Building Business Continuity & Resilience with Max Alexander

1
00:00:00,000 --> 00:00:12,640
Welcome to Logically Speaking, where we discuss the latest trends and challenges in cybersecurity
2
00:00:12,640 --> 00:00:15,360
with the top experts in their field.
3
00:00:15,360 --> 00:00:19,540
You're going to learn how to keep your data safe, your operations sound, and your business
4
00:00:19,540 --> 00:00:21,540
ready for whatever comes next.
5
00:00:21,540 --> 00:00:23,540
This is Logically Speaking.
6
00:00:23,540 --> 00:00:29,380
Today we have the incredible pleasure of being able to speak to Max Alexander.
7
00:00:29,380 --> 00:00:36,420
Max is currently Vice President of Cyber and Technology Emerging Threats Research at JPMorgan
8
00:00:36,420 --> 00:00:42,820
Chase, where he's responsible for educating the firm and its clients on best practices
9
00:00:42,820 --> 00:00:46,240
when it comes to mitigating cyber threats attacks.
10
00:00:46,240 --> 00:00:50,880
Prior to joining the firm in 2019, Max was the lead of the Digital Forensics and Insider
11
00:00:50,880 --> 00:00:53,160
Threats team at the Pentagon.
12
00:00:53,160 --> 00:00:59,160
He's also a director and a professor of digital forensics at the University of Maryland Global
13
00:00:59,160 --> 00:01:03,520
Campus, where he trains and mentors the future forensic investigators.
14
00:01:03,520 --> 00:01:06,880
And I'm very excited to talk to Max today.
15
00:01:06,880 --> 00:01:12,840
Comes with, Max, I got to be honest, when I read all of the degrees you had, I was a
16
00:01:12,840 --> 00:01:13,840
little intimidated.
17
00:01:13,840 --> 00:01:18,840
I wouldn't even go into that.
18
00:01:18,840 --> 00:01:20,320
We can talk about that later.
19
00:01:20,320 --> 00:01:24,880
I have, I would say, a mental illness where I'm addicted to going to college.
20
00:01:24,880 --> 00:01:26,800
It could be a good or a bad thing.
21
00:01:26,800 --> 00:01:30,760
So I do consider myself a lifelong learner.
22
00:01:30,760 --> 00:01:31,760
That's fantastic.
23
00:01:31,760 --> 00:01:35,360
I mean, I was going to ask you, should I call you Dr. Alexander?
24
00:01:35,360 --> 00:01:37,360
No, my name is Max.
25
00:01:37,360 --> 00:01:40,360
Just call me Max.
26
00:01:40,360 --> 00:01:41,360
That's fine.
27
00:01:41,360 --> 00:01:49,920
So Max, you know, to start things off, if you could just share how you got into cybersecurity
28
00:01:49,920 --> 00:01:55,360
and a little bit more about your experience, more from like, you know, from a tactical
29
00:01:55,360 --> 00:01:57,480
sense, like how did you get into cyber?
30
00:01:57,480 --> 00:02:01,160
Was it something you were always interested in or did you kind of just stumble into it?
31
00:02:01,160 --> 00:02:04,080
Well, from a tactical sense, it was very tactical.
32
00:02:04,080 --> 00:02:05,080
And yes, I did.
33
00:02:05,080 --> 00:02:06,680
I stumbled into it.
34
00:02:06,680 --> 00:02:09,800
So you know, we'll start back pre-9-11.
35
00:02:09,800 --> 00:02:13,920
Obviously, I was in the military, if you can't tell by the haircut, it still has, it's still
36
00:02:13,920 --> 00:02:15,920
a part of me.
37
00:02:15,920 --> 00:02:16,960
Yeah.
38
00:02:16,960 --> 00:02:20,800
So I joined the military before 9-11.
39
00:02:20,800 --> 00:02:24,760
I actually joined the National Guard, kind of like most people who joined the National
40
00:02:24,760 --> 00:02:30,040
Guard, you should see the commercials on TV of, you know, join the Guard, serve your country,
41
00:02:30,040 --> 00:02:32,360
but it also pays for college.
42
00:02:32,360 --> 00:02:36,360
And you know, I was, my family, we weren't poor, but we weren't rich either.
43
00:02:36,360 --> 00:02:39,200
We grew up in Kentucky and I went, okay, well, this makes sense.
44
00:02:39,200 --> 00:02:41,520
I've got to find a way to pay for college.
45
00:02:41,520 --> 00:02:42,800
I joined the National Guard.
46
00:02:42,800 --> 00:02:45,400
A lot of my close friends had joined the Guard.
47
00:02:45,400 --> 00:02:48,920
So also kind of wanted to do something hard.
48
00:02:48,920 --> 00:02:53,640
So I'm like, well, let me enlist in the Kentucky National Guard 20 Special Forces Group.
49
00:02:53,640 --> 00:02:55,320
So yeah, I did that.
50
00:02:55,320 --> 00:03:01,560
Went through all of the training and then the 9-11 happened and found myself overseas
51
00:03:01,560 --> 00:03:06,600
right at the beginning of the Afghan invasion.
52
00:03:06,600 --> 00:03:07,960
And you know, I was young then.
53
00:03:07,960 --> 00:03:12,440
I was just had graduated high school, finished training for about a year and a half.
54
00:03:12,440 --> 00:03:17,560
I was a little over 21, 22 years old at the kickoff of the war.
55
00:03:17,560 --> 00:03:23,600
And what we were doing in the war was obviously we were going and finding a lot of talent
56
00:03:23,600 --> 00:03:26,040
and terrorist-related individuals.
57
00:03:26,040 --> 00:03:32,600
And we were getting a lot of digital media, computers and cell phones and things of that
58
00:03:32,600 --> 00:03:33,600
nature.
59
00:03:33,600 --> 00:03:38,200
And we were collecting those things up and then they kind of turned to me and like, well,
60
00:03:38,200 --> 00:03:40,240
you're the youngest person on the team.
61
00:03:40,240 --> 00:03:45,720
You should know all there is to know about digital devices and cell phones and computers.
62
00:03:45,720 --> 00:03:48,320
And like, I'm from Kentucky.
63
00:03:48,320 --> 00:03:50,000
I don't own a cell phone.
64
00:03:50,000 --> 00:03:56,680
And I just, you know, I think I had just gotten a home computer when we left, you know, early
65
00:03:56,680 --> 00:03:57,680
2000s.
66
00:03:57,680 --> 00:04:00,720
Like, I don't know anything about this.
67
00:04:00,720 --> 00:04:06,040
So I learned when I was overseas, I actually was fortunate enough, I had linked up with
68
00:04:06,040 --> 00:04:14,160
some folks over at the National Security Agency, the kind of trial by fire at that time.
69
00:04:14,160 --> 00:04:18,440
When I got back, I'm like, well, you need to, you know, we're going to keep doing this
70
00:04:18,440 --> 00:04:20,320
for the foreseeable future.
71
00:04:20,320 --> 00:04:24,400
You've got to train me on what it is you want me to do.
72
00:04:24,400 --> 00:04:30,000
So I had convinced them to send me to a lot of schools and, you know, a lot of some of
73
00:04:30,000 --> 00:04:34,280
those were colleges and universities, but some of it was like the Defense Cybercrime
74
00:04:34,280 --> 00:04:35,280
Training Center.
75
00:04:35,280 --> 00:04:41,120
I got to do a lot of training there and was like probably one of the first forensic investigators
76
00:04:41,120 --> 00:04:43,020
in the DOD.
77
00:04:43,020 --> 00:04:45,860
So it was a really cool experience.
78
00:04:45,860 --> 00:04:49,120
That I am the accidental cyber person.
79
00:04:49,120 --> 00:04:50,920
I was, it was not purposeful.
80
00:04:50,920 --> 00:04:55,400
It was not something like I, yes, let's go into cyber.
81
00:04:55,400 --> 00:04:59,280
So kind of, kind of a long story there.
82
00:04:59,280 --> 00:05:05,320
That's interesting, you know, that you would be viewed as the young person who's tech savvy.
83
00:05:05,320 --> 00:05:07,800
So you had to know this stuff.
84
00:05:07,800 --> 00:05:08,800
That's interesting.
85
00:05:08,800 --> 00:05:14,680
So I want to talk a little bit about your forensic investigating background.
86
00:05:14,680 --> 00:05:17,120
You're in financial services now.
87
00:05:17,120 --> 00:05:18,120
Right.
88
00:05:18,120 --> 00:05:24,320
Traditionally, and I've been in cyber for 25 years and I've seen that traditionally
89
00:05:24,320 --> 00:05:31,280
financial services tends to be a leader in security since, you know, the times of, you
90
00:05:31,280 --> 00:05:32,880
know, the wild, wild west.
91
00:05:32,880 --> 00:05:35,560
They knew how to protect their assets.
92
00:05:35,560 --> 00:05:41,160
And so that's, to me, it's always been like that mindset that financial services is a
93
00:05:41,160 --> 00:05:42,160
leader.
94
00:05:42,160 --> 00:05:48,880
So in your experience, are there industries that need to invest further in cybersecurity?
