00:00:00Director of Threat Intelligence Interview
00:09:47Evolution of Cyber Threats
00:13:55Protecting Critical Infrastructure and Cyber Threats
00:20:06Global Cyber Gangs and Election Interference
ABOUT THIS EPISODE
Discover the fascinating world of cybersecurity with our special guest, Glenn Maiden, Director of Threat Intelligence at FortiGuard Labs, ANZ. From his beginnings in the mid-90s with the Department of Defence to his pivotal roles at the Australian Signals Directorate and the Australian Tax Office, Glenn offers a wealth of knowledge and insights as he discusses the evolution from traditional information security to modern cyber intelligence. He also sheds light on how his team at FortiGuard Labs collaborates on a global scale to protect customers from emerging threats.
Today's digital landscape is riddled with complex cyber threats, and we unravel this intricate web with an engaging discussion on hyper-connectivity and its vulnerabilities. The conversation exposes the sophisticated tactics of cybercriminals, from nation-state actors to organised crime, and explores how anonymity and jurisdictional complexities provide them with strategic advantages. Yet, amidst this challenging terrain, there is optimism as advancements in cybersecurity measures are bolstering resilience, particularly in regions like Australia, where substantial investments are being made to combat emerging threats.
As we navigate the volatile global environment, the conversation shifts towards protecting critical infrastructure and the proactive measures being championed by government initiatives like Australia's SOCI Act. We consider the alarming prospect of cyber-attacks as a precursor to conflict and discuss strategies to mitigate such risks, including the integration of AI and the importance of multi-factor authentication and smart access controls. The episode rounds out with an exploration of the convergence of cyber threats and misinformation, highlighting the role of cyber gangs and nation-state activities in election interference and the increasing threat of cyber-enabled misinformation, especially among the younger, more connected generations. Tune in for a compelling discussion that offers valuable insights into the future of digital safety.
English
United States
SHOW NOTES 🔗
TRANSCRIPT 🔗
WEBVTT
00:00:00.479 --> 00:00:03.709
Today's discussion was so interesting we needed to record it over two parts.
00:00:03.709 --> 00:00:11.188
Today I have the pleasure in having an interview with Glenn Maiden, who is the Director of Threat Intelligence at FortiGuard Labs, ANZ.
00:00:11.188 --> 00:00:22.727
We're going to be talking about all things threat intelligence, all things around cyber security, what Fortinet's seeing, as well as talking about Glenn's personal journey around the space, which is quite a fascinating one.
00:00:22.727 --> 00:00:24.211
Glenn, welcome to the podcast.
00:00:24.211 --> 00:00:25.329
Thank you very much, michael.
00:00:25.329 --> 00:00:26.320
It's fantastic to be here.
00:00:26.320 --> 00:00:26.780
Yeah, great.
00:00:26.780 --> 00:00:37.100
Look, before we get started, just to set the scene, I've had a look at your career and I've had a chat in the past and you've got quite a good career across many defense areas and vendors.
00:00:37.100 --> 00:00:45.570
So, for people who are listening, do you mind just spending a couple of minutes about your history, your background and what led you to be the Director of Threat Intelligence at Forty Guard for ANZ?
00:00:45.570 --> 00:00:47.713
Yeah, I was very very lucky, Michael.
00:00:47.734 --> 00:01:06.745
So I started out in the mid-90s with the Department of Defence as a tech co basically, and that was sort of building networks, playing around with routers, testing equipment that would eventually end up on the Army's network In about the year 2000, I moved to what was then called the Defence Signals Directorate, which is our signals intelligence organisation.
00:01:06.745 --> 00:01:16.188
They're now called the Australian Signals Directorate and back then the information security component that was a branch within that directorate was called Q Branch and now that is known as the Australian Cyber Security Centre.
00:01:16.188 --> 00:01:21.194
So things have sort of grown very, very large since my time 20, 25 years ago.
00:01:21.194 --> 00:01:35.271
But I spent sort of about a decade there and then I went for promotion into the Defence Imagery and Geospatial Organisation and I had my coolest job title I've ever had in my life and it was called the Director of Geospatial Exploitation.
00:01:35.271 --> 00:01:41.683
So I spent about four years there and that was fantastic because I learnt all about running an intelligence production directorate.
00:01:41.683 --> 00:01:49.072
So it was everything from data collection, data processing, data exploitation, reporting and analysis.
00:01:49.072 --> 00:01:56.171
So it was end to end running an intelligence organisation with reports that ended all the way up to no less than the prime minister's desk.
00:01:56.171 --> 00:02:02.980
So very, very exciting and fantastic, but the geospatial intelligence was not where my true love lied.
00:02:03.021 --> 00:02:14.631
So I went then across to the Australian tax office for about four years and I was the IT security advisor for the ATO Right, and that was a great cultural shift because you know I was so used to that sort of national security environment.
00:02:14.631 --> 00:02:35.145
Yes, going across to the ATO where they've got highly protected systems, they've got protected mainframes and data warehouses and stuff like that, they've got some obviously one of the biggest databases of PII in the country, probably in the Southern Hemisphere, and then those need to connect out to people's home computers, so people running e-tax and tax agents processing.
00:02:35.145 --> 00:02:47.549
So it was very, very exciting and challenging to look at sort of the different ways where we have to protect information and move information from unclassified all the way up to the wholly protected and being able to maintain integrity across all those environments.
00:02:47.549 --> 00:02:49.652
And it was about 2015,.
00:02:49.652 --> 00:02:53.108
I left the government and since then I've been working in the vendor side.
00:02:53.127 --> 00:03:02.647
So I did a quick stint with Lockheed Martin when I first got out and I was responsible for building the security operations center for a defense project called centralized processing.
00:03:02.647 --> 00:03:07.205
So that was a billion dollar project at the time, one of the biggest projects in the world.
00:03:07.205 --> 00:03:21.905
And then I was responsible for recruiting all the members of the security operations centre, training them up, getting everyone comfortable with the tools, building the use cases and building all the people and process side of things Very, very challenging, obviously.
00:03:21.905 --> 00:03:29.792
And then from there, yeah, I've been working with cyber security vendors since then some of the leading vendors and now at Fortinet for five years as of about now.
00:03:30.072 --> 00:03:30.554
Wow, wow.
00:03:30.554 --> 00:03:38.725
It's certainly an interesting journey, you know, when you think about where you started defense and then into information security, before people called it cyber right, yes.
00:03:39.562 --> 00:03:52.484
It was information security, security and really that customer-facing learning and understanding the challenges on that side, being able to really lead to really being one of the lead vendors around cyber and threat intelligence, et cetera, et cetera.
00:03:52.484 --> 00:04:05.168
So, under your new role that you're at today, under 40 Guard Labs for ANZ, what are your primary responsibilities for those who don't understand what 40 Guard Labs is, and maybe you can run through a bit of that and what are the critical goals of your team?
00:04:05.609 --> 00:04:07.520
Yeah, sure, michael, I'll take you on a quick segue.
00:04:07.540 --> 00:04:13.125
You'll probably find that I'll do that a little bit I like to meander a little bit, but cyber is an interesting term.
00:04:13.125 --> 00:04:19.071
So, as you say, guys like us that have been around for a long time there was a bit of controversy when they started calling information security cyber.
00:04:19.071 --> 00:04:27.394
But I've been thinking about this the last couple of weeks with that Israeli Mazar attack on Hezbollah where they blew up pages, which is definitely not an IT system.
00:04:27.394 --> 00:04:32.437
Cyber is normally meant to encompass computers and networks, so that was sort of the definition of cyber.
00:04:32.437 --> 00:04:52.483
But now I think that the definition is probably not quite right when you think that, while that was not a traditional cyber attack as you'd probably define it, because obviously without attacking over radio networks and attacking on non-digital systems, it was still a cyber-enabled attack, which I know we'll talk about later on in this podcast.
00:04:52.504 --> 00:04:55.350
So yeah, I think, as we become more and more converged.
00:04:55.350 --> 00:05:00.052
I think that some of these terms are probably almost worn out in the brave new world.
00:05:00.380 --> 00:05:00.682
They are.
00:05:00.682 --> 00:05:01.083
They are.
00:05:01.083 --> 00:05:09.365
So for those again who are thinking about threat intelligence, because that's really a source of understanding what's going on globally, where most attacks are coming from.
00:05:09.365 --> 00:05:27.747
So you and your team are really ingesting a lot of that threat intelligence from a global point of view, working with lots of customers, working with lots of other vendors to kind of collaborate on that data to really give your customers downstream effectively the best intelligence to protect themselves, give your customers downstream effectively the best intelligence to protect themselves.
00:05:27.747 --> 00:05:29.269
And your team then spends time curating that data, looking at data.
00:05:29.269 --> 00:05:31.343
Maybe you can touch on what the team really does.
00:05:31.624 --> 00:05:32.346
Yeah, yeah, thanks.
00:05:32.346 --> 00:05:33.870
Thanks, michael, I'll get back to your question.
00:05:33.870 --> 00:05:38.137
So FortiGuard Labs is basically the nerve center for all the Fortinet products.
00:05:38.137 --> 00:05:40.744
So most people know us for the FortiGate, the firewall.
00:05:40.744 --> 00:05:50.911
It's an industry leader and in fact out of every firewall sold globally, one out of two is going to be a FortiGate and then the other two is everybody else.
00:05:50.911 --> 00:05:55.649
So we are absolutely in every corner, in every industry vertical in the planet.
00:05:55.649 --> 00:06:00.209
So obviously we need to keep those firewalls update as the threats change.
00:06:00.209 --> 00:06:04.721
So all the telemetry comes back to me in FortiGuard Labs and my team.
