EP147 Special: 2024 Google Cloud Security Forecast Report

Security.

Hi there. Welcome to a special episode of the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Tim Peacock, the Senior PM for Threat Detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us, our guests, and the rest of the Cloud Security Podcast listeners on LinkedIn. Anton, we are talking about the future today.

We are, in fact. And I think that one realization that will probably happen to most of the listeners is that predicting the future is hard.

It is.

But there is one secret technique that we can use to actually know what will happen in the future. And I would absolutely not reveal what it is.

No, we won't reveal how we predict the future here at Google. But we have advanced techniques, listeners. You will learn about very soon how Google predicts the future. But overall, I actually really enjoyed this episode because we got also to talk about one of my favorite things, which is things that are getting better.

Yes, there was one small thing that's getting better, Tim. Yes, thank you for your optimism.

There was something good. There was something good in the world. We have to celebrate that.

That's correct, yes. That's right. Right in the Appendix X, there's this minor footnote about things getting better. So yes, you're absolutely right.

Well, with that footnote, listeners, let's turn things over to today's guest. I'm delighted to introduce today's guest. Today, we have the pleasure of being joined by Kelly VanderLee, a senior manager for threat analysis, Mandiant, here at Google Cloud. Kelly, I want to start off with a Yogi Berra quote. He said, predicting things is hard. Especially the future. We've got a threat forecast report. Is it hard to predict threat actors in the future? I feel like that's gotta be not easy.

Well, of course, we're not gonna be able to anticipate all potential futures in a short paper. For example, at the end of 2019, I don't think that most of the cybersecurity industry was anticipating how a global pandemic might impact how businesses and cyber threat actors operate. So there will be some surprises, some potentially unforeseen events. However, we can forecast short, medium, and long-term developments based on trends and observed threat activity. The large-scale trends tend to have quite a bit of momentum behind them. So there are definitely tracks that we can follow and signposts that we can call out that, oh, if we see XYZ circumstances, then that would probably indicate a change in the trend, whether to accelerate or to decelerate.

So wait, actually, this reminds me. So that sounds like we are mostly extrapolating as opposed to predicting. And to me, I have this dual strange perception of extrapolating. I think extrapolating is the best and the worst kind of prediction. The best is it's the only one that works, but the worst, it's kind of boring. So if you see a lot of ransomware, what are you going to predict for next year?

Ransomware.

A lot of ransomware. So is there anything that is maybe not extrapolatory, but more like, I don't know, crystal balling stuff. I don't know. I can't think of a good way to say it.

What comes out of left field? How about that?

Yeah. What comes out of left field? Thank you, Tim. I appreciate you saving me from my rambling.

That's what I'm here for.

Well, there are some things that are not necessarily cyber threat related, like things that affect our world. For example, the pandemic or Climate change affects how humans operate, how governments operate, how businesses operate, and that in turn has an impact on how we operate with our technology and how the bad guys operate with their technology. So, there were signs ahead of Russia's invasion of Ukraine that there would be a conflict. And so—

Mm-hmm.

Mm-hmm. In preparation for that event, of course, we were thinking about, okay, what could be the potential cyber threat implications of this? With the current hostilities between Israel and Hamas, as a cyber threat intelligence organization, we were not necessarily tracking what are all of the minute physical security implications going on currently between Israel and Palestine. But those physical, real-world surprise events also impact how cyber threat actors operate, how cyber defenders operate. So yeah, I'd say the trends that we can extrapolate well are based on what we know about baseline, no change in the world around all of the things that are going on in the cyber threat landscape. The profit motive, the actor capability supporting the ransomware trend, it has not changed. So they are specializing, they're getting better Despite having one operation be shut down by law enforcement or even by hacktivists, there are many options for threat actors to go to, to continue their business. So those are the kinds of things that we can predict. The real world and how they will impact the cyber threat landscape are a bit more difficult.