95
00:05:48,880 --> 00:05:56,080
In other words, what industries outside of your own do you see need additional investment
96
00:05:56,080 --> 00:05:57,080
in cybersecurity?
97
00:05:57,080 --> 00:06:02,520
And investment, you know, that's kind of an interesting word because we can invest in
98
00:06:02,520 --> 00:06:03,520
a lot of things.
99
00:06:03,520 --> 00:06:06,420
We can invest in people, process and technology.
100
00:06:06,420 --> 00:06:08,200
So what industries need more investment?
101
00:06:08,200 --> 00:06:09,920
Well, all of them.
102
00:06:09,920 --> 00:06:14,640
What industries need the most or more investment out of things that we've seen?
103
00:06:14,640 --> 00:06:17,120
You can read the news.
104
00:06:17,120 --> 00:06:18,160
Everybody reads the news.
105
00:06:18,160 --> 00:06:23,520
So I talk to a lot of folks around the globe every day.
106
00:06:23,520 --> 00:06:27,200
And that's kind of one of the questions that I get is, you know, how much money should
107
00:06:27,200 --> 00:06:28,360
I be investing?
108
00:06:28,360 --> 00:06:29,540
Where should I invest?
109
00:06:29,540 --> 00:06:31,360
What should I invest in?
110
00:06:31,360 --> 00:06:36,000
And I'll caveat this whole thing and kind of one of my sayings if you ever heard me
111
00:06:36,000 --> 00:06:40,680
talk is that you can build your castle's walls out of gold.
112
00:06:40,680 --> 00:06:43,640
It does not necessarily make it more secure.
113
00:06:43,640 --> 00:06:46,600
It just makes it more expensive.
114
00:06:46,600 --> 00:06:51,680
So when we talk about investing in things, okay, we have to do it smartly and all of
115
00:06:51,680 --> 00:06:56,880
the investments that we should make tend to go should go back to risk.
116
00:06:56,880 --> 00:06:59,960
Every organization should have some type of risk assessment.
117
00:06:59,960 --> 00:07:04,720
They should identify what they're vulnerable to, what risk they might have, what threat
118
00:07:04,720 --> 00:07:08,160
actors may be posed against them.
119
00:07:08,160 --> 00:07:13,360
And then let's start looking at the controls that we already have in place.
120
00:07:13,360 --> 00:07:19,400
And if the controls aren't mitigating those risks down to that acceptable level, then
121
00:07:19,400 --> 00:07:23,960
okay, maybe we need to invest more in certain areas.
122
00:07:23,960 --> 00:07:27,680
Most people, most organizations don't know what risk they face.
123
00:07:27,680 --> 00:07:30,520
They don't have a good risk assessment.
124
00:07:30,520 --> 00:07:34,440
So when they go about doing a lot of this, they do it blindly and they're like, well,
125
00:07:34,440 --> 00:07:36,840
let me just go buy the latest and greatest.
126
00:07:36,840 --> 00:07:41,200
And not to say that the latest and greatest thing isn't useful.
127
00:07:41,200 --> 00:07:45,880
You just have to figure out where this latest and greatest thing fits in.
128
00:07:45,880 --> 00:07:52,720
But to more specifically answer your question, what industry should we invest in or what
129
00:07:52,720 --> 00:07:56,320
industry should look at this more specifically?
130
00:07:56,320 --> 00:08:01,640
Well, I'll say critical infrastructure, and that's a very broad and nebulous term because
131
00:08:01,640 --> 00:08:06,360
when we look at critical infrastructure across the spectrum of the US, there are 16 critical
132
00:08:06,360 --> 00:08:12,400
infrastructure sectors, 80, 90% of it's owned by private industry, and pretty much everything
133
00:08:12,400 --> 00:08:15,880
under the sun is critical infrastructure when you look at the definitions.
134
00:08:15,880 --> 00:08:20,120
So to be even more specific to that, when I think of critical infrastructure, I'm thinking
135
00:08:20,120 --> 00:08:29,160
of, well, the things that make us function and live as a society, the energy, the electricity,
136
00:08:29,160 --> 00:08:34,040
the water, those things, the life health safety things.
137
00:08:34,040 --> 00:08:38,360
And oftentimes we see a lot of those things being hacked or hit.
138
00:08:38,360 --> 00:08:40,480
I was just reading the news the other day.
139
00:08:40,480 --> 00:08:46,160
We saw China might be targeting power companies around military bases.
140
00:08:46,160 --> 00:08:53,360
And historically, a lot of these critical infrastructure or electrical power sectors,
141
00:08:53,360 --> 00:08:55,840
they have historically been underfunded.
142
00:08:55,840 --> 00:09:00,880
A lot of these could be government owned, government partnerships, and a lot of the
143
00:09:00,880 --> 00:09:04,760
infrastructure they're using is old.
144
00:09:04,760 --> 00:09:12,160
And to completely revamp a lot of that is major, major investment, a major undertaking.
145
00:09:12,160 --> 00:09:18,080
And oftentimes too, we often see these critical infrastructure things hooked up to the open
146
00:09:18,080 --> 00:09:19,080
internet.
147
00:09:19,080 --> 00:09:21,000
There's actually search engines showed on HD.
148
00:09:21,000 --> 00:09:25,640
You can start Googling critical infrastructure appliances that may be out there and then
149
00:09:25,640 --> 00:09:27,200
start searching for vulnerability.
150
00:09:27,200 --> 00:09:33,720
So I would say if I were any organization, particularly that sector, I would definitely
151
00:09:33,720 --> 00:09:40,120
look at maybe investing more, trying to figure out how to modernize, how to maybe more secure
152
00:09:40,120 --> 00:09:41,120
our infrastructure.
153
00:09:41,120 --> 00:09:42,120
Yeah.
154
00:09:42,120 --> 00:09:45,480
And it's a key point, right?
155
00:09:45,480 --> 00:09:52,360
The critical infrastructure tends to be the one using the legacy systems, the set and
156
00:09:52,360 --> 00:09:57,360
forget it mindset for years and years and years.
157
00:09:57,360 --> 00:10:03,560
My teams have found servers that haven't been rebooted in years or patched because they're
158
00:10:03,560 --> 00:10:07,560
just afraid of bringing those systems down that they won't come back up.
159
00:10:07,560 --> 00:10:12,360
So you bring a really good point.
160
00:10:12,360 --> 00:10:21,200
Can you speak to a little bit about the, when an organization, a company gets breached,
161
00:10:21,200 --> 00:10:30,480
the impact typically is viewed as downtime and then on a cursory level, maybe reputational
162
00:10:30,480 --> 00:10:31,480
damage.
163
00:10:31,480 --> 00:10:38,760
But can you speak some of the unknown impacts of these breaches that are happening and maybe
164
00:10:38,760 --> 00:10:43,880
educate some of our listeners that they don't have to be a financial institution to have
165
00:10:43,880 --> 00:10:50,640
some of these countermeasures and as you mentioned, which is a great practice, identifying and
166
00:10:50,640 --> 00:10:57,960
quantifying the risk with an assessment so that you can then make sure that you're appropriating
167
00:10:57,960 --> 00:11:01,500
the right amount of budget and funds in the areas that are going to have the best amount
168
00:11:01,500 --> 00:11:04,360
of impact to reducing that risk.
169
00:11:04,360 --> 00:11:08,240
But can you speak to the unknown impacts of being breached?
170
00:11:08,240 --> 00:11:09,240
Yeah.
171
00:11:09,240 --> 00:11:15,600
And I think those unknown impacts too, when it goes back to identifying things and looking
172
00:11:15,600 --> 00:11:20,600
at what might affect your organization, it's a good marketing tool for cyber insurance
173
00:11:20,600 --> 00:11:26,160
because oftentimes with risk, we can accept it, we can mitigate it, we can ignore it,
174
00:11:26,160 --> 00:11:28,120
we can transfer it.
175
00:11:28,120 --> 00:11:33,640
Oftentimes we see a lot of companies, we're going to transfer that risk to cyber insurers,
176
00:11:33,640 --> 00:11:38,480
but we've seen the cost of cyber insurance, it just skyrockets and it is because a lot
177
00:11:38,480 --> 00:11:41,960
of these unknown risks that organizations face.
178
00:11:41,960 --> 00:11:45,600
So obviously when we're hit with any type of cyber attack, we're down.
179
00:11:45,600 --> 00:11:50,040
I think the average time an organization is down from a ransomware attack is about seven
180
00:11:50,040 --> 00:11:52,040
to nine business days.
181
00:11:52,040 --> 00:11:55,280
And keep in mind that that's an average.
182
00:11:55,280 --> 00:12:01,880
So that if you're doing really good and you have your Doc Ops, you tested them, you might
183
00:12:01,880 --> 00:12:05,680
be down for a matter of minutes, hours.
184
00:12:05,680 --> 00:12:08,460
We see worst case scenarios, it could be a period of months.
185
00:12:08,460 --> 00:12:12,800
So obviously downtime is probably your number one threat.
186
00:12:12,800 --> 00:12:15,520
But then there's also some residuals in that.