00:06:04.721 --> 00:06:08.644
That's where we go through and we'll exploit it, we'll rack and stack it.
00:06:08.644 --> 00:06:16.814
We've got several hundred humans that do about three quarters of a million hours every year of human research, and I know we'll talk about AI.
00:06:16.913 --> 00:06:18.795
It would be remiss of us not to, we have to.
00:06:19.759 --> 00:06:20.240
We have to, yes, but yeah.
00:06:20.240 --> 00:06:23.605
So we've been training our AI systems and ML systems since before.
00:06:23.605 --> 00:06:24.567
It was actually cool.
00:06:24.567 --> 00:06:29.894
So we've got multi-billion node AI systems that have been trained for over 10 years.
00:06:29.894 --> 00:06:35.932
And if you think that, telemetry, so all that metadata coming back from those firewalls saying, well, what's good, what's not, do we even know?
00:06:35.932 --> 00:06:41.192
We've been training on petabytes and petabytes of data for all that time.
00:06:41.192 --> 00:06:45.942
For all that time.
00:06:45.961 --> 00:06:51.305
So now our system is quite mature and able to go with with incredible accuracy, be able to understand if a behavior or a signature is malicious or not.
00:06:51.305 --> 00:07:05.350
So, where we're a bit different than other threat intelligence organizations, we all read the data the Verizim data breach report and reports like that, which are fantastic, but a lot of the threat intelligence that we get is based on post incident reporting and where people rack and stack it together.
00:07:05.350 --> 00:07:10.012
So we're able to be a little bit before the breach in near real time.
00:07:10.012 --> 00:07:24.531
So we go through a process what we see at that network and operating system layer and instead of just putting it directly into a report for someone to read at a later date, we push that back into the Fortinet fabric and also to partners like yourself at Oro.
00:07:24.531 --> 00:07:31.220
So, assuming you're not patient zero in almost near real time, you're actually protected from these threats as they evolve.
00:07:31.220 --> 00:07:32.766
So it is very, very different.
00:07:32.766 --> 00:07:40.574
But to get to your point about collaboration, obviously we'll ingest information from all of our systems, processes, devices across the network.
00:07:41.201 --> 00:07:42.245
But we're big on partnering.
00:07:42.245 --> 00:07:49.273
So we've got teams that go through and they sit in dark web forums and telegram channels, so all that goes in to get an understanding of the bad guys.
00:07:49.273 --> 00:07:49.713
Wow.
00:07:49.713 --> 00:07:50.661
But we also partner.
00:07:50.661 --> 00:07:54.980
So we've been working closely with Interpol for about sort of seven, eight years.
00:07:55.463 --> 00:08:06.555
We've been working closely with NATO for a long time In fact, my boss is going to the NATO conference very, very, very soon and the World Economic Forum, and this has actually been one that I've been directly involved in myself.
00:08:06.555 --> 00:08:15.685
So we've got a project program that we've been working with as a founding partner of the World Economic Forum Center for Cybersecurity, trying to map out the cyber criminal ecosystem.
00:08:15.685 --> 00:08:46.886
So yeah, where that's interesting is, you know we normally talk about IOCs, which is a bad IP or a bad DNS address, but what we're trying to do is find out who are the humans and the systems that they use and the accounts that they hold that sit behind these bad guys, the contis and the trick bots and the dark sides and the revils, so trying to actually understand the real people behind the cyber criminal ecosystem and the dark net that we hear so much about and that's a really interesting couple of points.
00:08:46.927 --> 00:08:52.948
then tying back to your point around the pager and two-way radio attack, and I guess let's circle back to that.
00:08:52.948 --> 00:09:05.565
So thanks for covering off what the labs teams does and people don't probably see that right, it's a huge team working behind the scenes to make sure customers are protected, sharing threat intelligence to effectively protect the world in some way, right.
00:09:05.565 --> 00:09:20.692
But then if I think about your point around this recent physical attack which could be considered, you know it is a technology attack ultimately, and the time you've spent doing the space, you know landscape has changed and continues to change all the time.
00:09:20.692 --> 00:09:29.149
What are some of the most significant changes then you've seen from a cyber threat point of view over the years and kind of how they're impacting businesses and countries?
00:09:29.149 --> 00:09:30.491
Today You're talking about World Economic Forum.
00:09:30.491 --> 00:09:32.027
That would never been a topic before, right?
00:09:32.027 --> 00:09:34.989
I mean, the cyber is so important today, fundamentally.
00:09:35.740 --> 00:09:38.128
Well, I think I mean you've probably cracked it right there.
00:09:38.128 --> 00:09:42.046
I mean in terms of the bad guys, I mean the volume's still there.
00:09:42.046 --> 00:09:55.174
But I guess the key point that I think that really is pertinent to the answer there is everything now is connected together.
00:09:55.174 --> 00:10:00.727
So again, we'll talk about OT and connecting OT to IP-based networks.
00:10:00.727 --> 00:10:14.605
But everything that we use, everything that we do, is connected to one big borg of a system, and in the old days, again, we'll talk about elections later on big borg of a system and in the old days, again we'll talk about elections later on.
00:10:14.625 --> 00:10:20.380
So you imagine, if I wanted to interfere with an election in the old days, I might go and bomb an election booth or I might steal a big bag of paper ballots.
00:10:20.380 --> 00:10:22.985
Now I might want to hack into an election.
00:10:22.985 --> 00:10:33.745
So everything from getting a script to ordering a car or even turning on your tap in the morning, everything is cyber enabled.
00:10:33.745 --> 00:10:43.878
So you know the bad guys in the early days, where they were just trying to breach our systems and you know, essentially, steal data.
00:10:43.878 --> 00:10:49.163
They realised a few years ago that well, availability is something that we can attack as well and that's something that's really, really going to make customers scream and pay us some money.
00:10:49.243 --> 00:10:52.996
So I think, from my perspective, the bad guys have always been the same.
00:10:52.996 --> 00:10:57.836
They're going to be a nation state that's hostile to us the Iran's, the North Korea's.
00:10:57.836 --> 00:11:03.198
It's going to be an issue-motivated group, and you think of the famous anonymous guys there.
00:11:03.198 --> 00:11:29.500
It might be an insider threat and that insider might be doing it for financial reasons or other reasons, or they might just screw up, yes, but most of it is going to be these serious organised crime groups that have probably migrated and evolved since the old days of the Italian mafia and now they're all going all the way across to Nigeria and these big scam farms that are now popping up on the border of Cambodia and Thailand, sort of up in that part of the world.
00:11:29.500 --> 00:11:34.341
This is just such a lucrative industry for the bad guys and unfortunately we're riding that crosshairs?
00:11:34.534 --> 00:11:35.077
Yeah, unfortunately.
00:11:35.077 --> 00:11:35.801
Yeah, because there's.
00:11:35.801 --> 00:11:38.615
You know, many of the Western countries, australia etc.
00:11:38.615 --> 00:11:42.120
Have got you know a fair bit of wealth realistically, so that's a soft target.
00:11:42.120 --> 00:11:52.826
I had a chat to one of the partners at Grand Nickel and we were talking about the same topic and he was made the the comment around um, be hard being a drug dealer today.
00:11:52.826 --> 00:11:56.389
Right, because you know, you know there's a whole process there and people involved, etc.
00:11:56.389 --> 00:11:59.032
Where now you can sit, as you just said, any, any in any border.
00:11:59.032 --> 00:12:04.196
As long as you're connected to this connectivity, you can really get away with a lot more and be really anonymous.
00:12:04.196 --> 00:12:04.837
Right, it's, it's.
00:12:04.918 --> 00:12:18.924
It's fascinating from from a business point of view, even how that, how they're doing that well, it's so advantageous because I can go through and route my attack through sort of a whole bunch of jurisdictions and then I can be sort of sitting in North Korea, or I can be sitting in Moscow, or I can be sitting in Beijing.
00:12:18.924 --> 00:12:22.500
I can attack you and me here sitting in Brisbane today.
00:12:22.500 --> 00:12:26.676
You can imagine just how hard that would be to track us back.
00:12:26.676 --> 00:12:34.110
So you know the likelihood of the police being able to get us in somewhere where there isn't an ability to come and move us back to Australia to be charged.
00:12:34.417 --> 00:12:43.702
It's absolutely beautiful, yeah, and do you think, with this continuous hyper connectivity, that that is just going to continue to be harder, or do you think we're getting better at mitigating?
00:12:43.702 --> 00:12:55.101
Of course there's things like labs that are helping mitigate known problems, but do you think this cat and mouse game is always going to be a system that we close in that gap, or is it widening from what you see and your counterparts you speak to?
00:12:55.863 --> 00:13:13.096
I think we're definitely getting better and I know with working with groups like Oro, so I think we've got some really really good technical solutions now to defend our networks we mentioned before.
00:13:13.096 --> 00:13:13.479
It's so ubiquitous.
00:13:13.479 --> 00:13:20.769
I mean three, four, five years ago, if you talk to a board member, cyber would have probably been the last on their list of problems, but now if they have a significant breach they can actually be charged and maybe go to jail or lose their house now.
00:13:20.769 --> 00:13:23.778
So that's certainly something that's really, really important to them.
00:13:23.778 --> 00:13:30.302
So they're quite happy to invest and take cybersecurity as one of the key business risks to their business.
00:13:30.302 --> 00:13:37.826
Being able to go through and do some really robust defence, especially proactive defence, before you have that big problem.
00:13:37.826 --> 00:13:38.957
I think we're getting.
00:13:38.957 --> 00:13:45.946
I mean, probably the statistics don't always paint that as a good picture, but certainly we're getting more resilient than what we were a few years ago.
00:13:45.946 --> 00:13:54.605
There's absolutely that's obviously a sweeping statement and there's gaps and there's some industries that are more mature than others, but certainly in Australia we're better than what we were.
