
120
00:06:58,070 --> 00:07:02,780
Cobalt Strike. We can quickly
determine if something is legitimate,
121
00:07:02,870 --> 00:07:07,700
a real customer doing their own red
team operations expose themselves where
122
00:07:07,700 --> 00:07:10,490
they've been visible, or if it's
somebody using it maliciously,
123
00:07:11,480 --> 00:07:15,410
and then bringing along all the
law enforcement groups. Of course,
124
00:07:15,410 --> 00:07:17,720
we also built a way to, in real time,
125
00:07:17,720 --> 00:07:20,750
be able to share the observations that
we're seeing with law enforcement so that
126
00:07:20,750 --> 00:07:24,560
they'd be able to take further actions
as needed against these different things.
127
00:07:25,310 --> 00:07:27,110
And as we
built out this court case,
128
00:07:27,590 --> 00:07:32,180
it was important for us to also be able
to show the harm that was being caused
129
00:07:32,180 --> 00:07:34,370
by these malicious actors and activities.
130
00:07:34,730 --> 00:07:38,570
And that's where Health ISAC came along
and was that third leg of the stool
131
00:07:39,050 --> 00:07:43,430
being able to represent their clients
and show the court this is what's really
132
00:07:43,430 --> 00:07:45,530
going on from these activities.
133
00:07:45,530 --> 00:07:49,310
So it's not just Microsoft
and Ttra complaining about
somebody cheating on their
134
00:07:49,310 --> 00:07:50,143
licenses,
135
00:07:50,390 --> 00:07:54,140
but there's actual harm
happening to outside entities
based upon these different
136
00:07:54,140 --> 00:07:55,220
activities going in there.
137
00:07:56,060 --> 00:08:01,010
So as we went in and built out that
court case and then we were able to get a
138
00:08:01,040 --> 00:08:04,910
court order to begin to take action
against these different environments.
139
00:08:05,360 --> 00:08:09,620
So we spent a lot of time building out
automated pipelines to be able to take
140
00:08:09,620 --> 00:08:13,730
action against these different places
and around the world really start to push
141
00:08:13,730 --> 00:08:15,440
back against the abuse of these tools.
142
00:08:15,800 --> 00:08:19,130
Yeah, it's so interesting to hear just
how that partnership came together.
143
00:08:19,190 --> 00:08:22,220
Each of these entities were
looking into this on their own,
144
00:08:22,220 --> 00:08:26,990
and then you joined forces to really
prove just how widespread this issue
145
00:08:26,990 --> 00:08:29,150
was. Yeah. So I know you
got into this a little bit,
146
00:08:29,150 --> 00:08:33,770
but I'd love to hear more about just
the results of this multi-year effort to
147
00:08:33,770 --> 00:08:38,300
disrupt cobalt strike abuse and reduce
the number of unauthorized copies.
148
00:08:38,360 --> 00:08:41,900
Are there any specific data points that
you can share with us about the overall
149
00:08:41,900 --> 00:08:43,310
success of this operation?
150
00:08:43,400 --> 00:08:43,730
Yeah.
151
00:08:43,730 --> 00:08:47,660
The speed and scale that we're able to
achieve working together has really been
152
00:08:47,750 --> 00:08:50,540
great. So over time now,
153
00:08:50,930 --> 00:08:54,800
what essentially happens is when
we observe a copy out in the,
154
00:08:55,380 --> 00:08:59,190
we can quickly determine is it
unauthorized and malicious? Is it real?
155
00:08:59,550 --> 00:09:04,350
And then pass that into a notification
pipeline where we send notices to the
156
00:09:04,350 --> 00:09:06,870
infrastructure providers where
the systems are being run.
157
00:09:07,380 --> 00:09:10,230
So your Amazons Azures,
158
00:09:10,650 --> 00:09:13,020
you name the hosting provider
all around the world,
159
00:09:13,500 --> 00:09:17,670
and leveraged those different providers
to take those systems offline quickly.
160
00:09:18,300 --> 00:09:22,440
So as far as what we observe
in the wild on a daily basis,
161
00:09:22,440 --> 00:09:27,360
we've seen roughly an 80% reduction
in the number of systems that the
162
00:09:27,360 --> 00:09:30,780
different groups and the
different entities that we're
working with are able to
163
00:09:30,900 --> 00:09:31,830
observe out there.