187
00:12:15,520 --> 00:12:20,840
Well, if an organization gets hit and they go down and they're down for a period of weeks,
188
00:12:20,840 --> 00:12:23,800
well maybe I need to go find a new organization to do business with.
189
00:12:23,800 --> 00:12:29,640
So now I'm going to maybe lose some customers I have to competitors because they haven't
190
00:12:29,640 --> 00:12:36,480
had a cyber attack or it's just easier for my customers to go to a business that's open.
191
00:12:36,480 --> 00:12:42,760
So there is some reputational damage there as well as a loss of customer base.
192
00:12:42,760 --> 00:12:45,200
In addition to that, intellectual property.
193
00:12:45,200 --> 00:12:51,400
So if I'm working on something, a lot of these ransomware attacks, they're not just ransoming
194
00:12:51,400 --> 00:12:52,400
my data.
195
00:12:52,400 --> 00:12:55,880
They're now taking and holding a hostage, starting to put it on the dark web.
196
00:12:55,880 --> 00:13:00,560
So if I'm Kentucky Fried Chicken and I've got the secret to the 11 herbs and spices,
197
00:13:00,560 --> 00:13:06,120
and that's what makes my business my business and someone goes and steals that, well then
198
00:13:06,120 --> 00:13:07,960
that could really put me in a jam.
199
00:13:07,960 --> 00:13:13,280
And now we see some other fried chicken restaurant come up and undercut me and maybe they have
200
00:13:13,280 --> 00:13:17,960
12 herbs and spices now because they're better, they know my secret.
201
00:13:17,960 --> 00:13:22,320
So we oftentimes see risk of that, particularly during COVID.
202
00:13:22,320 --> 00:13:27,520
We actually saw a lot of attacks against healthcare entities that were investigating the COVID
203
00:13:27,520 --> 00:13:28,520
vaccine.
204
00:13:28,520 --> 00:13:35,000
And I think we saw a particular nation state try and create their own COVID vaccine based
205
00:13:35,000 --> 00:13:37,160
on some of the data that was stolen.
206
00:13:37,160 --> 00:13:45,440
So a lot of these are very, like an iceberg, I think there was some company out there that
207
00:13:45,440 --> 00:13:52,160
made a iceberg graphic of the known knowns and then the unknown unknowns were actually
208
00:13:52,160 --> 00:13:56,280
deep down below the surface and vastly outnumbered the known knowns.
209
00:13:56,280 --> 00:14:02,880
So when looking at trying to protect your business, it's those things under the way
210
00:14:02,880 --> 00:14:06,280
tops that really could hem you up and bite you.
211
00:14:06,280 --> 00:14:12,480
Plus the cost of data breach notification legal, all of those things come into place.
212
00:14:12,480 --> 00:14:17,800
And now we're having to buy a lot of services for our clients and customers because their
213
00:14:17,800 --> 00:14:21,160
data was exposed, we could be exposed to lawsuits.
214
00:14:21,160 --> 00:14:24,160
So we have to figure that out outside council.
215
00:14:24,160 --> 00:14:26,440
We now have to start paying for those things.
216
00:14:26,440 --> 00:14:30,760
So a lot of expenses that organizations don't necessarily think of.
217
00:14:30,760 --> 00:14:33,160
No, those are really great points.
218
00:14:33,160 --> 00:14:39,000
You mentioned cyber insurance and I had a couple questions around that that I wanted
219
00:14:39,000 --> 00:14:42,160
to touch on because I think that's an interesting topic.
220
00:14:42,160 --> 00:14:47,220
I've spoken to some clients recently that have told me that their cyber insurance premiums
221
00:14:47,220 --> 00:14:48,220
are going up.
222
00:14:48,220 --> 00:14:50,760
I mean, you mentioned it.
223
00:14:50,760 --> 00:14:56,120
It's exponentially two, three, four times the amount.
224
00:14:56,120 --> 00:15:03,560
I'm also finding that the cyber insurers are mandating just some baseline, especially with
225
00:15:03,560 --> 00:15:12,320
some of our listeners in that mid market mandating certain countermeasures like multifactor,
226
00:15:12,320 --> 00:15:27,200
some type of endpoint protection and ongoing monitoring and retention of logs, incident
227
00:15:27,200 --> 00:15:29,360
response and disaster recovery plans.
228
00:15:29,360 --> 00:15:38,080
These are things that if you had the ability to nail it down to two or three things that
229
00:15:38,080 --> 00:15:45,760
you think would allow the listeners to keep their premiums, what would those things be?
230
00:15:45,760 --> 00:15:52,800
I think Microsoft did a study a couple of years ago and they said organizations implemented
231
00:15:52,800 --> 00:15:54,560
multifactor authentication.
232
00:15:54,560 --> 00:15:59,240
It would reduce cyber attacks by I think somewhere around the 90% range.
233
00:15:59,240 --> 00:16:06,800
I don't know what they looked at or how they came up with that calculation, but what we
234
00:16:06,800 --> 00:16:11,640
tend to look at is that hackers, they're getting passwords.
235
00:16:11,640 --> 00:16:17,080
I just read a study the other day when it talked about critical infrastructure attacks.
236
00:16:17,080 --> 00:16:24,200
Hackers were essentially using legitimate credentials, I think, in over 75% of the attacks.
237
00:16:24,200 --> 00:16:31,120
One, knowing that your users are under attack, implementing that multifactor authentication,
238
00:16:31,120 --> 00:16:36,300
using strong multifactor authentication, something like the tokens instead of something like
239
00:16:36,300 --> 00:16:39,400
a SMS text password.
240
00:16:39,400 --> 00:16:45,480
The tokens are much stronger than obviously the text because your phone can be faked,
241
00:16:45,480 --> 00:16:48,320
forged, spooked.
242
00:16:48,320 --> 00:16:51,400
That would be number one, but then also user monitoring.
243
00:16:51,400 --> 00:16:56,280
So if I know certain things about my users, they only log in maybe between the hours of
244
00:16:56,280 --> 00:16:57,280
nine to five.
245
00:16:57,280 --> 00:17:01,020
They log in from specific IP addresses.
246
00:17:01,020 --> 00:17:07,420
Having that monitoring capability, particularly on your administrators, and looking for deviations
247
00:17:07,420 --> 00:17:15,080
from the norm would probably pay dividends in a lot of the attacks that we're seeing.
248
00:17:15,080 --> 00:17:19,920
Of course, any type of monitoring that you're doing.
249
00:17:19,920 --> 00:17:24,840
Having logs, knowing what to collect, when to collect it.
250
00:17:24,840 --> 00:17:31,160
I think one of their sayings is to find evil, you have to know normal.
251
00:17:31,160 --> 00:17:34,480
Yeah, that's absolutely true.
252
00:17:34,480 --> 00:17:38,360
You have to know what right looks like, or you're never going to find wrong.
253
00:17:38,360 --> 00:17:42,760
So that's all part of a good cybersecurity program.
254
00:17:42,760 --> 00:17:43,760
Perfect.
255
00:17:43,760 --> 00:17:46,960
No, great, great, great points there, Max.
256
00:17:46,960 --> 00:17:47,960
Thank you.
257
00:17:47,960 --> 00:17:53,600
I want to shift a little bit and talk a little bit more about threat actor tactics, techniques,
258
00:17:53,600 --> 00:17:59,040
procedures, TTPs that your team are seeing from threat actors.
259
00:17:59,040 --> 00:18:05,000
Not specifics, but what are you seeing from the threat actors and their TTPs and how it's
260
00:18:05,000 --> 00:18:06,400
changed over time?
261
00:18:06,400 --> 00:18:12,120
Yeah, and I'll speak from a perspective of a lot of the research I do just in the private
262
00:18:12,120 --> 00:18:18,760
world from an educational institute perspective.
263
00:18:18,760 --> 00:18:27,000
A lot of what I'm seeing in that regard is that there is a war going on right now between
264
00:18:27,000 --> 00:18:28,400
Russia and Ukraine.
265
00:18:28,400 --> 00:18:34,080
And we're actually seeing a lot of the tactics and techniques that are used in that wartime
266
00:18:34,080 --> 00:18:40,840
environment being now operationalized and used in a civilian context, or the lines are
267
00:18:40,840 --> 00:18:41,840
being blurred now.
268
00:18:41,840 --> 00:18:47,600
There is not really a difference between what we're seeing in the war.
269
00:18:47,600 --> 00:18:51,400
Sometimes kind of commingled together.
270
00:18:51,400 --> 00:18:59,440
But we go back and I guess maybe at the start of the pandemic, we saw the rise of ransomware.
271
00:18:59,440 --> 00:19:05,160
And initially the ransomware tactics and techniques were, well, let's just go in and hold the
272
00:19:05,160 --> 00:19:06,740
data hostage.
273
00:19:06,740 --> 00:19:13,160
And early on during the pandemic, we saw a lot of organizations for the first time have
274
00:19:13,160 --> 00:19:18,920
to exercise some resiliency in that my employees are no longer in the building.
