EP118 RSA 2023 - How to Protect Your Organization from Cyberattacks in a Time of Political Turmoil

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the Senior Product Manager for Threat Detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit the subscribe button in your podcasting app of choice. You can follow the show, argue with your hosts, and the rest of the Cloud Security Podcast community on LinkedIn. Today, Anton, this is a really fun episode. We're kicking off RSA week with a really fun preview of a topic that is near and dear to my heart.

What? Threat intelligence? You're suddenly a fan of threat intelligence? What happened, Tim? I thought you were a threat—

No, not threat intelligence. Geopolitical cyber conflict.

Okay, that does sound exciting compared to just threat intelligence because, you know, enough people still think of the, oh my God, I have a long list of bad IP addresses. And while we can educate these people and say, but sirs, these are not threat intelligence indicators, I don't think it's working. I think enough people still see threat intel as a big, big list of bad IPs, which is really sad because it's kind of the opposite of that. Look at today's episode.

Well, I think as long as we don't have users rotate from it's a list of bad IPs to it's fun reading about bears, we'll end up in a good spot in the middle. So with those 2 polar opposite options, let's turn things over to today's guests. I'm delighted to introduce today's guests. We are joined by 2 of our friends today. First off, delighted to introduce Shannon Ronis, head of the Mandiant Communications Center, as well as John Miller, head of Mandiant Intelligence Analysis. Now, we've had Mandiant guests on our show before. We've had RSA episodes on our show before. We've even had episodes where we talk about markets and the role of government before. But today we get to talk about cyber in the context of state conflict. And I love this topic because I actually got interested, listeners, in, in cyber when I was a political science major and I was looking at 21st century conflict. And so since more than a decade ago, this has been one of my favorite topics. And I think what's cool today is we get to talk about how organizations sometimes struggle with contextualizing what's happening to them, what they see happening in the world, and relating those 2 things to each other. So first, let's start off at the leadership level. What advice you have for organizational security leadership, board leadership, when it comes to connecting cyber events that hit them with what's happening in the world at the geopolitical level?

Yeah, thank you for having us. Definitely a really interesting topic, and excited to be here. I think the primary thing that I'd say is, you know, we constantly hear questions from organizations in this category. We regularly work with organizations that are looking at a geopolitical conflict or some other kind of quote unquote bigger than cyber development and asking the question of what does this mean for threats to my organization? And the answer is one that's both highly subjective. There isn't one right answer, and it's highly important for an organization to be able to do what they need to do to use threat intelligence to drive the right outcomes for their team. So the important thing for leaders thinking about this is there needs to be some planning and framework in advance to be able to connect the dots all the way from something like the Olympics are happening, what does this mean for threats to my organization, all the way through to specific security actions that a team needs to be enabled to do, like hunting for undiscovered threats that are resident in an environment.

So some of that Makes a ton of sense to me. Certainly the Olympics are foreseeable. They happen every 4 years. What about unforeseeable things like, say, land wars in Europe?

Yeah, so that's one of the crises that we've been managing as a company for quite a while since it emerged last year in early January. I think the secret and the key to be able to do really agile, really effective crisis response is to To really focus on the fundamentals. As John said, you need to have all these frameworks in place. The reality is, if you're already doing intel well in your organization, if you already have all the structures built out, if you already have all your communications cadencies built out, if you understand your threat profile, that is the thing, the organizations, the entities, the threat actors that are likely to target you, but also sort of the introspective look at, well, who are the people, processes, and technologies that will make me a target? Where do I have gaps? Where do I have good visibility and bad visibility and the ability to detect and monitor and do something, right? If you have those good understandings and the ability already to quickly communicate and a good understanding of your stakeholders within the organization, who as an intel analyst are you communicating to? What are their day jobs? What are the decisions that they're grappling with? And how can I use intelligence to help those, right? If you have all that stuff built out, and again, these are the fundamentals of any good intel apparatus, Then, when a crisis happens and you don't know if you need to spin up and it's very unexpected, you really just surge and you really just kind of push to a higher level the things that already exist and kind of shorten up the timelines and kind of shorten the loop from when you decide to take an action to when that action is actually taken. So, the pre-work is the keyword for when it comes to crisis management.