00:13:54.605 --> 00:13:54.907
I think.
00:13:55.147 --> 00:14:00.647
Yeah, and do you feel as well that our government is really starting to push a few more things?
00:14:00.647 --> 00:14:06.947
In the US they talked about having to have a kind of cyber person size on the board.
00:14:06.947 --> 00:14:10.706
Today it's kind of mandated at a certain company level from what I read and understand.
00:14:10.706 --> 00:14:17.500
But you know, I know Australia's obviously adopted the SOCI Act for critical infrastructure.
00:14:17.500 --> 00:14:20.726
Do you think our government's doing enough now to really start pushing forward that we help close that gap?
00:14:21.414 --> 00:14:23.744
I think the government is doing some really, really good work.
00:14:23.744 --> 00:14:25.760
So, if you think obviously you mentioned SOCI.
00:14:25.760 --> 00:14:27.686
There's been updates to the Privacy Act.
00:14:27.686 --> 00:14:35.561
We've got the Cyber Strategy, where Home Affairs wants us to be the most cyber secure nation in the world by 2030.
00:14:35.561 --> 00:14:36.624
Really really good stuff there.
00:14:36.663 --> 00:14:42.544
The Privacy Act, the fines gone up to about $20 million I think it was $2 million or maybe it's $50 million now.
00:14:42.544 --> 00:14:46.384
Either way, significantly higher than what it was before.
00:14:46.384 --> 00:14:52.109
If you don't do due diligence around protecting personally identifiable information, pii.
00:14:52.109 --> 00:14:55.418
So, yes, certainly the dials have been screwed up there.
00:14:55.940 --> 00:15:23.855
I think that my biggest concern in terms of gaps is that, as the world is now becoming a very, very unstable and probably the most dangerous world that we've seen in decades, probably since World War II when there is the first sign of conflict, the first weapon to be fired will be a cyber weapon, and I think we need to have a much greater sense of urgency in protecting our critical infrastructure.
00:15:24.076 --> 00:15:32.903
As I said before, it's easy for us to expect to go out and turn on the tap in the morning and get fresh water and get in our car and drive to work.
00:15:32.903 --> 00:15:50.826
So if I was a bad guy and there was some conflict, it would be very easy for me to target a water processing plant or a water pump or disable the country's fuel supplies and, from a knock-on effect, obviously it would not take very, very long to cause significant disruptions for our economy.
00:15:50.826 --> 00:16:00.850
So I think we really need to take much more of a sense of urgency in looking at that macro level threat and just how some of these threats could be realised by a hostile nation.
00:16:00.850 --> 00:16:12.043
Again, instead of having to come and send a rocket across the north of the country and hit Darwin or whatever, why not launch an attack from sitting back in the northern hemisphere?
00:16:12.043 --> 00:16:14.827
It's going to be just as effective, just as devastating.
00:16:14.827 --> 00:16:15.570
Yeah, true, true.
00:16:21.475 --> 00:16:29.000
And actually probably more widespread, because a piece of arsenal will damage an area as opposed to a much more widespread issue, right, yeah, yeah, and hopefully we've got enough resilience and enough segmentation in some of our systems where it won't be widespread.
00:16:29.000 --> 00:16:33.258
But we have seen sort of some what were relatively simple attacks.
00:16:33.258 --> 00:16:38.457
You know the colonial pipeline that we saw over in the US caused reasonably significant damage.
00:16:39.321 --> 00:16:51.745
We had a recent issue where the ports or one of the shipping systems went down here in Australia, so we had boats floating across our coast unable to dock and unload their containers for a day or two, so it doesn't take very long.
00:16:52.075 --> 00:17:00.807
Knowing that you're spending so much time with your team looking at threat analysis, what are kind of the cyber threats facing organizations in 2025?
00:17:00.807 --> 00:17:08.326
And what should be the priorities or what should teams think about prioritizing for those, if you can give us any insights?
00:17:08.326 --> 00:17:12.061
I know things can change overnight, but what are you seeing today from your lens?
00:17:12.542 --> 00:17:17.377
So from my perspective, I mean I can talk about the increasing sophistication of threats.
00:17:17.377 --> 00:17:22.999
So we've got now AI, we've got some very, very smart actors that are looking for bugs in hardware.
00:17:22.999 --> 00:17:24.844
They're looking for breaks in systems.
00:17:24.844 --> 00:17:28.738
So there's always going to be that, there's always going to be a vulnerability somewhere.
00:17:28.738 --> 00:17:33.845
But I like to look at it from the other side, and this is from your side in Auro.
00:17:33.845 --> 00:17:35.106
This is the defender side.
00:17:35.166 --> 00:17:47.641
So if I'm trying to defend a system, how can I make the impact of any one breach get as close to minimal or zero as possible, and that is something that we can do.
00:17:47.641 --> 00:18:00.131
So, whether that's using multi-factor authentication, so if someone does manage to exploit one of your attack surface or one of your perimeter devices, if someone does manage to get access to that, how can we segment that off?
00:18:00.131 --> 00:18:07.859
Or how can we make sure that all those user accounts that they will then pop out of that box, how can we make sure that they're useless or harder to exploit?
00:18:07.859 --> 00:18:09.482
To get further into the system?
00:18:09.482 --> 00:18:11.246
Smart role-based access to exploit, to get further into the system.
00:18:11.246 --> 00:18:19.416
Smart role-based access, and not just for people but for machines as well.
00:18:19.718 --> 00:18:36.765
That helps really, really good security operations, like I know you do at Oro making sure that we know what our assets are, how they could be exploited, getting logs and telemetry off those devices, centralising them, normalizing them and then getting those into use cases that will then sit in front of a really really smart analyst's screen.
00:18:37.227 --> 00:18:58.538
So when something that isn't normal comes up, we've minimized what we call false positives, so it's not just something that's going to waste someone's time a red alert but we know with a reasonable amount of confidence that that alert that's just popped up on my screen is something that I've got to take a look at and from there I can go through and isolate and clean up and then bring back into service as quick as possible.
00:18:58.538 --> 00:19:16.096
And if you think about it in that way from a defender's perspective, it doesn't matter if I shouldn't say it doesn't matter, it matters less that a bad guy has got a zero day that they're using against you, because you know they're only going to get to a certain amount of, they're only going to get a certain, a certain distance before we find them and we stop them?
00:19:16.337 --> 00:19:32.105
yes, correct, you talked about the kind of nation states, uh, things that are happening and, from a global perspective, as we sit here today catching in brisbane, we're just coming off the back of the the us elections, you know, and they're obviously the results are a little bit in the spotlight, you know.
00:19:32.105 --> 00:19:48.558
You could argue which way it went, but it's happened and there was a lot of discussion leading up to it and post the last election in the US, plus other elections globally, that for people who followed along with the, you know, disinformation, misinformation it always kind of dominates the conversation.
00:19:48.558 --> 00:20:04.211
Now that we've so cyber connected and influencing and all these sorts of things, can you talk a little bit about some of the cyber enabled threats that relate to these issues and how they may detract from what should be a normal process and how the world's changed just in elections alone?
00:20:04.654 --> 00:20:06.760
Yeah, so this is a fascinating one, michael.
00:20:06.760 --> 00:20:17.837
So, if we think about that convergence of threat, and just before we get into the misinformation, I'm always fascinated about some of these global cyber gangs.
00:20:17.837 --> 00:20:33.843
So how do you go from a gang that's operating out of Nigeria or over in Eastern Europe all the way to attacking my mum that's sitting on her iPhone up at Burley Heads here as part of a scam?
00:20:33.843 --> 00:20:36.468
So it's well enough to have the infrastructure sitting behind it.
00:20:36.468 --> 00:20:45.584
It's well enough to maybe have an exploit, and maybe I want to just do some crypto mining off her phone, or maybe I do want to scam her out of her life savings.
00:20:45.584 --> 00:20:51.057
There has to be somewhere that all that infrastructure converts into a localised attack.
00:20:51.057 --> 00:20:56.642
So mum knows that she gets a message saying oh, this is Australia Post or this is the Australian Tax Office.
00:20:56.642 --> 00:21:03.846
So how do these bad guys on the other side of the world craft a social engineering attack that is so realistic that it can get past my mum?
00:21:03.846 --> 00:21:07.740
So I think that there's this convergence and this is where we get into the election.
00:21:07.740 --> 00:21:10.483
I think that there's this convergence and this is where we get into the election.
00:21:10.523 --> 00:21:16.798
The same bad guys and nation state guys are using the same malicious ecosystem that the criminals are using and more and more we see.
00:21:16.798 --> 00:21:31.218
Sometimes they'll call them mercenaries, but we're seeing that convergence of nation state actors and cyber criminals using the same infrastructure, in some cases working together, in some cases for trying to influence an election, or people, in some cases trying to steal money.
00:21:31.218 --> 00:21:35.708
So just to get a few terms out there, they call it MDM now.
00:21:35.708 --> 00:21:42.201
So there's a new term that they're starting to come out with, which is called misinformation, disinformation and malinformation.
00:21:42.201 --> 00:21:47.759
Now, misinformation is basically where I would say something and I just get it wrong.
00:21:47.759 --> 00:21:50.946
So I might say I'm doing a podcast with Michael in Sydney today.
00:21:50.946 --> 00:22:00.342
It was an honest mistake, but anyway, someone gets hold of that and they said oh, glenn's in Sydney today, why did he not turn up to this meeting in Sydney when I'm actually up in Queensland?
00:22:00.342 --> 00:22:01.465
So that's misinformation.
00:22:01.465 --> 00:22:07.338
Disinformation is where someone's a little bit more deliberate in what they're doing.