275
00:19:18,920 --> 00:19:23,880
But in order to do that, a lot of them just had to go out and buy stuff overnight, virtual
276
00:19:23,880 --> 00:19:26,200
private networks, remote desktop protocols.
277
00:19:26,200 --> 00:19:33,120
And they stood them up almost immediately, did not test them, did not implement security.
278
00:19:33,120 --> 00:19:39,440
And the initial TTP was, well, let's go after VPNs, let's go after RDP connections.
279
00:19:39,440 --> 00:19:46,360
And we saw that that was the number one cause of ransomware attacks in organizations at
280
00:19:46,360 --> 00:19:49,840
the early stages of the pandemic.
281
00:19:49,840 --> 00:19:54,560
Since then, the price of Bitcoin has fallen from 60,000, I think it's like 30,000 right
282
00:19:54,560 --> 00:19:56,360
now.
283
00:19:56,360 --> 00:20:01,880
We've seen a lot of folks no longer making these huge massive ransom payments.
284
00:20:01,880 --> 00:20:07,080
I think the biggest one I saw during the height of it was like $70 million.
285
00:20:07,080 --> 00:20:14,760
$50 million was, I think, an average ransomware payment just a couple of years ago.
286
00:20:14,760 --> 00:20:18,400
Now we're seeing quite lower ransomware payments.
287
00:20:18,400 --> 00:20:25,240
And it's more of the mindset of let's just go out and get everyone.
288
00:20:25,240 --> 00:20:32,720
And I think now what we've seen too is that Log4j, going back a couple of years, that
289
00:20:32,720 --> 00:20:35,200
was a big vulnerability that was exploited heavily.
290
00:20:35,200 --> 00:20:41,080
I think OWASP rated that as their number one, number two vulnerability for a while.
291
00:20:41,080 --> 00:20:45,760
And the patches had been out for that for at least now a couple of years.
292
00:20:45,760 --> 00:20:48,240
People still don't patch for Log4j.
293
00:20:48,240 --> 00:20:50,320
But now we have something even worse.
294
00:20:50,320 --> 00:20:57,080
We've seen the threat actors now kind of pivot to this move it vulnerability.
295
00:20:57,080 --> 00:21:01,880
And we've seen government organizations, private sectors, I think there's like 500 now private
296
00:21:01,880 --> 00:21:06,880
sector entities that have been hit with this move it vulnerability.
297
00:21:06,880 --> 00:21:09,720
Some of them still some people still don't know about it.
298
00:21:09,720 --> 00:21:15,520
Some people are now looking, you know, now just now looking to fix this.
299
00:21:15,520 --> 00:21:19,160
And this has been out since the 25th of May.
300
00:21:19,160 --> 00:21:21,480
But to circle back, I mean, completely answer your question.
301
00:21:21,480 --> 00:21:27,000
I think as a cyber person, you know, for the last decade, I've educated folks, hey, you
302
00:21:27,000 --> 00:21:31,480
need to really do a good job of taking care of your own organization, implementing those
303
00:21:31,480 --> 00:21:35,280
controls that we talked about earlier.
304
00:21:35,280 --> 00:21:39,880
Where cyber folks maybe we've fallen down over the last couple of years is that we've
305
00:21:39,880 --> 00:21:46,280
maybe neglected to say, oh, and by the way, you have to look at your third parties, because
306
00:21:46,280 --> 00:21:51,120
third parties are now big sources of vulnerability.
307
00:21:51,120 --> 00:21:57,080
And to circle back to how this relates to the Russian Ukraine crisis, when we go back
308
00:21:57,080 --> 00:22:02,880
to the first time of how Russia invaded the Crimea region 2016.
309
00:22:02,880 --> 00:22:07,480
One of the things that we saw the threat actors do in that particular case was they said,
310
00:22:07,480 --> 00:22:09,520
well, let's do a study of that country.
311
00:22:09,520 --> 00:22:14,120
And let's figure out some software that is kind of ubiquitous throughout Ukraine.
312
00:22:14,120 --> 00:22:17,800
And they actually found something called me doc.
313
00:22:17,800 --> 00:22:21,320
And it's a financial accounting software, pretty much everybody uses it.
314
00:22:21,320 --> 00:22:27,040
I think it's almost mandated by the government that everyone had to use me doc to report
315
00:22:27,040 --> 00:22:28,760
finances and taxes.
316
00:22:28,760 --> 00:22:31,600
Well, Russia said, let's hack into that.
317
00:22:31,600 --> 00:22:35,760
And all of the updates that me doc is providing to its clients and customers.
318
00:22:35,760 --> 00:22:38,760
Well, let's put some malware in that.
319
00:22:38,760 --> 00:22:43,120
And let's start shutting down these critical infrastructure sectors like we talked about
320
00:22:43,120 --> 00:22:46,840
earlier, the power, the banks, all of that stuff.
321
00:22:46,840 --> 00:22:49,920
And we saw that that is exactly what happened.
322
00:22:49,920 --> 00:22:54,440
And that has been a TTP, I think we've seen since 2016.
323
00:22:54,440 --> 00:22:58,840
And there's been a number of attacks in that regard.
324
00:22:58,840 --> 00:23:02,600
I think SolarWinds is exactly how they use SolarWinds.
325
00:23:02,600 --> 00:23:08,240
But even before that, there was a company that they clean up your desktop software,
326
00:23:08,240 --> 00:23:11,040
it used to be known as crap cleaner, it's called C cleaner.
327
00:23:11,040 --> 00:23:15,560
Now, the same thing happened to that when they hacked into it, all of the updates and
328
00:23:15,560 --> 00:23:22,880
was providing to its clients and customers that was essentially laced with malware.
329
00:23:22,880 --> 00:23:29,120
So the third party aspect, the threat actors now using those and leveraging those third
330
00:23:29,120 --> 00:23:31,240
parties to get into your organization.
331
00:23:31,240 --> 00:23:37,640
I think that's an evolving technique that we have seen in that regard.
332
00:23:37,640 --> 00:23:42,400
And then just in the ransomware space, again, that has evolved where they're just not content
333
00:23:42,400 --> 00:23:44,600
with taking and holding your data hostage.
334
00:23:44,600 --> 00:23:50,220
We're actually seeing these folks now use more of an extortion technique.
335
00:23:50,220 --> 00:23:55,360
We're going to take your proprietary data or your personal health information, your
336
00:23:55,360 --> 00:24:00,920
PII, and we're going to hold that hostage and threaten to release that on the dark web
337
00:24:00,920 --> 00:24:02,880
if you don't make some type of payments.
338
00:24:02,880 --> 00:24:07,720
So I think the attacks have evolved in that regard.
339
00:24:07,720 --> 00:24:12,640
Yeah, I know you brought up the interesting thing about ransom payments.
340
00:24:12,640 --> 00:24:21,840
I'm interested in your opinion on whether or not collectively there would ever be a
341
00:24:21,840 --> 00:24:29,900
movement where organizations will stop paying the ransom and do other measures to recoup
342
00:24:29,900 --> 00:24:35,920
and to recover from a ransomware attack and stop kind of that money train that seems to
343
00:24:35,920 --> 00:24:38,000
be right.
344
00:24:38,000 --> 00:24:47,440
Because the more the industry pays, the hackers will continue.
345
00:24:47,440 --> 00:24:50,100
It's a money game for them.
346
00:24:50,100 --> 00:24:57,240
But do you ever see that coming to fruition where we band together and say, no more payments,
347
00:24:57,240 --> 00:25:00,240
we're just going to recover in another way?
348
00:25:00,240 --> 00:25:07,220
Or will this always be kind of where we kind of stand and continue to pay these ransoms
349
00:25:07,220 --> 00:25:11,160
that will continue to impact industries?
350
00:25:11,160 --> 00:25:17,840
Yeah, I think for the most part, we still don't see a large group of organizations making
351
00:25:17,840 --> 00:25:18,840
ransom payments.
352
00:25:18,840 --> 00:25:24,720
But the quantity of them is so heavy and vast right now.
353
00:25:24,720 --> 00:25:31,160
Even the 30, almost 40% that are paying, that does add up.
354
00:25:31,160 --> 00:25:34,640
So it is a very lucrative business.
355
00:25:34,640 --> 00:25:42,400
As far as being able to recover, I think we preach for a long time that you have to have
356
00:25:42,400 --> 00:25:44,320
good backups of your system.
357
00:25:44,320 --> 00:25:47,800
You have to have a business continuity plan.
358
00:25:47,800 --> 00:25:50,960
You have to have a disaster recovery plan.
359
00:25:50,960 --> 00:25:53,800
You have to test those and make sure they've worked.
360
00:25:53,800 --> 00:25:57,520
I've spoken to a lot of organizations that have been hit and they're like, oh, yeah,
361
00:25:57,520 --> 00:26:00,680
we have backups or we have a backup.
362
00:26:00,680 --> 00:26:04,240
And then I'll talk to them three or four months later and they're like, oh, gosh, we've been
363
00:26:04,240 --> 00:26:05,240
hit with ransomware.
364
00:26:05,240 --> 00:26:06,240
We don't know what we're going to do.
365
00:26:06,240 --> 00:26:07,240
I thought you had backups.