That actually makes sense. So some of the weird things may come out of left field in the physical world and then affect the cyber world. I think that makes sense. So as far as use of the forecast, I mean, it's kind of a traditional and probably a very softball question. How can clients use the forecast? Or actually in a spicier version, as Tim would say, what gets better once you read it?

Okay. So a forecast document like this can help while clients are thinking about what are their objectives for the next year. Here at Google, we use the OKR system. Other organizations might have different ways to set out their objectives. for the next quarter, the next year, the next couple of years, it should help them to be able to prioritize. Like, what do they consider a high priority goal? Are they potentially not considering as high priority enough?

Hmm.

An analysis like this can help clients to adjust the emphasis of different issues or help to convince other stakeholders that No, guys, we really need to tackle this issue because it is a growing threat. And I'm sure we're all familiar with organizational negotiations when you— your InfoSec team works within its purview and it can make decisions and put out initiatives and set out goals on its own. But at some point it might need resources or buy-in from other groups and having the evidence laid out like this. As this is not just a one-off event, this is a pretty large-scale trend that we think is on an uptrend versus downtrend. It can help bring ammo to the table when they're trying to convince other folks that, no, this is important, we actually need to take action on this.

So I really like this answer because it reminds me of what— I think it's Eisenhower who said this— that, you know, plans are useless, but planning is indispensable. The point is not that we're predicting any one thing correctly or not. The point is that we have something that forces us to think and reevaluate and help us communicate with our stakeholders. I like that a lot. I want to maybe push on, you know, this being the Cloud Security Podcast and ask, what's the forecast for cloud environments? It says in the paper, I think we've got a quote here, cyberattacks targeting hybrid and multi-cloud environments will mature and become more impactful. What does that mean? Does that mean bad guys are going to get better at cloud?

Yeah, they are. They're already getting better at cloud.

Oh no. I hope they don't listen to the show. Bad guys, stop listening.

That's right. Put a filter on, Tim. You should like put a flag, no bad guys.

That's right.

You can like consider it a new CAPTCHA.

Yeah. You must be this good to listen to the show. Select all the images of puppies.

Yeah.

So, what does it mean? What are we going to see in cloud?

So, you would be hard pressed, I imagine, to find an organization that doesn't have some part of its enterprise network in the cloud, right? So, cloud is where the data is. For probably the majority of threat actors, they don't care whether the data or the access is in the cloud or on-prem. They care what they can get access to with the foothold that they've gained, right? There are some threat actors that do specifically target cloud, and those are concerning, and they range from what we would normally consider somewhat of a nuisance threat, crypto miner infections that are fairly simplistic to operate.

Yeah, of course.

But can have quite a large impact on an affected organization, to threat actors like APT29, which has been the poster child for really sneaky manipulations of the authentication mechanisms that operate between cloud and on-prem environments. But in addition to APT29, we're seeing Iranian threat actors regularly interact with cloud assets. We're seeing In this past couple years, a couple of really interesting Chinese incidents where, for example, UNC4841 exploited a zero-day in the Barracuda ESG device. We saw Chinese threat actors steal an MSA key and use it to forge tokens and ultimately allow access to US government agencies. These are pretty impactful campaigns. And as well, we see actors like FIN11 operating a huge campaign targeting the MOVEit managed file transfer software.

That was a big one.

Yeah. And FIN11 didn't care that this was a cloud asset. They cared that they had access. They cared that it was essentially an edge device so they could directly access the files that they were looking for on that device. They didn't have to traverse the network. and work harder to find data of value. They could operate faster. They could get in and take the data they wanted within minutes of getting access to the device. And it was a pretty neat and tidy operation that allowed them to affect many organizations in a single campaign.

Interesting. So that means that we should expect a lot more fun action in the cloud because not only attackers are— threat actors are growing their cloud skills, There's a lot more things to fish for, so to say, in the cloud.

So, and you can get really interesting scaled impact that way.