164
00:09:32,340 --> 00:09:35,580
And because of the automation of taking
these systems down and getting 'em
165
00:09:35,580 --> 00:09:36,413
offline,
166
00:09:36,630 --> 00:09:41,340
that dwell time from when we see a
system to when we see it go down,
167
00:09:41,730 --> 00:09:45,390
because we monitor and we continue to
enforce those notices until we see it
168
00:09:45,390 --> 00:09:46,223
taken offline,
169
00:09:46,620 --> 00:09:51,510
has been greatly reduced. So it's a much
smaller window where a system can be
170
00:09:51,510 --> 00:09:52,620
observed doing this.
171
00:09:53,610 --> 00:09:57,480
Hundreds of domains that were malicious
have been seized and sinkhole that has
172
00:09:57,480 --> 00:10:00,810
allowed additional intelligence gathering
to happen from the traffic that's
173
00:10:00,810 --> 00:10:03,900
going on in there as well,
which has really been great.
174
00:10:04,470 --> 00:10:08,130
And while our court order
is in the US, of course,
175
00:10:08,130 --> 00:10:11,370
so we really have DMCA as a US-based law.
176
00:10:11,970 --> 00:10:16,350
Most countries cooperate and observe
that or they have something similar in
177
00:10:16,350 --> 00:10:19,110
their areas of the world similar to that.
178
00:10:19,110 --> 00:10:22,410
So that allows us to enforce these
different places around the world and have
179
00:10:22,410 --> 00:10:24,450
this done as expected.
180
00:10:24,720 --> 00:10:29,610
The remaining systems we do see have been
pushed into a much smaller geographic
181
00:10:29,610 --> 00:10:30,443
window.
182
00:10:30,450 --> 00:10:34,770
Most of the traffic now originates
from a very limited set of countries or
183
00:10:34,770 --> 00:10:39,720
hosting providers where they're
either not as quick to action or they
184
00:10:39,720 --> 00:10:43,080
have enough cover from their
states to ignore it sometimes,
185
00:10:43,080 --> 00:10:46,410
but that makes it much easier for us
to defend against now that we see where
186
00:10:46,410 --> 00:10:49,860
that's happening from. So it's
really been a great result for us,
187
00:10:49,860 --> 00:10:53,250
and we've had great cooperation
from Microsoft and a number of other
188
00:10:53,250 --> 00:10:55,530
organizations as well as
global law enforcement.
189
00:10:55,920 --> 00:10:57,030
And that brings up a great point.
190
00:10:57,030 --> 00:11:01,200
I think that partnership
between Fort Health isac,
191
00:11:01,200 --> 00:11:03,030
Microsoft is a big part of it,
192
00:11:03,030 --> 00:11:07,710
but it also takes cooperation
collaboration between so
many different entities
193
00:11:07,770 --> 00:11:08,940
to really make that work.
194
00:11:09,030 --> 00:11:12,000
It really does. It's able to see
something, say something real.
195
00:11:12,420 --> 00:11:15,930
Anybody who's seeing things now has
places to get that information out.
196
00:11:15,990 --> 00:11:20,250
We're able on a daily basis to we're
realtime sharing what we see from things
197
00:11:20,250 --> 00:11:24,480
like cobalt strike, phishing kits,
malicious websites and domains.
198
00:11:24,930 --> 00:11:29,130
The whole ecosystem around that is
really coming together with information
199
00:11:29,130 --> 00:11:30,150
sharing activities.
200
00:11:31,140 --> 00:11:35,370
Fort and everybody else as well are
working with more than just health isac,
201
00:11:35,370 --> 00:11:38,640
other industry ISACs to really push
back on this all around the world.
202
00:11:39,030 --> 00:11:39,720
Definitely.
203
00:11:39,720 --> 00:11:44,310
And I know aside from this particular
partnership for also took part in
204
00:11:44,400 --> 00:11:45,630
Operation Morpheus,
205
00:11:45,630 --> 00:11:50,520
which was a multi-year effort by the
UK's national crime agency that also
206
00:11:50,580 --> 00:11:54,370
constituted a global takedown
of misuse of Cobalt strike.
207
00:11:54,370 --> 00:11:58,540
So I'm curious how those efforts also
contributed to the success and the
208
00:11:58,540 --> 00:11:59,800
collaboration there as well.
209
00:11:59,890 --> 00:12:00,130
Yeah,
210
00:12:00,130 --> 00:12:04,150
that was another great public private
partnership that Microsoft and Fortor were
211
00:12:04,150 --> 00:12:06,670
able to take part in. Initially,
212
00:12:06,970 --> 00:12:11,830
roughly 600 to 700 systems were
identified and the majority of
213
00:12:11,830 --> 00:12:16,300
those immediately taken down once
that law enforcement action commenced
214
00:12:16,690 --> 00:12:20,200
Fortria and Microsoft and other private
partners working together with those law
215
00:12:20,200 --> 00:12:23,590
enforcement teams. Again, we're able
to push back on these. And of course,
216
00:12:23,590 --> 00:12:26,740
having law enforcement around is great
because they could do things we can't.