366
00:26:07,240 --> 00:26:13,040
Oh, yeah, well, we've never tested it or the backup didn't work or the backup was only
367
00:26:13,040 --> 00:26:14,840
to a certain point in time.
368
00:26:14,840 --> 00:26:18,580
And the ransomware happened when we backed up the data.
369
00:26:18,580 --> 00:26:20,080
So we just restore it.
370
00:26:20,080 --> 00:26:23,460
We're restoring back to ransomware.
371
00:26:23,460 --> 00:26:31,040
So I think not just having a plan is good, but testing that plan, you have to put into
372
00:26:31,040 --> 00:26:33,280
some type of tabletop testing.
373
00:26:33,280 --> 00:26:37,080
You have to put in some type of actually no crap.
374
00:26:37,080 --> 00:26:41,320
I'm going to make sure the backups work and we're going to test this maybe over a long
375
00:26:41,320 --> 00:26:45,560
weekend to see if this actually happens.
376
00:26:45,560 --> 00:26:49,400
So I think, yeah, that's definitely needed.
377
00:26:49,400 --> 00:26:53,640
There's an old military expression, two is one and one is none.
378
00:26:53,640 --> 00:26:57,680
So one backup is probably good, but 500 backups are better.
379
00:26:57,680 --> 00:27:01,400
If you really want to be resilient, that may be an overkill.
380
00:27:01,400 --> 00:27:06,160
But you definitely have to know when the threat actor got in your system and be able to restore
381
00:27:06,160 --> 00:27:08,080
to a known good point before that.
382
00:27:08,080 --> 00:27:15,200
So having these multiple iterations of backups are definitely going to help your organization
383
00:27:15,200 --> 00:27:16,680
when the time comes.
384
00:27:16,680 --> 00:27:22,080
And then knowing that your teams can restore from those backups when needed gives you the
385
00:27:22,080 --> 00:27:27,720
power to not have to negotiate with these ransomware takers.
386
00:27:27,720 --> 00:27:35,440
So just encrypting your data using these basic cybersecurity protective measures, encrypt
387
00:27:35,440 --> 00:27:42,400
data at rest, encrypt data at transit, that would be very beneficial as well.
388
00:27:42,400 --> 00:27:45,120
Yeah, I wanted to, it's great points.
389
00:27:45,120 --> 00:27:47,640
Thanks for sharing it.
390
00:27:47,640 --> 00:27:53,680
I love that mindset of two is good, one is none.
391
00:27:53,680 --> 00:27:55,600
I wrote that down.
392
00:27:55,600 --> 00:27:58,640
I'm going to reuse that, maybe even put it on a t-shirt.
393
00:27:58,640 --> 00:28:02,520
But one of the things that I wanted to talk about was third party.
394
00:28:02,520 --> 00:28:11,680
You mentioned third party vulnerabilities or risks and that seems to be the threat vector
395
00:28:11,680 --> 00:28:15,040
that most people overlook in the mid-market.
396
00:28:15,040 --> 00:28:19,640
They think about shoring up their defenses, but they don't think about the weakest link
397
00:28:19,640 --> 00:28:25,360
in their security as that vendor that they've given VPN access or remote access to support
398
00:28:25,360 --> 00:28:30,880
some kind of software or application or system in their environment.
399
00:28:30,880 --> 00:28:38,240
How have you seen companies do a good job of handling that third party risk?
400
00:28:38,240 --> 00:28:44,080
Yeah, so for ages and ages, organizations have had third party oversight.
401
00:28:44,080 --> 00:28:50,160
So when you get ready to do business with somebody, you bring in a team of folks, maybe
402
00:28:50,160 --> 00:28:54,760
somebody from cyber, somebody from legal, somebody from pretty much every department
403
00:28:54,760 --> 00:29:00,640
who's going to have a say in this, and you go over the contract, the service level agreements
404
00:29:00,640 --> 00:29:04,120
that you're going to have, what you expect that company to do for you.
405
00:29:04,120 --> 00:29:10,560
You may ask them certain cyber questions, and then you sign a contract and then you
406
00:29:10,560 --> 00:29:15,440
largely forget about that until something bad happens.
407
00:29:15,440 --> 00:29:21,600
And that's where more successful organizations we see that, okay, we're not going to let
408
00:29:21,600 --> 00:29:26,680
this thing just kind of die on the vine or just wait for the relationship to deteriorate
409
00:29:26,680 --> 00:29:28,880
or for them to screw up.
410
00:29:28,880 --> 00:29:37,120
We have to at least annually go back and review, is this contract or is it doing what we've
411
00:29:37,120 --> 00:29:38,120
asked it to do?
412
00:29:38,120 --> 00:29:41,040
Are they adhering to the terms of the contract?
413
00:29:41,040 --> 00:29:49,640
Have we conducted an exercise with a drill with them in the case of something bad occurring
414
00:29:49,640 --> 00:29:51,360
and asking those questions?
415
00:29:51,360 --> 00:29:58,200
When vulnerabilities come out like log for J or this move-in vulnerability, have we asked
416
00:29:58,200 --> 00:30:01,520
the vendor, what have you done to patch this?
417
00:30:01,520 --> 00:30:05,320
Also, do we know what data that we're sharing with them?
418
00:30:05,320 --> 00:30:10,880
So in the event that we think that there may be a compromise, do we know what information
419
00:30:10,880 --> 00:30:14,760
we may have that we've shared could potentially be at risk?
420
00:30:14,760 --> 00:30:21,220
So it's a whole of organization aspect, but it has to be something that's continuous and
421
00:30:21,220 --> 00:30:22,220
ongoing.
422
00:30:22,220 --> 00:30:28,960
It can't just be, well, let's one and done and then wait for the best to happen.
423
00:30:28,960 --> 00:30:37,720
No, it's a really great point because last week was with a customer in Georgia and specifically
424
00:30:37,720 --> 00:30:43,840
this came up, which was, have you put into practice your business continuity plan?
425
00:30:43,840 --> 00:30:44,840
Have you tested it?
426
00:30:44,840 --> 00:30:51,040
Have you gotten everybody in the room, tossed a scenario at them?
427
00:30:51,040 --> 00:30:55,440
Have you assessed on an annual basis your third parties?
428
00:30:55,440 --> 00:31:02,240
And the CISO looked at me and he was like, no, we don't even know where to start.
429
00:31:02,240 --> 00:31:04,920
And that's not a small organization.
430
00:31:04,920 --> 00:31:12,800
That's a fairly large, several thousand employees, hundreds of millions of dollars in revenue
431
00:31:12,800 --> 00:31:15,300
at risk.
432
00:31:15,300 --> 00:31:19,700
And I think about that and I think that the point you made, which is really, really good
433
00:31:19,700 --> 00:31:26,320
is that annual attestation is super important, but then practicing the business continuity,
434
00:31:26,320 --> 00:31:28,440
the incident response.
435
00:31:28,440 --> 00:31:34,320
You mentioned previously about having those contacts with law enforcement or legal counsel,
436
00:31:34,320 --> 00:31:40,720
forensic investigators, those things, those relationships should never start when a ransomware
437
00:31:40,720 --> 00:31:42,920
has actually happened.
438
00:31:42,920 --> 00:31:45,320
It should be established.
439
00:31:45,320 --> 00:31:46,960
You should have practiced it.
440
00:31:46,960 --> 00:31:49,920
You should have that muscle memory.
441
00:31:49,920 --> 00:31:51,520
So really, really great points.
442
00:31:51,520 --> 00:31:53,840
I really appreciate that.
443
00:31:53,840 --> 00:32:00,880
I'd like to shift a little bit toward the insider threat and maybe share a little bit
444
00:32:00,880 --> 00:32:08,080
about your thoughts on how companies can protect against the insider threat.
445
00:32:08,080 --> 00:32:09,800
You mentioned intellectual property.
446
00:32:09,800 --> 00:32:16,000
That seems to be the number one asset that gets compromised from the insider.
447
00:32:16,000 --> 00:32:20,120
But maybe you can share a little bit about that and maybe some of your thoughts on how
448
00:32:20,120 --> 00:32:24,160
to mitigate that risk of that insider threat.
449
00:32:24,160 --> 00:32:29,640
And it's uncomfortable for a lot of organizations to talk about because we don't like to think
450
00:32:29,640 --> 00:32:36,960
that somebody that we work with is potentially going to be that person that takes our organization
451
00:32:36,960 --> 00:32:39,480
down, that steals our data from us.
452
00:32:39,480 --> 00:32:45,120
And then looking at my government experience, from my government background, I mean, catching
453
00:32:45,120 --> 00:32:52,560
spies, the Robert Hansons, the Edward Snowdens of the organizations, they were trusted with
454
00:32:52,560 --> 00:32:54,880
access to certain data.
455
00:32:54,880 --> 00:32:57,680
And then they essentially betrayed that trust.
456
00:32:57,680 --> 00:33:00,840
Rightfully or wrongly, it's a political thing for some folks to look at.
457
00:33:00,840 --> 00:33:02,840
I don't want to delve into that.