And I think that applies to getting the sort of to connect the dots, maybe not the dots, connect the picture on TV, the crisis, and the picture inside their SIEM, or as I try to joke in a little '90s manner, connect CNN to your IDS. What is involved in linking the events in the political scale to events in the organizational sensors and detection logic? That's been a puzzle. I've seen a lot of organizations who are quite confused about it, frankly. They only think about Oh, yeah, crisis, we're going to get a phishing email. I guess that's a relatively silly look at this, right? For you especially. But, like, how would you approach building this connection in a useful manner?

The good news is, you know, based on lessons that we've learned across many situations of having to respond to this type of question, it is possible to establish the right framework in advance, you know, and to be able to effectively answer those questions. And we're excited to talk about that.

And what is the right framework? What are the components there?

There are a few components that are involved that we're going to be highlighting. We break it down into a formula of delivering intelligence to the right people at the right time in the right format with the right content to help make the right decisions. So certainly several things that an organization has to think through in advance. If it was easy, everybody would do it. But at the same time, there are definitely good lessons to be learned. from cases where organizations have had success dealing with these situations?

And I would kind of add to that question. I mean, it's kind of a 2-part question, right? There's the first part of, do I need to respond or proactively spin up? And then the second part of the question is, okay, if I do, how? What do I do, right? And the first part of that question is something that when we present on this at RSA, John is going to talk in depth about, but a lot of it has to do with understanding, again, I mentioned your threat profile, right? Do I, based on my industry, based on my vertical, based on my geography, based on cases that I've been— threat activity that I've observed on network in the past, based on targeting that I've seen of organizations with a similar profile to mine, right? Having a full understanding of— and when I say threat profile, that is what I mean— mapping that understanding of yourself to the understanding of the threat landscape and the threat activity that you're looking at, right? If the threat activity matches my threat profile, Do I think that there is a likelihood that I will be targeted and should proactively spin up?

Yes.

Then the question is, okay, but what is that threat activity?

How much—

what's the potential risk to me and my organization based on that activity, right? If the potential impact is minor, right? And a lot of times when you're doing risk assessments or risk analysis, you can map these activities to a dollar value based on potential loss and flow-on effects and all of that stuff. So looking at it from that perspective, from a dollar value, is it more expensive or better for the organization for me to accept or transfer this risk, or should I proactively, you know, do something against it and kind of save us and provide efficiency that way? It really depends. It's a case-by-case basis. Not every organization is the same. Not every organization has the same threat profile or targeting profile. Not every organization is going to experience the impact of a successful breach in the same way. So, and this is something that we talk to organizations a lot about is, It's one thing to know that the adversary, it's incredibly important to understand the adversary and how they operate and what motivates them, but it is equally important to know thyself.

Hmm.

Know thy internal stakeholders. And again, then this is kind of moving into that second part of the question, right? We've decided to spin up, what do we do about it? Now we're starting to talk about, well, there's this, the key point of intel and the thing that, the value of intelligence is that it helps audiences and stakeholders create some sort of action, right? Intelligence has to lead to action. And the stakeholders in your organization are the ones who are responsible for taking that action. So just as you have to know thyself from an organizational perspective, what are my risks, what are my people, process, and technologies, because that tells you what's the potential impact or likelihood of you getting exploited, you also need to understand your individual stakeholders. What do they do? What is their day job? What are they responsible for? Where are the decisions and the uncertainties that they're grappling with, because if, as an intel analyst, you can get them the information to help them deal with those things in the context of a crisis, now you're enabling them to take actions and you're creating this whole-of-organization response where everybody is moving quickly because they have the right intel at the right time. And that's that formula that John was alluding to, to make decisions quickly and to get things done and protect yourself before you deal with an issue.

So to combine what John said and what Anton said, we need to have STIX into our IDS, not CNN, and we put CNN into our CISO. Do LLMs give us an opportunity to put CNN into our IDS and STIX into our CISO?

Why are you going there, Tim?

Why are you going there?

No, I'm just teasing about the LLMs. That occurred to me as I was writing notes though.

Yeah, great question. Shannon, you want to take that one or shall I take a stab at it?