00:22:07.338 --> 00:22:19.403
So if you imagine I was a bad guy, I might get a FortiGate and I might say, oh, fortinet says that it can do five terabits worth of throughput when this is actually only two terabits.
00:22:19.403 --> 00:22:23.682
So I just make something completely up, send that out, and then I could use that against me.
00:22:23.682 --> 00:22:28.539
So there's sort of those two different ways that we can use to influence Malinflammation.
00:22:28.559 --> 00:22:36.684
Isinformation is a bit of a controversial term, but that's where you use, I guess, legitimate information with malicious context.
00:22:36.684 --> 00:22:39.684
So if you think, probably revenge porn is a good example of that.
00:22:39.684 --> 00:22:52.846
So a photo is taken in the privacy of someone's home that then gets leaked to people that weren't originally accessed or authorized to have that information and that's used against the victim Malinformation the reason why that's sort of a bit controversial.
00:22:52.846 --> 00:22:54.176
It could actually be something that's true.
00:22:54.176 --> 00:23:03.998
So if you think of our good friend Donald Trump and Stormy Daniels, that may or may not be true, but if it was true that would be really really juicy to use against him if I was one of his enemies.
00:23:03.998 --> 00:23:11.049
So, basically, forever hostile nations have wanted to go through and interfere with democracy.
00:23:11.130 --> 00:23:17.696
So, back in the day, it might be Russia funding some Marxist groups at a university or something like that.
00:23:17.696 --> 00:23:27.141
There might be some other political parties that they'll funnel some money into to try and influence, but now in these cyber-enabled days, it opens up a whole world of possibilities for these guys.
00:23:27.141 --> 00:23:38.592
So if you go back to sort of 2016, the Russians had about 500 Russians activated and trying to disrupt the American elections and American society.
00:23:38.592 --> 00:23:41.605
And if you think of those 500, that would have actually been quite rare back then.
00:23:41.605 --> 00:23:45.066
So you need Russian people that speak really, really good English.
00:23:45.066 --> 00:23:46.601
They understand and they're speaking with American accents.
00:23:46.601 --> 00:23:47.365
They understand the subcultures.
00:23:47.365 --> 00:23:48.991
They understand sort and they're speaking with American accents.
00:23:48.991 --> 00:23:50.819
They understand the subcultures.
00:23:50.819 --> 00:23:52.990
They understand sort of some of the societal norms.
00:23:52.990 --> 00:23:54.455
They understand the political system.
00:23:54.455 --> 00:23:55.960
They know how elections work.
00:23:56.480 --> 00:24:06.028
So apparently these guys going back to that election back then, they pumped out about 80,000 posts and pieces of propaganda just to influence us.
00:24:06.028 --> 00:24:07.069
So that was 500.
00:24:07.069 --> 00:24:09.182
And obviously that was the scale they could get.
00:24:09.182 --> 00:24:19.330
But if you think now in the age of AI, you could probably have just a handful of people that could do much, much more than that by generating some of these malicious posts.
00:24:19.330 --> 00:24:21.939
And just you mentioned the election that we just saw yesterday.
00:24:21.939 --> 00:24:44.746
Going back on the 4th of September, there was a group called Tenant Media that was charged over in the US and they were a right-wing group, but they were taking money from Russia to go out and spread misinformation to all their fans, all the people that they were influencing, and they were saying, oh, go in and intimidate voters, go in and steal votes, go in and destroy ballot collection areas.
00:24:44.746 --> 00:24:55.349
So this is a real threat and it's happening every day and luckily I can't think off the top of my head any really catastrophic things that have happened down here in Australia, but it's only a matter of time.
00:24:55.710 --> 00:25:00.165
It is true, and I think you do touch on a very good point there if I think about influencing media.
00:25:00.165 --> 00:25:07.929
So if we go right back, you know a newspaper, then television, you know this kind of thing's been happening for a while where people want to kind of make things come to fruition.
00:25:07.929 --> 00:25:16.002
The challenge we've got now is again we're so cyber enabled or so connected.
00:25:16.002 --> 00:25:20.222
I should say no doubt that social media has played such a big role in that because everyone's connected on that and I think about the new generation coming through.
00:25:20.222 --> 00:25:27.707
So you have baby boomers, all that were probably still paper based reading, all that, and they were influenced in some way, but probably not as catastrophic.
00:25:27.707 --> 00:25:38.540
If we go all the way down to the people who can vote now, where they're just hyper-connected and everything's on a screen, probably the ability to influence the outcome is completely different, right, if you think about how wide that gap is.
00:25:39.102 --> 00:25:39.683
Yeah, it's funny.
00:25:39.683 --> 00:25:50.411
I sometimes think, and they talk about these digital natives, and I've got three kids a 17-year-old daughter, a 15-year-old son and a 12-year-old daughter a 15-year-old son and a 12-year-old daughter.
00:25:50.490 --> 00:25:51.532
They're all digital natives.
00:25:51.532 --> 00:25:56.077
And my son is an absolute.
00:25:56.077 --> 00:25:56.881
He loves technology.
00:25:56.881 --> 00:25:57.723
He's built his own PC from parts.
00:25:57.723 --> 00:25:58.185
He programs in Python.
00:25:58.185 --> 00:25:59.130
Technology is just his absolute passion.
00:25:59.150 --> 00:26:01.355
But I think I don't know when we talk about digital natives.
00:26:01.355 --> 00:26:04.801
Going back to our day, we built systems from the ground up.
00:26:04.801 --> 00:26:18.300
We'd build a rack and then we'd put a router in it and we'd put a switch in it and we'd put a firewall in it and then we'd put a server in it and we'd plug it all in and load the applications on the top of that infrastructure and then push that out.
00:26:18.300 --> 00:26:29.121
We'd know what IP address it had, we knew exactly where that server was and what was running and what it was doing and if something happened you'd walk into the server room and turn it off, yeah, yeah.
00:26:29.602 --> 00:26:42.203
So I just wonder, especially with sort of some of these digital natives these days, whether they've become a little bit a part of the attack service, because they're so good at using these applications and exploiting these applications, but not necessarily knowing how they work.
00:26:42.203 --> 00:26:51.518
And then, if you think, in most cases or many cases these days, these applications are powered by service from the cloud.
00:26:51.518 --> 00:26:53.142
Do we actually even know where our data is or where it's getting processed.
00:26:53.142 --> 00:26:58.000
So I think it's very, very different in 2025 than what it was even probably pre-COVID.
00:26:58.221 --> 00:26:58.602
Yeah, yeah.
00:26:58.602 --> 00:27:15.701
And if I think about again those attacks, the influencing election and state-based activities to influence a country, and election's always the peak period you also touched on earlier around campaigns you know christmas is coming then they're very crafty about how they do their, their threats etc.
00:27:15.701 --> 00:27:28.265
But if I think about elections particularly and we've heard over the last three or four elections globally that they've been influenced and there's been some proof in it and maybe not some proof in it you know there's a bit of a debate, but do you think this has affected the public's trust in in the editorial and the electoral process?
00:27:28.265 --> 00:27:33.183
But do you think this has affected the public's trust in the electoral process or do you think it's kind of they just get on with it?
00:27:33.183 --> 00:27:33.826
What's your view on that?
00:27:34.055 --> 00:27:35.819
I think, michael, that's 100%.
00:27:35.819 --> 00:27:41.520
The public's trust has been affected and in some ways, that is actually the intent of some of these disruptions.
00:27:41.520 --> 00:27:46.616
So I don't necessarily need to have my candidate win.
00:27:46.616 --> 00:27:56.038
But what happens if like we saw sort of last time what happens if I can erode the public's trust so much in elections that I can use that then against my enemy country?
00:27:56.038 --> 00:28:06.607
And I just read a report recently about our handling of COVID and you could argue with how good a job we did versus how bad and a few mistakes with 2020 hindsight.
00:28:06.607 --> 00:28:16.436
But the frightening part of that particular report was there was an erosion, a significant erosion of public trust in authorities, people like the health system.
00:28:16.436 --> 00:28:23.097
So when the next pandemic comes along, maybe people won't be quite as compliant in some of these.
00:28:23.097 --> 00:28:27.236
So it becomes very, very, very, very different situation and quite dangerous very, very quickly.
00:28:27.416 --> 00:28:44.875
Do you think there's some strategies that governments, organisations or individuals can use to protect themselves against the spread of misinformation, and maybe ways to really validate and identify credible sources, considering we're talking a lot about AI, you know, deep fakes, all these sorts of things or it's just going to get harder and harder, I think?
00:28:44.916 --> 00:28:52.248
it is going to get harder and harder, I think, especially with the rise of AI and deep f facts, it's going to be very, very hard to work out what's real and what's not.
00:28:52.248 --> 00:28:55.426
And you know, I don't know if I can answer you, michael, where this goes.
00:28:55.426 --> 00:29:06.003
I mean, you know, if it was a cyber attack, you know a buffer overflow or some sort of exploit against a service, I'd say, well, we need to put a firewall in front of it and block that port or monitor that port or something.
00:29:06.003 --> 00:29:08.746
But when it comes to influencing humans, I don't know.
00:29:08.746 --> 00:29:12.269
Maybe we get an AI, some sort of an AI system to defend against it.
00:29:12.269 --> 00:29:13.971
But it's definitely a risk.
00:29:14.875 --> 00:29:35.446
And even if you look at where the attackers are going, so it's so, so common now for attackers to not even use necessarily use malware, but certainly more and more they're using credentials that they've either stolen or dumped from the victim or they've just bought from an initial access broker and you guys at Oro in the SOC.
00:29:35.446 --> 00:29:39.444
It's one thing to see to notice someone doing a port scan inside a network.