458
00:33:02,840 --> 00:33:07,960
But organizationally, you do have to look at, OK, well, we've entrusted people with
459
00:33:07,960 --> 00:33:11,000
some very high levels of access.
460
00:33:11,000 --> 00:33:16,520
And then they kind of walk away with that data, put that data out there, and we didn't
461
00:33:16,520 --> 00:33:17,640
want it.
462
00:33:17,640 --> 00:33:20,400
Those are the intentional insider threats.
463
00:33:20,400 --> 00:33:25,400
And those are things that everybody probably thinks about when we hear the term insider
464
00:33:25,400 --> 00:33:26,400
threat.
465
00:33:26,400 --> 00:33:31,720
There's also the unintentional insider threat, which is pretty much everybody in the organization
466
00:33:31,720 --> 00:33:37,800
who might do something stupid on the computer, which IT folks, I think, were probably some
467
00:33:37,800 --> 00:33:46,040
of the worst offenders of doing stupid things, but just anybody who gets a phishing email,
468
00:33:46,040 --> 00:33:50,480
that's still a large portion of cyber attacks that are out there.
469
00:33:50,480 --> 00:33:52,960
And it only takes one.
470
00:33:52,960 --> 00:33:57,560
And if your staff isn't trained on recognizing the latest and greatest phishing attacks,
471
00:33:57,560 --> 00:34:02,320
which we talk about things that are evolving, we now see blended attacks where you're getting
472
00:34:02,320 --> 00:34:07,200
emails that are directing you to pick up the phone and call the hackers and talking to
473
00:34:07,200 --> 00:34:08,520
a person on the phone.
474
00:34:08,520 --> 00:34:11,220
They're again, letting that guard down a little bit more.
475
00:34:11,220 --> 00:34:14,440
You might start divulging things that you necessarily wouldn't.
476
00:34:14,440 --> 00:34:22,840
So the unintentional insider can be just as dangerous as that intentional insider.
477
00:34:22,840 --> 00:34:27,800
We have to go back and again, we have to look at certain policies.
478
00:34:27,800 --> 00:34:30,440
What controls can I put in place?
479
00:34:30,440 --> 00:34:35,880
What policy controls can I put in place to one maybe stave off some of this?
480
00:34:35,880 --> 00:34:41,640
So could be maybe you're not going to bring thumb drives or a movable media into the building.
481
00:34:41,640 --> 00:34:46,680
My technical control might be that I'm going to monitor for the use of thumb drives.
482
00:34:46,680 --> 00:34:51,520
Then I might have a disciplinary program attached around that.
483
00:34:51,520 --> 00:34:58,360
Maybe even for our unintentional insiders, we do now see a lot of folks using these third
484
00:34:58,360 --> 00:35:02,520
party services to conduct phishing attacks on their organizations.
485
00:35:02,520 --> 00:35:05,080
Kevin Mitnick, great guy.
486
00:35:05,080 --> 00:35:07,560
Just lost him a couple weeks ago.
487
00:35:07,560 --> 00:35:14,160
He had a great company out there that was doing these phishing attacks.
488
00:35:14,160 --> 00:35:17,800
We see a lot of use and a lot of value in that.
489
00:35:17,800 --> 00:35:19,120
We're training your organizations.
490
00:35:19,120 --> 00:35:21,840
A lot of the folks I talk to now, they're kind of paranoid.
491
00:35:21,840 --> 00:35:27,120
Like, oh gosh, is this going to be a phishing test that my IT team is doing?
492
00:35:27,120 --> 00:35:31,280
And yeah, I'm glad to see people are now a little scared about that.
493
00:35:31,280 --> 00:35:35,040
We do see some disciplinary programs coming up through a lot of organizations.
494
00:35:35,040 --> 00:35:41,640
Maybe the first time that you click on a phishing email and it's one of these tests that are
495
00:35:41,640 --> 00:35:48,600
coming from one of these third party companies that you're seeing a little education, training
496
00:35:48,600 --> 00:35:50,000
and support coming your way.
497
00:35:50,000 --> 00:35:51,960
Like, okay, hey, you failed the phishing test.
498
00:35:51,960 --> 00:35:53,500
Let's educate you.
499
00:35:53,500 --> 00:35:57,000
Maybe the second time you do it, your manager provides you some education, training and
500
00:35:57,000 --> 00:35:58,280
support.
501
00:35:58,280 --> 00:36:02,120
Maybe the third or fourth time you do this, it may or may not be a resume generating event,
502
00:36:02,120 --> 00:36:06,280
but HR gets involved in the figuring out, hey, why do you keep clicking these phishing
503
00:36:06,280 --> 00:36:07,280
emails?
504
00:36:07,280 --> 00:36:12,000
Are you doing this on purpose or are you just not taking to the training what's going on?
505
00:36:12,000 --> 00:36:19,440
But again, there has to be a, all of the controls put in place, the policy, the technical, we
506
00:36:19,440 --> 00:36:22,920
have to be able to monitor and have some type of metric.
507
00:36:22,920 --> 00:36:27,960
I think Jack Welch said something, if you can't measure it, you can't manage it.
508
00:36:27,960 --> 00:36:31,280
I know in the business world that may cause some consternation with some folks, but I
509
00:36:31,280 --> 00:36:34,520
think in the IT world, it's definitely good as a science background.
510
00:36:34,520 --> 00:36:38,840
I want to have some measurements on what my network and my employees are doing.
511
00:36:38,840 --> 00:36:44,760
So if I start out doing my phishing test and we've got 50, 70% click rate and now I've
512
00:36:44,760 --> 00:36:49,160
got my folks trained in paranoia and we're down in the single digits, I think, you know,
513
00:36:49,160 --> 00:36:52,840
it's not perfect, but I'm doing better and we're not having as many attacks.
514
00:36:52,840 --> 00:36:59,240
Then I can focus maybe some more of my effort on triaging some of these phishing things
515
00:36:59,240 --> 00:37:03,360
that might get through and just allows me to better focus my efforts.
516
00:37:03,360 --> 00:37:04,840
Probably a longer answer than you wanted.
517
00:37:04,840 --> 00:37:12,160
No, no, you gave some great topics here like, you know, the policy and the controls are
518
00:37:12,160 --> 00:37:13,160
super important.
519
00:37:13,160 --> 00:37:17,000
I think the education is key as well.
520
00:37:17,000 --> 00:37:23,920
But one of the things that I've seen is creating this culture where questioning is okay.
521
00:37:23,920 --> 00:37:32,280
What I mean by that is we've gotten, you know, we've seen internally an increase in kind
522
00:37:32,280 --> 00:37:39,080
of these SMS phishing, you know, the smishing where someone will get a text from our CEO
523
00:37:39,080 --> 00:37:43,000
saying, hey, this is me with a new cell phone.
524
00:37:43,000 --> 00:37:45,320
I need you to respond immediately.
525
00:37:45,320 --> 00:37:46,840
Yeah.
526
00:37:46,840 --> 00:37:52,520
And instead of simply responding, we developed this culture of, hmm, that sounds odd.
527
00:37:52,520 --> 00:37:53,520
Let me question it.
528
00:37:53,520 --> 00:37:58,880
I know his real cell number and this actually happened to me two weekends ago.
529
00:37:58,880 --> 00:38:05,680
Another one that happened was on the last day of the month, we got to an email alias,
530
00:38:05,680 --> 00:38:13,040
a file that said signed PO for X hundred thousands of dollars.
531
00:38:13,040 --> 00:38:20,120
And you know, I immediately notified sales organizations that do not click on that.
532
00:38:20,120 --> 00:38:23,560
And I knew that they were questioning it when I contacted IT.
533
00:38:23,560 --> 00:38:25,960
Yes, several people already notified us.
534
00:38:25,960 --> 00:38:29,240
It's that culture of question, right?
535
00:38:29,240 --> 00:38:34,720
Don't trust everything that you get, even if it seems like a PO at the end of the month.
536
00:38:34,720 --> 00:38:37,400
It goes back to empowering your employees as well.
537
00:38:37,400 --> 00:38:38,400
So I think that's a good point.
538
00:38:38,400 --> 00:38:40,640
We have to question, we have to empower employees.
539
00:38:40,640 --> 00:38:45,000
That purchase order you're receiving in the financial world, we call that a business email
540
00:38:45,000 --> 00:38:51,920
compromise and that's probably the number one external fraud threat that you're going
541
00:38:51,920 --> 00:38:56,200
to face, but it's enabled by these unintentional insiders in your company.
542
00:38:56,200 --> 00:39:00,680
So one, you have to train the staff, the accounts payable staff.
543
00:39:00,680 --> 00:39:01,680
What does this look like?
544
00:39:01,680 --> 00:39:06,320
But you have to have the authority to question that because oftentimes those are accompanied
545
00:39:06,320 --> 00:39:10,400
by, well, if you don't make the payment, we're going to assess you a late fee, a penalty.
546
00:39:10,400 --> 00:39:12,280
We're going to cancel your contract.
547
00:39:12,280 --> 00:39:16,560
And you have that person who's, they're decently paid, but they're not well off.