No, go ahead. I was just fascinated by how many acronyms you were able to put into one sentence.

That was very impressive.

Oh yeah.

Sorry.

Sorry, listeners, that's really bad of me.

Yeah, we've been looking, you know, it's very timely, of course. We've been looking a lot, given all the discussion publicly about LLMs, at what exactly does this mean for the future of how we think about, you know, how do you build an effective threat intelligence function? And a lot of what it will come down to is, you know, as these tools evolve, most likely what we're going to see is an increased capability to take more raw intelligence holdings, more, you know, unfinished data and insights, and turn that into something that's more finished. And that, for example, you know, could provide a quick summary to a CISO of an important issue and kind of reduce that time to value as well as increase a team's capacity to be able to, you know, provide answers to expected predictable types of questions like, can you give me a summary of what's going on in this event?

Okay, that actually does make sense.

So that's really nice of you, John. I was kind of just bullshitting about the LLMs thing, but I like that there was a real answer there.

That's great.

He was trying to trick you. He's known for that, right?

It's a good question.

Yeah.

So Anton's got a good one here.

Yeah, I kind of wanted to— I'm reminiscing back to my Gartner days a little bit, and a lot of TI, threat intel questions I've gotten back in the analyst days were kind of about, I collect intel, I'm supposed to benefit over here, but the middle is still very much a gap. And I think Shannon highlighted maybe a few dozen times so far that you have to be able to act and it must be actionable.

Is acting important? I think acting is important.

Oh, Tim has a question. Is actionable intel important? But the point is, this is still very confused in some minds, even security leaders' minds. I've met one in my Gartner days who read threat intel reports. And when I asked him, why are you reading it? And he said, Oh, they make for engaging reading. So he basically considered them to be kind of fun stories about bears. Like, like, like, that's okay. It's his money. He was paying for subscriptions to read reports as a pro, but it's probably not why they were being made. So your framework, how does it help connect this? I get threat intel, strategic intel, country-related intel to I'm safer.

This is a really common problem that we see a lot. And I think it comes back to a lot of times we see this kind of Field of Dreams mentality, right? This, if you build it, they will come. If you create the best analysis and the best report and everybody reads it, then everybody's safe. And that is absolutely not true. And a lot of that has to do with the way that the information is being presented to the stakeholders who need to take it for action, right? When we think about who our stakeholders are with the function that I run, it's everywhere across the board. It's executives, it's sales folks, it's customer success, it's analysts, right? People who have full-day jobs and things that they are focused on and requirements that they are grappling with. So, how do you take one piece of information and make it fit for purpose for an analyst, for an executive, for a salesperson? Because you can talk to them about the same topic, but unless you're looking at it through the lens and using the language and the base knowledge that they already have, that they can take this new information and map it to and make sense of whatever it is that you're telling them, right? They're not gonna be able to do anything with it. So, that's why, again, This pre-work is the keyword. This pre-work, we call this a stakeholder analysis. Again, understanding who your audiences are.

Not the threat actor, but the stakeholder.

Yes.

So there's that involved. Huh. That is tricky.

This is brilliant because—

Brilliant.

This is amazing. I took an amazing class called Persuasive Communication years ago, changed my life. And there were basically 2 rules. The first rule was always understand you're with them. And always understand your audience.

That's it.

And that was it. And if you can do that, you're golden. That's it. And so this is, this is amazing.

So, but the other part and the extra struggle that comes with intel is everybody wants to get value out of intel, right? And we talk about how analysts need to understand the use cases to communicate that value effectively. But at the same time, your audiences who are not necessarily cyber intel analysts or really engaged in the cyberspace, might be getting your intelligence reporting and just kind of saying, I don't really know what to do with this, right? What's the value here? I don't— So, as you're doing a stakeholder analysis, we always talk about socializing the intel function. And what that means, all that really means is, as you're sitting there asking questions of your stakeholders to understand them, you are also giving them information about you so they can understand you and understand the value that you can give them. Once they've asked, once you've figured out what the decisions are that they're trying to grapple with, You can then supply the information of, oh, here's how I can help you. And once they know that you are there to help them do their jobs, it's way more likely that they're going to start paying attention to the intel reporting that you're providing. And it's way more likely that they're going to have an understanding of what to do with that quickly because you've already had those conversations in the context of normal day-to-day work that is now very useful in a crisis situation.