00:29:39.444 --> 00:29:40.126
That's unusual.
00:29:40.126 --> 00:29:41.679
That's something really, really unusual.
00:29:41.679 --> 00:29:42.862
I've got to go and investigate that.
00:29:42.862 --> 00:29:47.006
But it's another thing to see Michael move from server A to server B.
00:29:47.006 --> 00:29:52.340
Well, that might actually be you just going through and accessing a file share, but it could be someone using your account.
00:29:52.340 --> 00:29:55.965
That's a lot harder, as the SOC analyst, to know.
00:29:55.965 --> 00:29:57.781
Well, is this legitimate or is this anomalous?
00:29:58.615 --> 00:30:05.344
I hope you enjoyed part one of my discussion with Glenn Maiden, Director of Threat Intelligence at FortiGuard Labs ANZ.
00:30:05.344 --> 00:30:07.260
Tune in next week for part two.
00:00:00.479 --> 00:00:03.709
Today's discussion was so interesting we needed to record it over two parts.
00:00:03.709 --> 00:00:11.188
Today I have the pleasure in having an interview with Glenn Maiden, who is the Director of Threat Intelligence at FortiGuard Labs, ANZ.
00:00:11.188 --> 00:00:22.727
We're going to be talking about all things threat intelligence, all things around cyber security, what Fortinet's seeing, as well as talking about Glenn's personal journey around the space, which is quite a fascinating one.
00:00:22.727 --> 00:00:24.211
Glenn, welcome to the podcast.
00:00:24.211 --> 00:00:25.329
Thank you very much, michael.
00:00:25.329 --> 00:00:26.320
It's fantastic to be here.
00:00:26.320 --> 00:00:26.780
Yeah, great.
00:00:26.780 --> 00:00:37.100
Look, before we get started, just to set the scene, I've had a look at your career and I've had a chat in the past and you've got quite a good career across many defense areas and vendors.
00:00:37.100 --> 00:00:45.570
So, for people who are listening, do you mind just spending a couple of minutes about your history, your background and what led you to be the Director of Threat Intelligence at Forty Guard for ANZ?
00:00:45.570 --> 00:00:47.713
Yeah, I was very very lucky, Michael.
00:00:47.734 --> 00:01:06.745
So I started out in the mid-90s with the Department of Defence as a tech co basically, and that was sort of building networks, playing around with routers, testing equipment that would eventually end up on the Army's network In about the year 2000, I moved to what was then called the Defence Signals Directorate, which is our signals intelligence organisation.
00:01:06.745 --> 00:01:16.188
They're now called the Australian Signals Directorate and back then the information security component that was a branch within that directorate was called Q Branch and now that is known as the Australian Cyber Security Centre.
00:01:16.188 --> 00:01:21.194
So things have sort of grown very, very large since my time 20, 25 years ago.
00:01:21.194 --> 00:01:35.271
But I spent sort of about a decade there and then I went for promotion into the Defence Imagery and Geospatial Organisation and I had my coolest job title I've ever had in my life and it was called the Director of Geospatial Exploitation.
00:01:35.271 --> 00:01:41.683
So I spent about four years there and that was fantastic because I learnt all about running an intelligence production directorate.
00:01:41.683 --> 00:01:49.072
So it was everything from data collection, data processing, data exploitation, reporting and analysis.
00:01:49.072 --> 00:01:56.171
So it was end to end running an intelligence organisation with reports that ended all the way up to no less than the prime minister's desk.
00:01:56.171 --> 00:02:02.980
So very, very exciting and fantastic, but the geospatial intelligence was not where my true love lied.
00:02:03.021 --> 00:02:14.631
So I went then across to the Australian tax office for about four years and I was the IT security advisor for the ATO Right, and that was a great cultural shift because you know I was so used to that sort of national security environment.
00:02:14.631 --> 00:02:35.145
Yes, going across to the ATO where they've got highly protected systems, they've got protected mainframes and data warehouses and stuff like that, they've got some obviously one of the biggest databases of PII in the country, probably in the Southern Hemisphere, and then those need to connect out to people's home computers, so people running e-tax and tax agents processing.
00:02:35.145 --> 00:02:47.549
So it was very, very exciting and challenging to look at sort of the different ways where we have to protect information and move information from unclassified all the way up to the wholly protected and being able to maintain integrity across all those environments.
00:02:47.549 --> 00:02:49.652
And it was about 2015,.
00:02:49.652 --> 00:02:53.108
I left the government and since then I've been working in the vendor side.
00:02:53.127 --> 00:03:02.647
So I did a quick stint with Lockheed Martin when I first got out and I was responsible for building the security operations center for a defense project called centralized processing.
00:03:02.647 --> 00:03:07.205
So that was a billion dollar project at the time, one of the biggest projects in the world.
00:03:07.205 --> 00:03:21.905
And then I was responsible for recruiting all the members of the security operations centre, training them up, getting everyone comfortable with the tools, building the use cases and building all the people and process side of things Very, very challenging, obviously.
00:03:21.905 --> 00:03:29.792
And then from there, yeah, I've been working with cyber security vendors since then some of the leading vendors and now at Fortinet for five years as of about now.
00:03:30.072 --> 00:03:30.554
Wow, wow.
00:03:30.554 --> 00:03:38.725
It's certainly an interesting journey, you know, when you think about where you started defense and then into information security, before people called it cyber right, yes.
00:03:39.562 --> 00:03:52.484
It was information security, security and really that customer-facing learning and understanding the challenges on that side, being able to really lead to really being one of the lead vendors around cyber and threat intelligence, et cetera, et cetera.
00:03:52.484 --> 00:04:05.168
So, under your new role that you're at today, under 40 Guard Labs for ANZ, what are your primary responsibilities for those who don't understand what 40 Guard Labs is, and maybe you can run through a bit of that and what are the critical goals of your team?
00:04:05.609 --> 00:04:07.520
Yeah, sure, michael, I'll take you on a quick segue.
00:04:07.540 --> 00:04:13.125
You'll probably find that I'll do that a little bit I like to meander a little bit, but cyber is an interesting term.
00:04:13.125 --> 00:04:19.071
So, as you say, guys like us that have been around for a long time there was a bit of controversy when they started calling information security cyber.
00:04:19.071 --> 00:04:27.394
But I've been thinking about this the last couple of weeks with that Israeli Mazar attack on Hezbollah where they blew up pages, which is definitely not an IT system.
00:04:27.394 --> 00:04:32.437
Cyber is normally meant to encompass computers and networks, so that was sort of the definition of cyber.
00:04:32.437 --> 00:04:52.483
But now I think that the definition is probably not quite right when you think that, while that was not a traditional cyber attack as you'd probably define it, because obviously without attacking over radio networks and attacking on non-digital systems, it was still a cyber-enabled attack, which I know we'll talk about later on in this podcast.
00:04:52.504 --> 00:04:55.350
So yeah, I think, as we become more and more converged.
00:04:55.350 --> 00:05:00.052
I think that some of these terms are probably almost worn out in the brave new world.
00:05:00.380 --> 00:05:00.682
They are.
00:05:00.682 --> 00:05:01.083
They are.
00:05:01.083 --> 00:05:09.365
So for those again who are thinking about threat intelligence, because that's really a source of understanding what's going on globally, where most attacks are coming from.
00:05:09.365 --> 00:05:27.747
So you and your team are really ingesting a lot of that threat intelligence from a global point of view, working with lots of customers, working with lots of other vendors to kind of collaborate on that data to really give your customers downstream effectively the best intelligence to protect themselves, give your customers downstream effectively the best intelligence to protect themselves.
00:05:27.747 --> 00:05:29.269
And your team then spends time curating that data, looking at data.
00:05:29.269 --> 00:05:31.343
Maybe you can touch on what the team really does.
00:05:31.624 --> 00:05:32.346
Yeah, yeah, thanks.
00:05:32.346 --> 00:05:33.870
Thanks, michael, I'll get back to your question.
00:05:33.870 --> 00:05:38.137
So FortiGuard Labs is basically the nerve center for all the Fortinet products.
00:05:38.137 --> 00:05:40.744
So most people know us for the FortiGate, the firewall.
00:05:40.744 --> 00:05:50.911
It's an industry leader and in fact out of every firewall sold globally, one out of two is going to be a FortiGate and then the other two is everybody else.
00:05:50.911 --> 00:05:55.649
So we are absolutely in every corner, in every industry vertical in the planet.
00:05:55.649 --> 00:06:00.209
So obviously we need to keep those firewalls update as the threats change.
00:06:00.209 --> 00:06:04.721
So all the telemetry comes back to me in FortiGuard Labs and my team.
00:06:04.721 --> 00:06:08.644
That's where we go through and we'll exploit it, we'll rack and stack it.
00:06:08.644 --> 00:06:16.814
We've got several hundred humans that do about three quarters of a million hours every year of human research, and I know we'll talk about AI.
00:06:16.913 --> 00:06:18.795
It would be remiss of us not to, we have to.
00:06:19.759 --> 00:06:20.240
We have to, yes, but yeah.
00:06:20.240 --> 00:06:23.605
So we've been training our AI systems and ML systems since before.
00:06:23.605 --> 00:06:24.567
It was actually cool.
00:06:24.567 --> 00:06:29.894
So we've got multi-billion node AI systems that have been trained for over 10 years.
00:06:29.894 --> 00:06:35.932
And if you think that, telemetry, so all that metadata coming back from those firewalls saying, well, what's good, what's not, do we even know?
00:06:35.932 --> 00:06:41.192
We've been training on petabytes and petabytes of data for all that time.
00:06:41.192 --> 00:06:45.942
For all that time.
00:06:45.961 --> 00:06:51.305
So now our system is quite mature and able to go with with incredible accuracy, be able to understand if a behavior or a signature is malicious or not.