548
00:39:16,560 --> 00:39:20,920
They're like, gosh, I don't want to be responsible for ruining this relationship, incurring a
549
00:39:20,920 --> 00:39:22,040
late fee.
550
00:39:22,040 --> 00:39:23,040
I need my job.
551
00:39:23,040 --> 00:39:24,040
I don't want to get fired.
552
00:39:24,040 --> 00:39:25,720
Let me go ahead and make this payment.
553
00:39:25,720 --> 00:39:28,240
So not only questioning, but also reporting.
554
00:39:28,240 --> 00:39:32,280
And I think that's one of the other aspects is that not only when you see these phishing
555
00:39:32,280 --> 00:39:39,080
emails should you look at this and question it, not just delete it, but your organization
556
00:39:39,080 --> 00:39:45,480
needs to have a mechanism to report this over to the IT staff, like you were talking about,
557
00:39:45,480 --> 00:39:52,680
so they can remove this from the inboxes of folks who may not have that questioning mindset.
558
00:39:52,680 --> 00:39:57,320
And going back again to my government days, another thing that we look at is not just
559
00:39:57,320 --> 00:40:03,040
questioning and reporting.
560
00:40:03,040 --> 00:40:07,640
All of the fraud contacts in your organization and all the insider threat folks in your organization
561
00:40:07,640 --> 00:40:13,880
will say that the number one way of catching insider threats in your organization is the
562
00:40:13,880 --> 00:40:14,880
reporting.
563
00:40:14,880 --> 00:40:19,720
And you have to have a culture of reporting in the organization.
564
00:40:19,720 --> 00:40:27,080
Going back and looking at spies like Aldrich Ames, he did a lot of damage to the government.
565
00:40:27,080 --> 00:40:29,120
And he went undetected for a long time.
566
00:40:29,120 --> 00:40:35,080
And he was an instructor at the CIA's farm and was training future spies, but was also
567
00:40:35,080 --> 00:40:36,080
selling them out.
568
00:40:36,080 --> 00:40:42,960
But it wasn't until someone came and actually looked at his drapes and recognized that,
569
00:40:42,960 --> 00:40:45,120
gosh, these drapes are thousands of dollars.
570
00:40:45,120 --> 00:40:49,480
There's no way that this guy is just 14 or 15 would be able to afford this.
571
00:40:49,480 --> 00:40:55,680
They actually reported him and were able to then catch that spy.
572
00:40:55,680 --> 00:40:57,480
Interesting.
573
00:40:57,480 --> 00:41:03,920
I'd like to shift focus a little bit and talk about artificial intelligence and how you
574
00:41:03,920 --> 00:41:09,120
perceive AI having an impact on cybersecurity.
575
00:41:09,120 --> 00:41:10,800
There's two aspects of it.
576
00:41:10,800 --> 00:41:15,760
There's the threat actors use of AI, but then there's also the countermeasures that are
577
00:41:15,760 --> 00:41:18,560
powered by AI.
578
00:41:18,560 --> 00:41:24,480
How do you see AI having an impact on cybersecurity?
579
00:41:24,480 --> 00:41:28,880
People in cybersecurity have been using AI longer than I think a lot of the population
580
00:41:28,880 --> 00:41:32,840
has known about artificial intelligence.
581
00:41:32,840 --> 00:41:40,080
So anybody who's been in the cyber world for a decade, we've seen the emergence of AI,
582
00:41:40,080 --> 00:41:42,200
particularly as it relates to endpoint detection response.
583
00:41:42,200 --> 00:41:44,640
There's a host of companies out there that are using it.
584
00:41:44,640 --> 00:41:48,400
There's a host of companies that are doing it at the perimeters and the firewall level
585
00:41:48,400 --> 00:41:50,240
as well.
586
00:41:50,240 --> 00:41:55,840
So that is a good use of that technology.
587
00:41:55,840 --> 00:41:58,040
And then AI is obviously a broad set.
588
00:41:58,040 --> 00:42:02,240
You have AI in general and machine learning and then deep learning.
589
00:42:02,240 --> 00:42:08,320
So there's a myriad of stuff that encompasses AI in and of itself.
590
00:42:08,320 --> 00:42:11,200
A lot of what we're seeing, I think, is scaremongering.
591
00:42:11,200 --> 00:42:15,040
It's people who've watched 2001, a space odyssey.
592
00:42:15,040 --> 00:42:23,320
I think Hal's going to take over the nuclear weapons or we've seen Terminator.
593
00:42:23,320 --> 00:42:29,280
Not that we shouldn't necessarily question what it's doing, but I think a lot of the
594
00:42:29,280 --> 00:42:32,320
hype curve of this is kind of overblown.
595
00:42:32,320 --> 00:42:34,760
I do think it is a good use of technology.
596
00:42:34,760 --> 00:42:36,000
We have to use it smartly.
597
00:42:36,000 --> 00:42:38,360
We have to understand what it's doing.
598
00:42:38,360 --> 00:42:45,040
I think a lot of the issue with AI is that a lot of the outputs are black box.
599
00:42:45,040 --> 00:42:49,320
They're not necessarily Bayesian logarithms that you can follow along with some type of
600
00:42:49,320 --> 00:42:51,960
mathematical concept.
601
00:42:51,960 --> 00:42:53,600
It's doing something.
602
00:42:53,600 --> 00:42:57,360
We kind of have an idea of what it's doing, but we don't know why it's deriving certain
603
00:42:57,360 --> 00:43:03,880
conclusions, but we do see that it's coming to relatively a good understanding of what
604
00:43:03,880 --> 00:43:05,520
we've asked it to do.
605
00:43:05,520 --> 00:43:10,180
But when we start reusing code and we start asking AI to do certain things that maybe
606
00:43:10,180 --> 00:43:14,400
it wasn't initially intended to do, but now we're asking it to do something different
607
00:43:14,400 --> 00:43:20,120
and it comes out with some crazy result, OK, well, yes, you should expect that because
608
00:43:20,120 --> 00:43:24,360
that's not what it was intended to do and we're using it for that purpose.
609
00:43:24,360 --> 00:43:31,040
So I do see AI as a good tool, hackers, obviously there's hack GPT now they're using it for
610
00:43:31,040 --> 00:43:33,280
some nefarious things.
611
00:43:33,280 --> 00:43:36,920
I have played around with it even just as far as early this year.
612
00:43:36,920 --> 00:43:41,440
Chat GPT, it didn't code very well in Python.
613
00:43:41,440 --> 00:43:43,440
It's gotten a little bit better.
614
00:43:43,440 --> 00:43:44,920
It didn't do math very well.
615
00:43:44,920 --> 00:43:47,320
I've asked it to do some very simple math problems.
616
00:43:47,320 --> 00:43:52,580
I think it had problems doing subtraction and division.
617
00:43:52,580 --> 00:43:58,560
So yeah, it's a decent tool, but it's not going to be the end all be all.
618
00:43:58,560 --> 00:44:01,600
I think that some people make it out to be.
619
00:44:01,600 --> 00:44:03,600
No, I appreciate that.
620
00:44:03,600 --> 00:44:11,400
I did want to end on a note and ask your opinion about that new SEC rule that is requiring
621
00:44:11,400 --> 00:44:16,600
companies to reveal cyber attacks within about four days.
622
00:44:16,600 --> 00:44:21,520
The stated purpose of this SEC rule is to protect investors.
623
00:44:21,520 --> 00:44:23,000
Right.
624
00:44:23,000 --> 00:44:28,160
But with the experience you've had in forensic investigations and that my teams have had
625
00:44:28,160 --> 00:44:33,720
in forensic investigations, four days seems like a very short amount of time to do root
626
00:44:33,720 --> 00:44:39,560
cause analysis to actually figure out what the attack impact is.
627
00:44:39,560 --> 00:44:45,640
Do you have any thoughts on that rule and how it's going to be a game changer for how
628
00:44:45,640 --> 00:44:49,040
quickly companies have to report these attacks?
629
00:44:49,040 --> 00:44:50,040
Yeah.
630
00:44:50,040 --> 00:44:52,720
Well, first and foremost, I mean, it's an SEC rule.
631
00:44:52,720 --> 00:44:59,040
So right now when it comes to fruition, you're going to have to follow it.
632
00:44:59,040 --> 00:45:04,640
And essentially you need to get your legal counsel involved because it is a legal process
633
00:45:04,640 --> 00:45:09,400
first and foremost, but you also have to have your cyber folks.
634
00:45:09,400 --> 00:45:15,700
Looking at the SEC rule, it also says a material breach.
635
00:45:15,700 --> 00:45:18,760
Because that's a legal word, you're going to have to figure out what the word material
636
00:45:18,760 --> 00:45:19,920
means.
637
00:45:19,920 --> 00:45:22,520
So it's not just a cyber process.
638
00:45:22,520 --> 00:45:25,280
So one, yes, go out, follow the law.
639
00:45:25,280 --> 00:45:28,760
Two, get your cyber folks involved.
640
00:45:28,760 --> 00:45:31,860
Our job is the same thing we've always done.
641
00:45:31,860 --> 00:45:32,920
Let's go investigate.