217
00:12:27,190 --> 00:12:30,130
We can get an order to take
down a provider or a site.
218
00:12:30,430 --> 00:12:33,910
We can't put somebody in handcuffs
where they can. It's great to see.
219
00:12:33,910 --> 00:12:38,620
It feels like the number of
seized websites, seized servers,
220
00:12:39,250 --> 00:12:42,280
people getting arrested is
continuing to increase worldwide,
221
00:12:42,280 --> 00:12:45,760
and that's really good to see to
keep pushing back in the ecosystem.
222
00:12:46,150 --> 00:12:50,080
For sure. And I know we've already
spoken a lot about just the importance of
223
00:12:50,080 --> 00:12:53,050
collaboration. It seems to be
the theme of the episode today,
224
00:12:53,140 --> 00:12:56,470
but I'm curious if we could even double
down on that more and talk about just
225
00:12:56,470 --> 00:13:01,210
the importance of cross organizational
collaborations and improving cyber
226
00:13:01,210 --> 00:13:02,920
resilience specifically in healthcare.
227
00:13:02,920 --> 00:13:06,160
I know that it's such a highly
targeted and highly regulated industry.
228
00:13:06,220 --> 00:13:10,600
Yeah, I think really important,
and we along with Microsoft,
229
00:13:10,600 --> 00:13:14,770
have definitely made an effort to share
the techniques that we've used and how
230
00:13:14,770 --> 00:13:19,690
we came about doing this across different
conferences and webinar and podcasts
231
00:13:19,690 --> 00:13:22,150
like this. Having those friends,
232
00:13:22,570 --> 00:13:27,370
being able to work with you can really
enhance your operational capabilities
233
00:13:27,760 --> 00:13:32,320
and having law enforcement coming along
with us gives us that final place that
234
00:13:32,320 --> 00:13:35,860
we can go as we're seeing these different
places and these different IOCs.
235
00:13:36,460 --> 00:13:40,000
So we think it's super important to
have these industry partnerships.
236
00:13:40,360 --> 00:13:43,930
We work heavily with Microsoft who
work with a lot of other worldwide
237
00:13:44,050 --> 00:13:48,640
intelligence providers and other defensive
security technology places to do this
238
00:13:48,640 --> 00:13:49,473
as well.
239
00:13:49,480 --> 00:13:54,220
Being able to share that information
around and being able to get more pushback
240
00:13:54,220 --> 00:13:57,910
against these actors, the more friends
you have doing these types of things,
241
00:13:57,910 --> 00:14:00,730
the more effect we can have and the
greater you can make your security
242
00:14:00,730 --> 00:14:01,563
resiliency.
243
00:14:01,660 --> 00:14:02,920
Curious also,
244
00:14:02,980 --> 00:14:07,240
how you see the landscape of cyber
threats evolving over the next few years
245
00:14:07,240 --> 00:14:10,900
beyond just cobalt strike
abuse. Just in a general sense.
246
00:14:11,110 --> 00:14:14,140
We're seeing more and more pickup
in these types of tools. Of course,
247
00:14:14,140 --> 00:14:16,090
there's other competing tools out there.
248
00:14:16,090 --> 00:14:18,310
There's starting to be some
open source frameworks.
249
00:14:18,730 --> 00:14:20,440
As we push down at Cobalt Strike,
250
00:14:20,440 --> 00:14:24,640
we're seeing an increase in some other
technologies that are similar or maybe
251
00:14:25,240 --> 00:14:27,040
now at this level of efforts going on.
252
00:14:27,040 --> 00:14:30,940
They're starting to shift their
tactics a bit, but in general,
253
00:14:31,660 --> 00:14:36,250
the way that they're initially breaching
these environments is fairly constant
254
00:14:36,250 --> 00:14:39,970
over time. Phishing is high in
the list generally, number one,
255
00:14:39,970 --> 00:14:44,080
some form of business, email compromise
or spearfishing targeted attacks,
256
00:14:44,710 --> 00:14:47,980
weak configurations by
design or by
mistake.
257
00:14:48,550 --> 00:14:50,950
Missing patches is honestly
still a big one, and
258
00:14:52,520 --> 00:14:55,730
I don't think those are going to
change a lot in the very near term.
259
00:14:55,970 --> 00:14:59,090
Those are really effective
ways to breach an environment.