In the example that you mentioned, you know, it's great that that security executive was taking the time to read the stories about the bears, like you said, But to emphasize what Shannon was saying, you know, let's say a new leader comes in or there's a really busy time, the organization would probably benefit from having some analysis done of, you know, okay, this is the type of decision that this particular executive actually needs to make. And rather than just having the stories about bears, maybe something a little bit more focused like, hey, here's a notable change in the threat landscape that we saw for your organization, and what are the implications going to be? for different parts of your security team and the actions that they're going to need to take.

Interesting.

And I think kind of since we're talking about stakeholder action, which might actually be my favorite topic to talk about ever. So, when we kind of went about setting up and revamping and improving our crisis function, governance is important and how you manage it, right? So, we ended up following a model that has a steering committee with senior leadership from across every part of the organization. And the reason for that is that, again, in order to manage crisis effectively, We do want to provide timely and accurate intelligence, right? But in order to create that intelligence based on the activity being seen, that takes time, that takes resources. And thinking about it from the stakeholder perspective, for them to action the intel we're providing, that takes time and that takes resources. So unless you have senior leadership from across every part of the organization bought in, or if you're thinking about it from a RACI perspective, that accountable bucket, You're not necessarily going to be able to create the taskings, create the actions, move resources to focus on this crisis in order to be able to effectively deal with it. So, having governance and organizational buy-in from the highest levels is incredibly important to make sure that you're not just kind of providing information and saying— and everybody's kind of reading your reports and saying, cool story, I'm too busy to deal with that right now.

Yes.

And that's not uncommon at all, even with leaders, especially if it goes even to CIO. I've seen examples when some reports go above CISO, and then it becomes a whole other tricky stakeholder analysis, as you pointed out, right? Because it may not be the same report that goes to CEO or CIO as the one that goes to a CISO or head of some security function, right?

Yeah. Agreed. Probably a lot more impactful in most cases at that level. for someone to be able to briefly speak on a live call to, hey, this is the top one thing that you should be thinking about today in terms of an important change to the threat landscape, versus firing over, you know, yet another email that someone may not ever have time to consume.

So I want to get a little bit tactical for a second and ask, how does an organization know if they're actually getting value out of their threat intelligence? What are the KPIs to look for here? How do we know if what we're doing is good? Or maybe put differently, what do we expect to see get better as a result of this?

Yeah, I think the important thing with that question is organizations really need to focus on what were the actions that were enabled by the intelligence that was provided around a crisis situation and let that be the primary metric of, are we doing the right things or are we not? It's really easy in these situations for, for teams that are focused on delivering answers to their leadership to measure the answers directly and say something like, oh, we shared, you know, an update on this timeline, or we delivered this many reports, or other measures that are kind of directly on intelligence deliverables instead of the actions that were enabled. But what if instead, you know, in that example, the team looked at Was the organization able to effectively hunt for actors that were well aligned with who might target us in this situation? And was the organization able to effectively prioritize security alerts that seemed like they might have a connection to the situation? So measuring that kind of end user outcome is really the approach that organizations want to be able to take to answer that question of, you know, are we accomplishing the right things and are we measuring the right things to do that?

So, it's not like indicators per hour or reports per week or something like that. There is a lot more. I guess that you're making somewhat slightly cringy faces when I present some of the metrics I've seen people try to measure intel with. And I think that, yeah, I think that actually makes sense.

Right.

So, I wanted to switch gears a tiny bit. And I mean, I'm being funny about it sometimes, or at least try to. And I think cloud providers, this is a cloud security podcast. So, I want to try to build a little bit of a tenuous connection to cloud here. So, it feels like being a cloud provider gives us sort of a strange and unique view of threat intel because ultimately we see what affects our clients, right? Is there anything magical or special to this process that us being a cloud provider adds?

I think the fundamentals across crises are sort of platform agnostic, right? It doesn't— for me, I don't think it necessarily matters that it's a cloud provider. I think at the end of the day, we're looking at a problem that is a very human problem. that can be facilitated by technology because technology can sort of shorten the communication. But I, I'm open to being corrected.