00:06:51.305 --> 00:07:05.350
So, where we're a bit different than other threat intelligence organizations, we all read the data the Verizim data breach report and reports like that, which are fantastic, but a lot of the threat intelligence that we get is based on post incident reporting and where people rack and stack it together.
00:07:05.350 --> 00:07:10.012
So we're able to be a little bit before the breach in near real time.
00:07:10.012 --> 00:07:24.531
So we go through a process what we see at that network and operating system layer and instead of just putting it directly into a report for someone to read at a later date, we push that back into the Fortinet fabric and also to partners like yourself at Oro.
00:07:24.531 --> 00:07:31.220
So, assuming you're not patient zero in almost near real time, you're actually protected from these threats as they evolve.
00:07:31.220 --> 00:07:32.766
So it is very, very different.
00:07:32.766 --> 00:07:40.574
But to get to your point about collaboration, obviously we'll ingest information from all of our systems, processes, devices across the network.
00:07:41.201 --> 00:07:42.245
But we're big on partnering.
00:07:42.245 --> 00:07:49.273
So we've got teams that go through and they sit in dark web forums and telegram channels, so all that goes in to get an understanding of the bad guys.
00:07:49.273 --> 00:07:49.713
Wow.
00:07:49.713 --> 00:07:50.661
But we also partner.
00:07:50.661 --> 00:07:54.980
So we've been working closely with Interpol for about sort of seven, eight years.
00:07:55.463 --> 00:08:06.555
We've been working closely with NATO for a long time In fact, my boss is going to the NATO conference very, very, very soon and the World Economic Forum, and this has actually been one that I've been directly involved in myself.
00:08:06.555 --> 00:08:15.685
So we've got a project program that we've been working with as a founding partner of the World Economic Forum Center for Cybersecurity, trying to map out the cyber criminal ecosystem.
00:08:15.685 --> 00:08:46.886
So yeah, where that's interesting is, you know we normally talk about IOCs, which is a bad IP or a bad DNS address, but what we're trying to do is find out who are the humans and the systems that they use and the accounts that they hold that sit behind these bad guys, the contis and the trick bots and the dark sides and the revils, so trying to actually understand the real people behind the cyber criminal ecosystem and the dark net that we hear so much about and that's a really interesting couple of points.
00:08:46.927 --> 00:08:52.948
then tying back to your point around the pager and two-way radio attack, and I guess let's circle back to that.
00:08:52.948 --> 00:09:05.565
So thanks for covering off what the labs teams does and people don't probably see that right, it's a huge team working behind the scenes to make sure customers are protected, sharing threat intelligence to effectively protect the world in some way, right.
00:09:05.565 --> 00:09:20.692
But then if I think about your point around this recent physical attack which could be considered, you know it is a technology attack ultimately, and the time you've spent doing the space, you know landscape has changed and continues to change all the time.
00:09:20.692 --> 00:09:29.149
What are some of the most significant changes then you've seen from a cyber threat point of view over the years and kind of how they're impacting businesses and countries?
00:09:29.149 --> 00:09:30.491
Today You're talking about World Economic Forum.
00:09:30.491 --> 00:09:32.027
That would never been a topic before, right?
00:09:32.027 --> 00:09:34.989
I mean, the cyber is so important today, fundamentally.
00:09:35.740 --> 00:09:38.128
Well, I think I mean you've probably cracked it right there.
00:09:38.128 --> 00:09:42.046
I mean in terms of the bad guys, I mean the volume's still there.
00:09:42.046 --> 00:09:55.174
But I guess the key point that I think that really is pertinent to the answer there is everything now is connected together.
00:09:55.174 --> 00:10:00.727
So again, we'll talk about OT and connecting OT to IP-based networks.
00:10:00.727 --> 00:10:14.605
But everything that we use, everything that we do, is connected to one big borg of a system, and in the old days, again, we'll talk about elections later on big borg of a system and in the old days, again we'll talk about elections later on.
00:10:14.625 --> 00:10:20.380
So you imagine, if I wanted to interfere with an election in the old days, I might go and bomb an election booth or I might steal a big bag of paper ballots.
00:10:20.380 --> 00:10:22.985
Now I might want to hack into an election.
00:10:22.985 --> 00:10:33.745
So everything from getting a script to ordering a car or even turning on your tap in the morning, everything is cyber enabled.
00:10:33.745 --> 00:10:43.878
So you know the bad guys in the early days, where they were just trying to breach our systems and you know, essentially, steal data.
00:10:43.878 --> 00:10:49.163
They realised a few years ago that well, availability is something that we can attack as well and that's something that's really, really going to make customers scream and pay us some money.
00:10:49.243 --> 00:10:52.996
So I think, from my perspective, the bad guys have always been the same.
00:10:52.996 --> 00:10:57.836
They're going to be a nation state that's hostile to us the Iran's, the North Korea's.
00:10:57.836 --> 00:11:03.198
It's going to be an issue-motivated group, and you think of the famous anonymous guys there.
00:11:03.198 --> 00:11:29.500
It might be an insider threat and that insider might be doing it for financial reasons or other reasons, or they might just screw up, yes, but most of it is going to be these serious organised crime groups that have probably migrated and evolved since the old days of the Italian mafia and now they're all going all the way across to Nigeria and these big scam farms that are now popping up on the border of Cambodia and Thailand, sort of up in that part of the world.
00:11:29.500 --> 00:11:34.341
This is just such a lucrative industry for the bad guys and unfortunately we're riding that crosshairs?
00:11:34.534 --> 00:11:35.077
Yeah, unfortunately.
00:11:35.077 --> 00:11:35.801
Yeah, because there's.
00:11:35.801 --> 00:11:38.615
You know, many of the Western countries, australia etc.
00:11:38.615 --> 00:11:42.120
Have got you know a fair bit of wealth realistically, so that's a soft target.
00:11:42.120 --> 00:11:52.826
I had a chat to one of the partners at Grand Nickel and we were talking about the same topic and he was made the the comment around um, be hard being a drug dealer today.
00:11:52.826 --> 00:11:56.389
Right, because you know, you know there's a whole process there and people involved, etc.
00:11:56.389 --> 00:11:59.032
Where now you can sit, as you just said, any, any in any border.
00:11:59.032 --> 00:12:04.196
As long as you're connected to this connectivity, you can really get away with a lot more and be really anonymous.
00:12:04.196 --> 00:12:04.837
Right, it's, it's.
00:12:04.918 --> 00:12:18.924
It's fascinating from from a business point of view, even how that, how they're doing that well, it's so advantageous because I can go through and route my attack through sort of a whole bunch of jurisdictions and then I can be sort of sitting in North Korea, or I can be sitting in Moscow, or I can be sitting in Beijing.
00:12:18.924 --> 00:12:22.500
I can attack you and me here sitting in Brisbane today.
00:12:22.500 --> 00:12:26.676
You can imagine just how hard that would be to track us back.
00:12:26.676 --> 00:12:34.110
So you know the likelihood of the police being able to get us in somewhere where there isn't an ability to come and move us back to Australia to be charged.
00:12:34.417 --> 00:12:43.702
It's absolutely beautiful, yeah, and do you think, with this continuous hyper connectivity, that that is just going to continue to be harder, or do you think we're getting better at mitigating?
00:12:43.702 --> 00:12:55.101
Of course there's things like labs that are helping mitigate known problems, but do you think this cat and mouse game is always going to be a system that we close in that gap, or is it widening from what you see and your counterparts you speak to?
00:12:55.863 --> 00:13:13.096
I think we're definitely getting better and I know with working with groups like Oro, so I think we've got some really really good technical solutions now to defend our networks we mentioned before.
00:13:13.096 --> 00:13:13.479
It's so ubiquitous.
00:13:13.479 --> 00:13:20.769
I mean three, four, five years ago, if you talk to a board member, cyber would have probably been the last on their list of problems, but now if they have a significant breach they can actually be charged and maybe go to jail or lose their house now.
00:13:20.769 --> 00:13:23.778
So that's certainly something that's really, really important to them.
00:13:23.778 --> 00:13:30.302
So they're quite happy to invest and take cybersecurity as one of the key business risks to their business.
00:13:30.302 --> 00:13:37.826
Being able to go through and do some really robust defence, especially proactive defence, before you have that big problem.
00:13:37.826 --> 00:13:38.957
I think we're getting.
00:13:38.957 --> 00:13:45.946
I mean, probably the statistics don't always paint that as a good picture, but certainly we're getting more resilient than what we were a few years ago.
00:13:45.946 --> 00:13:54.605
There's absolutely that's obviously a sweeping statement and there's gaps and there's some industries that are more mature than others, but certainly in Australia we're better than what we were.
00:13:54.605 --> 00:13:54.907
I think.
00:13:55.147 --> 00:14:00.647
Yeah, and do you feel as well that our government is really starting to push a few more things?
00:14:00.647 --> 00:14:06.947
In the US they talked about having to have a kind of cyber person size on the board.
00:14:06.947 --> 00:14:10.706
Today it's kind of mandated at a certain company level from what I read and understand.
00:14:10.706 --> 00:14:17.500
But you know, I know Australia's obviously adopted the SOCI Act for critical infrastructure.
00:14:17.500 --> 00:14:20.726
Do you think our government's doing enough now to really start pushing forward that we help close that gap?
00:14:21.414 --> 00:14:23.744
I think the government is doing some really, really good work.
00:14:23.744 --> 00:14:25.760
So, if you think obviously you mentioned SOCI.
00:14:25.760 --> 00:14:27.686
There's been updates to the Privacy Act.
00:14:27.686 --> 00:14:35.561
We've got the Cyber Strategy, where Home Affairs wants us to be the most cyber secure nation in the world by 2030.