260
00:14:59,390 --> 00:15:02,990
What we are seeing change a lot is the
tactics around that. It's allowing threat
261
00:15:02,990 --> 00:15:05,870
actors to be better at it and
more efficient in that scale,
262
00:15:06,230 --> 00:15:10,400
especially using things like artificial
intelligence and AI technologies
263
00:15:10,970 --> 00:15:15,290
where we used to see maybe a phishing
email coming out of a foreign country with
264
00:15:15,560 --> 00:15:18,170
grammar mistakes, missing punctuation.
265
00:15:18,290 --> 00:15:22,580
You could just tell it wasn't quite
right. They're translating it now with ai,
266
00:15:22,640 --> 00:15:23,780
they can do that at scale.
267
00:15:23,780 --> 00:15:27,740
They can target anywhere in the world
and be able to push those things out.
268
00:15:28,310 --> 00:15:32,210
When we're doing our VUL management
programs and we're looking for vectors and
269
00:15:32,210 --> 00:15:34,790
patches and maybe systems that
are exposed to the internet,
270
00:15:35,180 --> 00:15:36,590
the threat actors doing that too,
271
00:15:36,590 --> 00:15:40,130
and they're doing it with better scale
and technology than they used to in the
272
00:15:40,130 --> 00:15:40,490
past.
273
00:15:40,490 --> 00:15:44,900
So they're accelerating what they can do
and how they can do their intelligence
274
00:15:44,910 --> 00:15:49,370
gathering and have a better way to target
our executives and our employees as
275
00:15:49,370 --> 00:15:51,380
they're trying to get into
these systems initially.
276
00:15:51,770 --> 00:15:54,590
And stopping that front line of
defense is getting really important.
277
00:15:54,920 --> 00:15:55,850
Definitely. Yeah.
278
00:15:55,850 --> 00:15:59,720
It's interesting to hear that these
threat actors are going back to tried and
279
00:15:59,720 --> 00:16:03,800
true techniques, phishing, business,
email compromise, those things still work,
280
00:16:03,800 --> 00:16:04,550
but as you said,
281
00:16:05,000 --> 00:16:09,140
they're using AI and things like
that to make these attacks even more
282
00:16:09,200 --> 00:16:12,110
successful. So I'm sure on
the defense side it's tough.
283
00:16:12,620 --> 00:16:14,690
And we're doing the same
thing on the defensive side.
284
00:16:15,020 --> 00:16:17,870
We're all starting to use
more machine learning,
285
00:16:17,870 --> 00:16:20,960
more artificial intelligence to
be able to detect things at scale,
286
00:16:21,230 --> 00:16:23,780
uncover what's going on across
these different campaigns,
287
00:16:23,780 --> 00:16:27,260
and being able to more quickly target
these threat actors as they're trying to
288
00:16:27,260 --> 00:16:28,700
get access to your environments.
289
00:16:29,030 --> 00:16:30,050
And to close this out,
290
00:16:30,050 --> 00:16:33,860
I'm curious what advice you'd give to
healthcare organizations that are looking
291
00:16:33,860 --> 00:16:37,970
to strengthen their cybersecurity
posture in this environment where these
292
00:16:37,970 --> 00:16:40,340
threats are continuing and advancing.
293
00:16:40,550 --> 00:16:44,990
A lot of it really is initially make
sure you've got the basics right.
294
00:16:44,990 --> 00:16:48,590
It's blocking and tackling kind
of things. Do you have a DR plan?
295
00:16:48,620 --> 00:16:49,760
You probably do.
296
00:16:49,850 --> 00:16:53,450
When's the last time you actually checked
your incident response and tried to
297
00:16:53,450 --> 00:16:57,440
exercise it? Do what's going
to happen if you are breached?
298
00:16:57,440 --> 00:17:00,500
And if something happens, like we
said, in the same breach model,
299
00:17:00,560 --> 00:17:02,900
you're either assuming you're already
breached or you're going to get breached
300
00:17:02,900 --> 00:17:03,733
at some point.
301
00:17:03,950 --> 00:17:07,160
It's just a matter of what
you do afterwards in that
effect to make sure that
302
00:17:07,160 --> 00:17:08,870
you understand your change of command,
303
00:17:09,320 --> 00:17:11,810
what things are going to happen and
when and how you're going to do that.
304
00:17:11,870 --> 00:17:12,830
It's really important.
305
00:17:13,580 --> 00:17:17,900
Do you have multifactor
authentication enabled everywhere?