Yes, correct. It's kind of cool. And not just crypto miners, as everybody kind of like, everybody's mind jumped to that.

I read, speaking of crypto miners real quick, I read a fascinating piece on Kim Zetter's blog just last night about something that looked like a crypto miner but was much more. So I will share that in the resources for listeners and they should check out When a crypto miner isn't just a crypto miner.

Yeah, I think I recall that case too. So I think the other cool thing makes an appearance, namely AI.

Oh, no.

And it's also kind of hard to predict the future here, especially if you go back to, say, October last year. A lot of AI predictions would look very different. So we do say that LLMs and other GenAI tools would likely be developed and offered as a service by attackers for attackers. So I'm thinking more of a software as a service offered by the attackers for the attackers, like malicious soft as a service GenAI. So do we really expect attacker-run models? Like, how would they train them? This sounds really logical but also kind of far-fetched at the same time. I don't know.

Yeah, so I don't think it's that far-fetched. Currently, we have seen threat actors advertising access to like slightly modified interfaces for existing chatbot-type tools.

Mm-hmm.

So in some sense, the model is already there. How effective they are, like, are they gonna be able to successfully maintain access and continue dodging the controls that are supposed to be catching evidence of malicious use cases? That remains to be seen. But I think over time, the threat actors will start figuring out how to make generative AI tools very effective for their operations. They can make defenders as well as attackers much more efficient in their jobs. There are many different potential use cases. It does take some work, though, to make it work. It's not magic. You can't just, like, do one query, and then magically you have a giant phishing campaign that will be as successful as something that you could have crafted.

Which matches perfectly legitimate use of AI by the good guys. Like, if you expect to solve this big business problem by just giving one prompt and this is solved, No. So basically the same for the bad guys. That's very, that's very predictable.

Right. And then the bad guy software as a service model is well established, right? We've been watching this particularly in the ransomware ecosystem, but this exists for— exploit kits have been around for how long? You know, at least the past 10 years. I'm dating myself, maybe.

I think we're all dated around here at this point.

I mean, I, I make more jokes about the '90s than other people, so I guess—

Anton makes jokes whose relevance was over before I was born.

Not, not that harsh. Sorry.

So yeah, I don't think it's that far-fetched. We've seen prototypes of this. We know that the threat actors are definitely capable of specializing and monetizing that particular stage in the, the attack lifecycle. And so if they are able to build or customize or do additional training on, and like an open source model to their particular purpose. Yeah, I think it's possible that this could be a thing that we see.

So, one of the big things I'm looking forward to in 2024, and by looking forward to, I mean maybe looking forward to the same way I look forward to going to the dentist, is elections. What's the cloud election security threat forecast intersection?

Okay. We do definitely expect to see cyber espionage operations that are seeking to understand intentions and potential impacts to nation relationships or even particular individuals being the heads of cabinet ministries and things like that. This kind of targeting can happen and can affect cloud, you know, workspace type systems, but it's not a specific to cloud type threat because the threat actors again are going after the person. They're going after what's inside the person's head and what evidence of that is in their technology. So that may be in their iCloud, it may be in their Google Drive, it may be in their email account, it may be elsewhere that the threat actors will try and gain access to that. So we do expect to see nation states trying to figure out what's going to happen in the election. We expect to see plenty of information operations, including uses of AI. So AI to create images, AI to create videos, AI to craft text that is more human sounding and a better translation than they could get from another machine translator. So those AI-like functions that they're using probably use cloud compute assets to make that happen. The storage of the social media platforms that are sharing these images and disseminating them to people also likely rely on cloud.

Mm-hmm.

Some of the most impactful operations that we've seen affecting like media organizations or political parties or candidates around elections have been more hybrid. Espionage and information operations like hack and leak operations, falsifying materials and claiming that they were leaked from a particular politician. We've also seen foreign threat actors presenting themselves as domestic partisans seeking to organize protests or even intimidate voters. And so similar to cyber espionage and other information operations, these things can touch the cloud in different ways. But are not necessarily specifically targeted on cloud.