00:14:35.561 --> 00:14:36.624
Really really good stuff there.
00:14:36.663 --> 00:14:42.544
The Privacy Act, the fines gone up to about $20 million I think it was $2 million or maybe it's $50 million now.
00:14:42.544 --> 00:14:46.384
Either way, significantly higher than what it was before.
00:14:46.384 --> 00:14:52.109
If you don't do due diligence around protecting personally identifiable information, pii.
00:14:52.109 --> 00:14:55.418
So, yes, certainly the dials have been screwed up there.
00:14:55.940 --> 00:15:23.855
I think that my biggest concern in terms of gaps is that, as the world is now becoming a very, very unstable and probably the most dangerous world that we've seen in decades, probably since World War II when there is the first sign of conflict, the first weapon to be fired will be a cyber weapon, and I think we need to have a much greater sense of urgency in protecting our critical infrastructure.
00:15:24.076 --> 00:15:32.903
As I said before, it's easy for us to expect to go out and turn on the tap in the morning and get fresh water and get in our car and drive to work.
00:15:32.903 --> 00:15:50.826
So if I was a bad guy and there was some conflict, it would be very easy for me to target a water processing plant or a water pump or disable the country's fuel supplies and, from a knock-on effect, obviously it would not take very, very long to cause significant disruptions for our economy.
00:15:50.826 --> 00:16:00.850
So I think we really need to take much more of a sense of urgency in looking at that macro level threat and just how some of these threats could be realised by a hostile nation.
00:16:00.850 --> 00:16:12.043
Again, instead of having to come and send a rocket across the north of the country and hit Darwin or whatever, why not launch an attack from sitting back in the northern hemisphere?
00:16:12.043 --> 00:16:14.827
It's going to be just as effective, just as devastating.
00:16:14.827 --> 00:16:15.570
Yeah, true, true.
00:16:21.475 --> 00:16:29.000
And actually probably more widespread, because a piece of arsenal will damage an area as opposed to a much more widespread issue, right, yeah, yeah, and hopefully we've got enough resilience and enough segmentation in some of our systems where it won't be widespread.
00:16:29.000 --> 00:16:33.258
But we have seen sort of some what were relatively simple attacks.
00:16:33.258 --> 00:16:38.457
You know the colonial pipeline that we saw over in the US caused reasonably significant damage.
00:16:39.321 --> 00:16:51.745
We had a recent issue where the ports or one of the shipping systems went down here in Australia, so we had boats floating across our coast unable to dock and unload their containers for a day or two, so it doesn't take very long.
00:16:52.075 --> 00:17:00.807
Knowing that you're spending so much time with your team looking at threat analysis, what are kind of the cyber threats facing organizations in 2025?
00:17:00.807 --> 00:17:08.326
And what should be the priorities or what should teams think about prioritizing for those, if you can give us any insights?
00:17:08.326 --> 00:17:12.061
I know things can change overnight, but what are you seeing today from your lens?
00:17:12.542 --> 00:17:17.377
So from my perspective, I mean I can talk about the increasing sophistication of threats.
00:17:17.377 --> 00:17:22.999
So we've got now AI, we've got some very, very smart actors that are looking for bugs in hardware.
00:17:22.999 --> 00:17:24.844
They're looking for breaks in systems.
00:17:24.844 --> 00:17:28.738
So there's always going to be that, there's always going to be a vulnerability somewhere.
00:17:28.738 --> 00:17:33.845
But I like to look at it from the other side, and this is from your side in Auro.
00:17:33.845 --> 00:17:35.106
This is the defender side.
00:17:35.166 --> 00:17:47.641
So if I'm trying to defend a system, how can I make the impact of any one breach get as close to minimal or zero as possible, and that is something that we can do.
00:17:47.641 --> 00:18:00.131
So, whether that's using multi-factor authentication, so if someone does manage to exploit one of your attack surface or one of your perimeter devices, if someone does manage to get access to that, how can we segment that off?
00:18:00.131 --> 00:18:07.859
Or how can we make sure that all those user accounts that they will then pop out of that box, how can we make sure that they're useless or harder to exploit?
00:18:07.859 --> 00:18:09.482
To get further into the system?
00:18:09.482 --> 00:18:11.246
Smart role-based access to exploit, to get further into the system.
00:18:11.246 --> 00:18:19.416
Smart role-based access, and not just for people but for machines as well.
00:18:19.718 --> 00:18:36.765
That helps really, really good security operations, like I know you do at Oro making sure that we know what our assets are, how they could be exploited, getting logs and telemetry off those devices, centralising them, normalizing them and then getting those into use cases that will then sit in front of a really really smart analyst's screen.
00:18:37.227 --> 00:18:58.538
So when something that isn't normal comes up, we've minimized what we call false positives, so it's not just something that's going to waste someone's time a red alert but we know with a reasonable amount of confidence that that alert that's just popped up on my screen is something that I've got to take a look at and from there I can go through and isolate and clean up and then bring back into service as quick as possible.
00:18:58.538 --> 00:19:16.096
And if you think about it in that way from a defender's perspective, it doesn't matter if I shouldn't say it doesn't matter, it matters less that a bad guy has got a zero day that they're using against you, because you know they're only going to get to a certain amount of, they're only going to get a certain, a certain distance before we find them and we stop them?
00:19:16.337 --> 00:19:32.105
yes, correct, you talked about the kind of nation states, uh, things that are happening and, from a global perspective, as we sit here today catching in brisbane, we're just coming off the back of the the us elections, you know, and they're obviously the results are a little bit in the spotlight, you know.
00:19:32.105 --> 00:19:48.558
You could argue which way it went, but it's happened and there was a lot of discussion leading up to it and post the last election in the US, plus other elections globally, that for people who followed along with the, you know, disinformation, misinformation it always kind of dominates the conversation.
00:19:48.558 --> 00:20:04.211
Now that we've so cyber connected and influencing and all these sorts of things, can you talk a little bit about some of the cyber enabled threats that relate to these issues and how they may detract from what should be a normal process and how the world's changed just in elections alone?
00:20:04.654 --> 00:20:06.760
Yeah, so this is a fascinating one, michael.
00:20:06.760 --> 00:20:17.837
So, if we think about that convergence of threat, and just before we get into the misinformation, I'm always fascinated about some of these global cyber gangs.
00:20:17.837 --> 00:20:33.843
So how do you go from a gang that's operating out of Nigeria or over in Eastern Europe all the way to attacking my mum that's sitting on her iPhone up at Burley Heads here as part of a scam?
00:20:33.843 --> 00:20:36.468
So it's well enough to have the infrastructure sitting behind it.
00:20:36.468 --> 00:20:45.584
It's well enough to maybe have an exploit, and maybe I want to just do some crypto mining off her phone, or maybe I do want to scam her out of her life savings.
00:20:45.584 --> 00:20:51.057
There has to be somewhere that all that infrastructure converts into a localised attack.
00:20:51.057 --> 00:20:56.642
So mum knows that she gets a message saying oh, this is Australia Post or this is the Australian Tax Office.
00:20:56.642 --> 00:21:03.846
So how do these bad guys on the other side of the world craft a social engineering attack that is so realistic that it can get past my mum?
00:21:03.846 --> 00:21:07.740
So I think that there's this convergence and this is where we get into the election.
00:21:07.740 --> 00:21:10.483
I think that there's this convergence and this is where we get into the election.
00:21:10.523 --> 00:21:16.798
The same bad guys and nation state guys are using the same malicious ecosystem that the criminals are using and more and more we see.
00:21:16.798 --> 00:21:31.218
Sometimes they'll call them mercenaries, but we're seeing that convergence of nation state actors and cyber criminals using the same infrastructure, in some cases working together, in some cases for trying to influence an election, or people, in some cases trying to steal money.
00:21:31.218 --> 00:21:35.708
So just to get a few terms out there, they call it MDM now.
00:21:35.708 --> 00:21:42.201
So there's a new term that they're starting to come out with, which is called misinformation, disinformation and malinformation.
00:21:42.201 --> 00:21:47.759
Now, misinformation is basically where I would say something and I just get it wrong.
00:21:47.759 --> 00:21:50.946
So I might say I'm doing a podcast with Michael in Sydney today.
00:21:50.946 --> 00:22:00.342
It was an honest mistake, but anyway, someone gets hold of that and they said oh, glenn's in Sydney today, why did he not turn up to this meeting in Sydney when I'm actually up in Queensland?
00:22:00.342 --> 00:22:01.465
So that's misinformation.
00:22:01.465 --> 00:22:07.338
Disinformation is where someone's a little bit more deliberate in what they're doing.
00:22:07.338 --> 00:22:19.403
So if you imagine I was a bad guy, I might get a FortiGate and I might say, oh, fortinet says that it can do five terabits worth of throughput when this is actually only two terabits.
00:22:19.403 --> 00:22:23.682
So I just make something completely up, send that out, and then I could use that against me.
00:22:23.682 --> 00:22:28.539
So there's sort of those two different ways that we can use to influence Malinflammation.
00:22:28.559 --> 00:22:36.684
Isinformation is a bit of a controversial term, but that's where you use, I guess, legitimate information with malicious context.
00:22:36.684 --> 00:22:39.684
So if you think, probably revenge porn is a good example of that.
00:22:39.684 --> 00:22:52.846
So a photo is taken in the privacy of someone's home that then gets leaked to people that weren't originally accessed or authorized to have that information and that's used against the victim Malinformation the reason why that's sort of a bit controversial.
00:22:52.846 --> 00:22:54.176
It could actually be something that's true.
00:22:54.176 --> 00:23:03.998
So if you think of our good friend Donald Trump and Stormy Daniels, that may or may not be true, but if it was true that would be really really juicy to use against him if I was one of his enemies.