306
00:17:18,560 --> 00:17:23,120
Are you segmenting your networks
so that if you do get compromised,
307
00:17:23,120 --> 00:17:27,800
that blast radius is limited or things
sitting wide open where they can move
308
00:17:27,800 --> 00:17:31,370
laterally all across the network as
they come on? How are you managing your
309
00:17:31,370 --> 00:17:32,900
vulnerability type programs?
310
00:17:33,320 --> 00:17:36,710
A lot of times what we see
is managing for the numbers.
311
00:17:37,190 --> 00:17:40,100
I got 10,000 vulnerabilities
today. I can't close 'em all.
312
00:17:40,100 --> 00:17:44,450
I'm going to knock off 2000 fast ones.
So I have 8,000. It looks great on paper,
313
00:17:44,810 --> 00:17:49,680
but are you really making risk-based
decisions on what is the most likely
314
00:17:49,680 --> 00:17:53,790
path someone's going to take to
compromise your crown jewels patient data,
315
00:17:54,180 --> 00:17:56,010
getting access to devices and things,
316
00:17:56,010 --> 00:17:58,110
or are you just playing
a numbers type game?
317
00:17:58,590 --> 00:18:02,730
So doing a risk-based evaluation of
what it is and how you need to protect
318
00:18:02,730 --> 00:18:04,560
yourself thinking like an attacker would.
319
00:18:05,280 --> 00:18:08,280
Being able to arrange your
defenses in those types of manners.
320
00:18:08,670 --> 00:18:10,800
So those are all great ways to start.
321
00:18:11,190 --> 00:18:15,330
We are definitely seeing
more OT and iot type attacks.
322
00:18:15,810 --> 00:18:17,940
So medical devices are
right in that chain.
323
00:18:18,420 --> 00:18:21,930
A lot of those are probably built
with not great security in mind at the
324
00:18:21,930 --> 00:18:22,350
beginning,
325
00:18:22,350 --> 00:18:26,760
who's ever going to attack the electronic
interface to my pacemaker? But those
326
00:18:26,760 --> 00:18:28,350
kinds of things are happening these days,
327
00:18:28,350 --> 00:18:30,780
and we need to be mindful of all
the different threat vectors.
328
00:18:31,590 --> 00:18:35,910
And especially as now so many people
have gone to a at least partial work from
329
00:18:35,910 --> 00:18:39,540
home model. Your visibility
used to be much more controlled.
330
00:18:40,230 --> 00:18:42,660
People are coming into the office,
they're signing into the network,
331
00:18:42,660 --> 00:18:45,510
they're sitting at a desk.
Now in many respects,
332
00:18:45,630 --> 00:18:50,340
people are connecting from anywhere,
working from home, doing jobs,
333
00:18:50,340 --> 00:18:53,070
third party suppliers, they
have people working from home.
334
00:18:53,130 --> 00:18:56,520
Your area that you have to be
concerned with has expanded a lot,
335
00:18:56,520 --> 00:18:58,950
and you need to take all of those
different places into account.
336
00:18:59,700 --> 00:19:04,050
And that's great advice to think like
the attacker and really tackle it from
337
00:19:04,050 --> 00:19:07,200
that end. So it was great to
hear about this partnership.
338
00:19:07,230 --> 00:19:09,750
Always nice to hear a success
story in cybersecurity,
339
00:19:09,750 --> 00:19:12,630
and I'm sure these efforts
will really continue.
340
00:19:12,720 --> 00:19:14,970
So thanks so much for joining us
today, Bob. It was a pleasure.
341
00:19:15,030 --> 00:19:17,940
Yep. Looking forward to further
updates in the future for Fortune,
342
00:19:17,940 --> 00:19:20,910
Microsoft and Hi Sac. This
is a long-term effort.
343
00:19:21,090 --> 00:19:23,700
We're expecting many more
years to keep going after this,
344
00:19:23,700 --> 00:19:26,640
and we'll keep you posted
with more great details.
345
00:19:26,790 --> 00:19:27,623
Great. Thank you.
346
00:19:30,960 --> 00:19:34,620
And thank you listener for tuning
in. If you liked what you heard,
347
00:19:34,740 --> 00:19:37,650
head over to Spotify or
Apple and drop us a review.
348
00:19:37,860 --> 00:19:41,310
We'll be choosing some of our reviews
to be read on the show in appreciation.
349
00:19:41,310 --> 00:19:44,340
So keep listening through to the end
because you might get name dropped.
350
00:19:44,760 --> 00:19:45,840
See you next time.
351
00:19:48,210 --> 00:19:52,410
Music by Kyle Murphy and
production by me Kelsey Widdle.
352
00:20:01,280 --> 00:20:03,720
This is an Informa Tech target production.