That makes sense. But I mean, ultimately, influence operations are kind of high cost, high volume, which means to scale, probably cloud use would be likely. So it's almost like they would be the— it's not attacks against the cloud, they would be using cloud in a quote unquote legitimate manner. They would use the benefits of cloud computing to achieve their malicious goals.

Right.

Roughly, that's what I'm hearing.

Okay.

That makes sense.

It's another form of abuse. Yeah.

So I wanted to continue, and I want to sort of pick on a googly theme of something positive and, you know, beautiful. So do we have anything that report indicates is going well for the good guys, for the defense? Like, tell me maybe something, some badness decreased that would qualify. Anything would get better in 2024?

This is the part where you get to be optimistic, hopefully.

Yeah.

Yeah, I think Tim started this question. I'm pretty sure. Definitely not me.

This feels like a me question.

So, I would first point to, we've been talking a lot this year at Mandiant about threat actors finding sneaky ways to evolve tactics to evade detection. This includes things like using botnets to proxy traffic between the command and control and the victim. Or sticking to edge device compromise or implementing tactics to evade detections or implementing tactics to specifically trigger detections, machine detections, so that something doesn't get investigated by a human and then get discovered for the full scope of the malicious activity that's involved in the threat activity. So why are the threat actors trying so hard to evade detection? It's because detection is working. It's not perfect. It's not in every case. Every organization should definitely be stress testing their setup and making sure that they are continually making sure that it is configured properly and that they're closing all the gaps and doing all of the updates. But we see this happening in our top-tier threat of actors, that they are coming up with very clever ways to still get into organizations despite detections. We also see that in our incident response investigations, if we look at them on aggregate, the initial infection vector is no longer phishing. The top initial infection vector is not—

Exploits.

Yes.

What is it now? Exploits?

Yes, exploits.

But it's a little counterintuitive, though. Does it mean we improved humans more than we improved the tech?

No. So we do see that social engineering is still quite effective, right? So UNC3944, aka Scattered Spider, has been very, very effective at using SMS phishing. And we have other threat actors doing business email compromise where essentially it is a social engineering engagement largely over email, but also in chats and in social media. So phishing is still alive and well. Social engineering still works on the human And I do think that email detections have been improving, and that's why we're seeing it sort of decline as a proportion of overall intrusion vectors for the investigations that we're doing. But we do see other infection vectors being explored with greater emphasis, and exploits can be very effective depending on the exploits. But we've also seen a lot of infected USBs. Hmm.

Well, I hate to do this because it's fun to predict the future and it's fun to talk about things that are getting better, but I have to ask our traditional closing questions. One, aside from the report, which we will of course link to in the notes and the promo and all that, do you have recommended reading for the audience? And 2, do you have a tip maybe to help people improve their planning or future prediction skills?

Let's see. For recommended reading, I would suggest the Mandiant Ransomware Hardening Guide. for any organization that this is something that's probably good to review, given that ransomware and data theft extortion are threats that are growing and they're prevalent across geography, across industry. This is something that every organization should have a plan to respond to. Mm-hmm.

Mm-hmm.

For a tip on how to use this information, how to use forecasting, I would go back to what we said at the beginning, that InfoSec is an island or like a piece of an organization, but to really create good security, you need to talk to and have buy-in from your executives and your partners throughout the organization that it needs to be a whole team approach to really be successful.

I really like that answer. So often it seems that people in InfoSec get into it because they like the nerdy aspects and get promoted and get promoted and then don't develop the people skills. And it does us all a disservice because, at the end of the day, it's a team sport. And so, Kelly, with that, thank you so much for joining us today.

Yeah, thanks for having me.

And now we are at time. Thank you very much for listening and, of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton_Chuvaikin and _TimPico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode. Security.

Security.