Yeah, the other thing that I would add is, you know, this really goes back to what Shannon said about understanding your stakeholders. If you're trying to enable a team who's only protecting on-premise assets, then they may need to be able to do different things with the intelligence that you give them than if you're enabling a team that's also trying to protect cloud assets. And that's the important thing to keep in mind. So, you know, having a strong understanding of what does it actually look like to take the right proactive and reactive security actions for cloud-based assets for my organization, and then the crisis intelligence function that's responding to these situations being well positioned to deliver those needed insights. That's the important thing when you think about how to manage this as an organization using cloud services.

That actually makes sense to me, and I think that's clear.

Well, it was maybe making less sense to me than it was about to make sense to Anton before I cut him off. What's actually different about cloud compared to on-prem for this?

You know, I don't think there's going to be one answer to that, but long story short, organizations that are— let's say I'm looking for an indication that an intrusion operator targeted cloud-based assets. There are going to be a number of things that are different. There are potentially going to be different tools that they have the capabilities to use across those assets to look for malicious activity. There may be different levels of visibility that they have into what's going on in the environment versus, let's say, if it was, you know, a physical box that they could go work on directly. They may have a situation where there are different TTPs that are being used by sophisticated malicious actors that are tailored to certain cloud environments.

Mm-hmm.

So kind of all of the above, you know, could potentially be considerations that, again, essentially mean, you know, you need to be able to understand, okay, what are the actions that I'm trying to enable here, and what do I need to provide to enable those actions?

Yeah, the actions certainly end up being different for Cloud IR versus on-prem IR. We are sadly at time, so I'm going to ask our traditional closing questions. First, do you have recommended reading? And it can be anything, a book, a blog, not Anton's blog, that's been banned from the list.

For today, for today, just for today.

And one tip to improve people's use of threat intelligence?

I will go first. I would recommend the book that I'm currently reading, which is a series of poems by Mary Oliver.

Oh, nice.

Yeah, I'm enjoying every single one of them. And then in terms of advice for anybody looking to do better with threat intel, it comes back to that question. Know thyself, know the threat actors, but above all, know thyself, know thy stakeholders, and just keep in mind that intelligence has to lead to action. Otherwise, What is the point?

So I'm sorry, but I have to jump in. An intelligence expert, a very intelligent intelligence expert, tells me that knowing yourself is more important than knowing a threat actor. That blows my mind a little.

That to me speaks to not—

What about the bears? What about them bears?

That speaks to me to a very wise intelligence expert, not just an intelligent intelligence expert.

You know, ideally you would have both.

That's the deal.

It's just easy to get a little lost in, oh, this is so interesting, this is so exciting, you know, this, this insight into how a threat actor is operating, and forget that first part about, okay, I have to not just understand the threats, but also how my organization lines up against them. And definitely important to, to understand both sides.

Yeah, it has to be an iterative process. Just knowing the threat actor is one thing. Knowing thyself is how you truly get the most value possible out of the threat intel that you are consuming or producing, whatever the case may be.

Well, what I love about this is it really gets back to what I always say on the show about CISOs not needing another security product, but really needing some time with a therapist or a family counselor. John, your recommended reading or one tip?

Sure.

You know, I didn't come prepared to answer that question, but I think I have a good answer. I recently picked up a book called Sandworm that's about cyber conflict and is very timely, both due to the Russia-Ukraine conflict, as well as happens to involve a lot of folks that Shannon and I have worked with across the cybersecurity industry. So definitely worth a read just given the events that are happening in the world. And your second question, you know, I think one of the most memorable things for me as I've been thinking about this topic is, again, you know, the importance of being able to measure what do I need to do and am I successful in terms of those end-user actions. Typically, you know, you don't want the end state of what an organization does with threat intelligence to stop at getting the threat intelligence. You want to be able to enable some action, and that's the important thing to be able to measure.

Well, John, Shannon, fascinating discussion. Thank you so much. I'm looking forward to the RSA talk quite a bit. Thanks for joining us today.

Thank you for having us.

Thank you.

And now we are at time. Thank you very much for listening and of course for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter @anton_chuvakin and _timpeako. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.