642
00:45:32,920 --> 00:45:33,920
Let's find the cause of the breach.
643
00:45:33,920 --> 00:45:36,240
Let's go through the incident response process.
644
00:45:36,240 --> 00:45:38,560
Let's do all of those things.
645
00:45:38,560 --> 00:45:40,440
Let the legal folks worry about the legal things.
646
00:45:40,440 --> 00:45:41,440
I'm not a lawyer.
647
00:45:41,440 --> 00:45:43,000
I can't give legal advice.
648
00:45:43,000 --> 00:45:48,240
That being said, when we look at maybe some of the material impacts, okay, now I'm having
649
00:45:48,240 --> 00:45:55,120
to notify the government about a potential breach that I'm still investigating.
650
00:45:55,120 --> 00:46:01,640
I may not have had time to patch or mitigate some of the things that I'm still trying to
651
00:46:01,640 --> 00:46:02,920
figure out.
652
00:46:02,920 --> 00:46:05,280
Is there a potential risk there?
653
00:46:05,280 --> 00:46:06,920
Yeah, there could be.
654
00:46:06,920 --> 00:46:15,760
Because now I'm notifying someone outside of my organization about a breach and I still
655
00:46:15,760 --> 00:46:19,800
don't maybe know how, why, what happened.
656
00:46:19,800 --> 00:46:24,600
Other people could then say, ah, ACME widgets has been hit.
657
00:46:24,600 --> 00:46:29,300
Let's start going after them because they're just in the middle of recovery process.
658
00:46:29,300 --> 00:46:32,040
We know that something bad is happening.
659
00:46:32,040 --> 00:46:40,240
So maybe from a tactical side of the house, it could be less than optimal for some cyber
660
00:46:40,240 --> 00:46:41,560
work.
661
00:46:41,560 --> 00:46:43,960
I understand why the government did it.
662
00:46:43,960 --> 00:46:51,260
So we're trying to protect investors, but it may have some second and third order effects
663
00:46:51,260 --> 00:46:54,600
that we don't know about yet.
664
00:46:54,600 --> 00:47:01,280
So it's important again, if you find it's not working, if companies are finding that
665
00:47:01,280 --> 00:47:04,080
it's not working, it's a legislative process.
666
00:47:04,080 --> 00:47:08,080
Let's get in touch with our legislators and provide some input on that.
667
00:47:08,080 --> 00:47:09,080
Great.
668
00:47:09,080 --> 00:47:10,560
Well, I appreciate the comment.
669
00:47:10,560 --> 00:47:19,120
One last thought, there seems to always be this shortage of resources, skilled resources
670
00:47:19,120 --> 00:47:20,720
in cybersecurity.
671
00:47:20,720 --> 00:47:26,760
The number varies depending upon what trade rags you read, the hundred thousands to the
672
00:47:26,760 --> 00:47:27,760
millions.
673
00:47:27,760 --> 00:47:35,960
What are your thoughts on how you crack into cyber?
674
00:47:35,960 --> 00:47:39,620
And it's always that catch-22.
675
00:47:39,620 --> 00:47:43,640
People want to hire folks with experience, but you don't get experience until you actually
676
00:47:43,640 --> 00:47:46,000
get a job in the industry.
677
00:47:46,000 --> 00:47:54,000
So how do we make up that delta of resources that seem to be always lacking in cybersecurity?
678
00:47:54,000 --> 00:47:57,680
Experience comes from different things.
679
00:47:57,680 --> 00:48:04,400
So education first and foremost, you have to know what you're doing.
680
00:48:04,400 --> 00:48:06,880
Does that mean everybody has to go to college?
681
00:48:06,880 --> 00:48:07,880
No.
682
00:48:07,880 --> 00:48:10,640
Does everybody have to have a CISSP?
683
00:48:10,640 --> 00:48:11,640
No.
684
00:48:11,640 --> 00:48:17,680
But some of those, those were the routes that I took just because I'm a glutton for punishment
685
00:48:17,680 --> 00:48:19,920
and I like doing some of those things.
686
00:48:19,920 --> 00:48:22,920
My daughter, she's 16, almost 17 years old now.
687
00:48:22,920 --> 00:48:25,520
She absolutely hates and detests going to school.
688
00:48:25,520 --> 00:48:28,560
I have to be on her all the time.
689
00:48:28,560 --> 00:48:34,040
She likes cybersecurity, so I've enrolled her in as many cyber things in her high school
690
00:48:34,040 --> 00:48:35,240
now as we can.
691
00:48:35,240 --> 00:48:38,400
So she just finished the complete cyber curriculum they have.
692
00:48:38,400 --> 00:48:41,440
She's doing coding this year.
693
00:48:41,440 --> 00:48:45,600
I think we've determined that she probably, the four-year university is just not going
694
00:48:45,600 --> 00:48:47,240
to be for her.
695
00:48:47,240 --> 00:48:52,160
There's a great community college, Nova Community College.
696
00:48:52,160 --> 00:48:55,360
They have an Associates of Applied Science.
697
00:48:55,360 --> 00:49:01,180
She's looking at doing that cyber curriculum, cyber program there to get that training.
698
00:49:01,180 --> 00:49:04,600
And then also maybe looking at internships and things along the way.
699
00:49:04,600 --> 00:49:10,440
So there is a path for her, even someone who doesn't like college, that maybe it might
700
00:49:10,440 --> 00:49:12,960
be an option for her in the future.
701
00:49:12,960 --> 00:49:19,120
But I do think too that we can't just look at college as a way like, oh, well, you don't
702
00:49:19,120 --> 00:49:20,200
have a four-year degree.
703
00:49:20,200 --> 00:49:22,380
You're not qualified to do cyber.
704
00:49:22,380 --> 00:49:27,120
There are lots of folks out there that do not have any college, do not have any cybersecurity
705
00:49:27,120 --> 00:49:30,440
certifications whatsoever.
706
00:49:30,440 --> 00:49:36,920
And they still can pick up something and they're still valuable in this process and could ultimately
707
00:49:36,920 --> 00:49:38,520
be a really good cyber person.
708
00:49:38,520 --> 00:49:42,040
So we can't necessarily discount those folks either.
709
00:49:42,040 --> 00:49:46,840
Within, you know, if your companies are big enough that you can afford to have some of
710
00:49:46,840 --> 00:49:53,040
your own internal training, that might be a method to go to build your own.
711
00:49:53,040 --> 00:49:54,040
Okay.
712
00:49:54,040 --> 00:49:59,640
We, you know, the business that may be more important than knowing cyber, let's grow our
713
00:49:59,640 --> 00:50:03,240
own and develop what we need along that process.
714
00:50:03,240 --> 00:50:05,160
And that could be skills.
715
00:50:05,160 --> 00:50:07,640
That could be maybe we're going to pay for college for you.
716
00:50:07,640 --> 00:50:09,440
Maybe we do our own thing.
717
00:50:09,440 --> 00:50:11,300
So there's a million ways to get there.
718
00:50:11,300 --> 00:50:14,480
You don't have to have degrees and certs.
719
00:50:14,480 --> 00:50:16,240
It helps.
720
00:50:16,240 --> 00:50:22,140
But you know, just getting folks to that stage and companies identifying that need.
721
00:50:22,140 --> 00:50:25,840
And if the school system isn't providing it to you, then you have to find it some other
722
00:50:25,840 --> 00:50:26,840
way.
723
00:50:26,840 --> 00:50:27,840
Yeah, no, it's a great point.
724
00:50:27,840 --> 00:50:34,800
I was just, you made me remember a conversation I was having two weeks ago with a retired
725
00:50:34,800 --> 00:50:46,240
admiral in the Navy who is helping this nonprofit organization with children on the spectrum
726
00:50:46,240 --> 00:50:53,920
of autism, you know, high functioning autism and getting them trained in cybersecurity
727
00:50:53,920 --> 00:51:03,400
because of their proclivity toward being able to analyze data at rapid paces, you know,
728
00:51:03,400 --> 00:51:10,420
repetitive functions and focus and, and, and getting them to have a career path as a sock
729
00:51:10,420 --> 00:51:18,040
analyst or being able to train them in these cybersecurity areas so that they can have
730
00:51:18,040 --> 00:51:22,880
a career and be able to continue to prove themselves.
731
00:51:22,880 --> 00:51:29,540
And we were talking about this and I thought, here's one way where we can introduce more
732
00:51:29,540 --> 00:51:34,560
individuals into this industry that seems to be lacking resources overall.
733
00:51:34,560 --> 00:51:37,560
I appreciate the comments that you just made.
734
00:51:37,560 --> 00:51:39,600
Max, thank you very much.
735
00:51:39,600 --> 00:51:42,600
I think we've come to the end of our time.
736
00:51:42,600 --> 00:51:46,020
And I appreciate all the comments and the conversation here.
737
00:51:46,020 --> 00:51:47,660
That's all for this episode.
738
00:51:47,660 --> 00:51:52,200
Make sure you tune in next time, the Logically Speaking, and stay cyber first and future
739
00:51:52,200 --> 00:51:52,440
ready.