00:23:03.998 --> 00:23:11.049
So, basically, forever hostile nations have wanted to go through and interfere with democracy.
00:23:11.130 --> 00:23:17.696
So, back in the day, it might be Russia funding some Marxist groups at a university or something like that.
00:23:17.696 --> 00:23:27.141
There might be some other political parties that they'll funnel some money into to try and influence, but now in these cyber-enabled days, it opens up a whole world of possibilities for these guys.
00:23:27.141 --> 00:23:38.592
So if you go back to sort of 2016, the Russians had about 500 Russians activated and trying to disrupt the American elections and American society.
00:23:38.592 --> 00:23:41.605
And if you think of those 500, that would have actually been quite rare back then.
00:23:41.605 --> 00:23:45.066
So you need Russian people that speak really, really good English.
00:23:45.066 --> 00:23:46.601
They understand and they're speaking with American accents.
00:23:46.601 --> 00:23:47.365
They understand the subcultures.
00:23:47.365 --> 00:23:48.991
They understand sort and they're speaking with American accents.
00:23:48.991 --> 00:23:50.819
They understand the subcultures.
00:23:50.819 --> 00:23:52.990
They understand sort of some of the societal norms.
00:23:52.990 --> 00:23:54.455
They understand the political system.
00:23:54.455 --> 00:23:55.960
They know how elections work.
00:23:56.480 --> 00:24:06.028
So apparently these guys going back to that election back then, they pumped out about 80,000 posts and pieces of propaganda just to influence us.
00:24:06.028 --> 00:24:07.069
So that was 500.
00:24:07.069 --> 00:24:09.182
And obviously that was the scale they could get.
00:24:09.182 --> 00:24:19.330
But if you think now in the age of AI, you could probably have just a handful of people that could do much, much more than that by generating some of these malicious posts.
00:24:19.330 --> 00:24:21.939
And just you mentioned the election that we just saw yesterday.
00:24:21.939 --> 00:24:44.746
Going back on the 4th of September, there was a group called Tenant Media that was charged over in the US and they were a right-wing group, but they were taking money from Russia to go out and spread misinformation to all their fans, all the people that they were influencing, and they were saying, oh, go in and intimidate voters, go in and steal votes, go in and destroy ballot collection areas.
00:24:44.746 --> 00:24:55.349
So this is a real threat and it's happening every day and luckily I can't think off the top of my head any really catastrophic things that have happened down here in Australia, but it's only a matter of time.
00:24:55.710 --> 00:25:00.165
It is true, and I think you do touch on a very good point there if I think about influencing media.
00:25:00.165 --> 00:25:07.929
So if we go right back, you know a newspaper, then television, you know this kind of thing's been happening for a while where people want to kind of make things come to fruition.
00:25:07.929 --> 00:25:16.002
The challenge we've got now is again we're so cyber enabled or so connected.
00:25:16.002 --> 00:25:20.222
I should say no doubt that social media has played such a big role in that because everyone's connected on that and I think about the new generation coming through.
00:25:20.222 --> 00:25:27.707
So you have baby boomers, all that were probably still paper based reading, all that, and they were influenced in some way, but probably not as catastrophic.
00:25:27.707 --> 00:25:38.540
If we go all the way down to the people who can vote now, where they're just hyper-connected and everything's on a screen, probably the ability to influence the outcome is completely different, right, if you think about how wide that gap is.
00:25:39.102 --> 00:25:39.683
Yeah, it's funny.
00:25:39.683 --> 00:25:50.411
I sometimes think, and they talk about these digital natives, and I've got three kids a 17-year-old daughter, a 15-year-old son and a 12-year-old daughter a 15-year-old son and a 12-year-old daughter.
00:25:50.490 --> 00:25:51.532
They're all digital natives.
00:25:51.532 --> 00:25:56.077
And my son is an absolute.
00:25:56.077 --> 00:25:56.881
He loves technology.
00:25:56.881 --> 00:25:57.723
He's built his own PC from parts.
00:25:57.723 --> 00:25:58.185
He programs in Python.
00:25:58.185 --> 00:25:59.130
Technology is just his absolute passion.
00:25:59.150 --> 00:26:01.355
But I think I don't know when we talk about digital natives.
00:26:01.355 --> 00:26:04.801
Going back to our day, we built systems from the ground up.
00:26:04.801 --> 00:26:18.300
We'd build a rack and then we'd put a router in it and we'd put a switch in it and we'd put a firewall in it and then we'd put a server in it and we'd plug it all in and load the applications on the top of that infrastructure and then push that out.
00:26:18.300 --> 00:26:29.121
We'd know what IP address it had, we knew exactly where that server was and what was running and what it was doing and if something happened you'd walk into the server room and turn it off, yeah, yeah.
00:26:29.602 --> 00:26:42.203
So I just wonder, especially with sort of some of these digital natives these days, whether they've become a little bit a part of the attack service, because they're so good at using these applications and exploiting these applications, but not necessarily knowing how they work.
00:26:42.203 --> 00:26:51.518
And then, if you think, in most cases or many cases these days, these applications are powered by service from the cloud.
00:26:51.518 --> 00:26:53.142
Do we actually even know where our data is or where it's getting processed.
00:26:53.142 --> 00:26:58.000
So I think it's very, very different in 2025 than what it was even probably pre-COVID.
00:26:58.221 --> 00:26:58.602
Yeah, yeah.
00:26:58.602 --> 00:27:15.701
And if I think about again those attacks, the influencing election and state-based activities to influence a country, and election's always the peak period you also touched on earlier around campaigns you know christmas is coming then they're very crafty about how they do their, their threats etc.
00:27:15.701 --> 00:27:28.265
But if I think about elections particularly and we've heard over the last three or four elections globally that they've been influenced and there's been some proof in it and maybe not some proof in it you know there's a bit of a debate, but do you think this has affected the public's trust in in the editorial and the electoral process?
00:27:28.265 --> 00:27:33.183
But do you think this has affected the public's trust in the electoral process or do you think it's kind of they just get on with it?
00:27:33.183 --> 00:27:33.826
What's your view on that?
00:27:34.055 --> 00:27:35.819
I think, michael, that's 100%.
00:27:35.819 --> 00:27:41.520
The public's trust has been affected and in some ways, that is actually the intent of some of these disruptions.
00:27:41.520 --> 00:27:46.616
So I don't necessarily need to have my candidate win.
00:27:46.616 --> 00:27:56.038
But what happens if like we saw sort of last time what happens if I can erode the public's trust so much in elections that I can use that then against my enemy country?
00:27:56.038 --> 00:28:06.607
And I just read a report recently about our handling of COVID and you could argue with how good a job we did versus how bad and a few mistakes with 2020 hindsight.
00:28:06.607 --> 00:28:16.436
But the frightening part of that particular report was there was an erosion, a significant erosion of public trust in authorities, people like the health system.
00:28:16.436 --> 00:28:23.097
So when the next pandemic comes along, maybe people won't be quite as compliant in some of these.
00:28:23.097 --> 00:28:27.236
So it becomes very, very, very, very different situation and quite dangerous very, very quickly.
00:28:27.416 --> 00:28:44.875
Do you think there's some strategies that governments, organisations or individuals can use to protect themselves against the spread of misinformation, and maybe ways to really validate and identify credible sources, considering we're talking a lot about AI, you know, deep fakes, all these sorts of things or it's just going to get harder and harder, I think?
00:28:44.916 --> 00:28:52.248
it is going to get harder and harder, I think, especially with the rise of AI and deep f facts, it's going to be very, very hard to work out what's real and what's not.
00:28:52.248 --> 00:28:55.426
And you know, I don't know if I can answer you, michael, where this goes.
00:28:55.426 --> 00:29:06.003
I mean, you know, if it was a cyber attack, you know a buffer overflow or some sort of exploit against a service, I'd say, well, we need to put a firewall in front of it and block that port or monitor that port or something.
00:29:06.003 --> 00:29:08.746
But when it comes to influencing humans, I don't know.
00:29:08.746 --> 00:29:12.269
Maybe we get an AI, some sort of an AI system to defend against it.
00:29:12.269 --> 00:29:13.971
But it's definitely a risk.
00:29:14.875 --> 00:29:35.446
And even if you look at where the attackers are going, so it's so, so common now for attackers to not even use necessarily use malware, but certainly more and more they're using credentials that they've either stolen or dumped from the victim or they've just bought from an initial access broker and you guys at Oro in the SOC.
00:29:35.446 --> 00:29:39.444
It's one thing to see to notice someone doing a port scan inside a network.
00:29:39.444 --> 00:29:40.126
That's unusual.
00:29:40.126 --> 00:29:41.679
That's something really, really unusual.
00:29:41.679 --> 00:29:42.862
I've got to go and investigate that.
00:29:42.862 --> 00:29:47.006
But it's another thing to see Michael move from server A to server B.
00:29:47.006 --> 00:29:52.340
Well, that might actually be you just going through and accessing a file share, but it could be someone using your account.
00:29:52.340 --> 00:29:55.965
That's a lot harder, as the SOC analyst, to know.
00:29:55.965 --> 00:29:57.781
Well, is this legitimate or is this anomalous?
00:29:58.615 --> 00:30:05.344
I hope you enjoyed part one of my discussion with Glenn Maiden, Director of Threat Intelligence at FortiGuard Labs ANZ.
00:30:05.344 --> 00:30:07.260
Tune in next week for part two.
SEARCH PAST EPISODES
Search past episodes of Securely Connected Everything.
Disclaimer: The podcast and artwork embedded on this page are from Michael van Rooyen, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.
EDIT
Thank you for helping to keep the podcast database up to date.
