EP207 Slaying the Ransomware Dragon: Can a Startup Succeed?

Secure running. Hi there.

Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the Senior PM for Risk Analytics and Cloud Threat in Google SecOps, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us, and the rest of the Cloud Security Podcast listeners on our Google Cloud Security Community page. Without any further ado, let's turn things over to today's guest.

And today our guest is Bob Blakely, co-founder and chief product officer of Mimik. Welcome to the show.

Thanks very much, Anton. It's good to see you and to speak to you.

I think it's good to see you after 10 years. How many years? At this point, I'm kind of a little nervous to reminisce, but maybe you can try.

Yeah, I have no real sense of time, but it is good to know that there is an honorable and productive life after Gartner.

Yes. I mean, in your case specifically, you had a pretty stellar career after Gartner, and you still have a pretty stellar career. So I guess people who are interested can look you up on LinkedIn, right?

They can absolutely look me up on LinkedIn or even just Google, and it doesn't even matter if you spell my last name right.

So actually, the whole spelling your name thing, I think I did try it 3 or 4 times, and one time fairly recently. So I'm embarrassed to admit that. So yes. And by the way, Google does work even for me.

It does, but you shouldn't feel bad about it because 3 generations back in my family, there were 3 children of my great-grandfather, and they had all 3 spellings of the last name, E before the L, E after the L, And E before and after the L. So I think it's our fault.

Okay. Yes. My mind is a little blown from that. So you sort of have 3 family names over the history, but wow. So another piece of old news is ransomware. So wait, is ransomware old news? Or— so before I start rambling too much like former analysts we are, tell us about the ransomware problem. Some people feel like it's so 2015.

So of course, there is no new thing under the sun. And ransomware, in one sense, is just the transposition into the electronic environment of protection rackets and extortion that has happened in the physical world forever. On the other hand, the ability to extort people at a distance and circumvent the controls of the financial system make it a lower-risk business for the ransomware actors than extortion has been traditionally in the physical world. And I think that's probably one of the reasons that ransomware has been getting more and more severe over the last decade or so, because it is sort of the fastest path to cash out While still avoiding encounters with the police.

So I have an embarrassing revelation at this point because probably around 2015, maybe when I still was at Gartner, I had a pretty fierce argument with somebody at the Gartner Security Summit. And that person was kind of arguing that ransomware would be a big deal. And I was telling him that, no, stealing credit cards is the better criminal business. And I Maybe even before 2015, and basically this person was convincing me that no, no, no, ransomware is going to be big. And I'm like, but monetizing sounds like a risk. It's much cleaner to sort of steal credit cards and then sell them on the black market, and you never have to deal with victims and all this other stuff. But the person basically tried to argue passionately that ransomware would be something to fear, and ultimately I have to admit now I forgot who that was, but that person was right, and ransomware did grow to be a very big deal despite this. challenge of dealing with victims and monetization challenges. So is it because of cryptocurrencies or what made ransomware the big deal?

I think it is largely because of cryptocurrencies. And back in 2015, I almost certainly would have argued on your side because no one is more surprised than me that cryptocurrency is sort of still around and manages to be a viable channel for the exfiltration of the proceeds of crime, I would've found that implausible. I still find it a little surprising that cryptocurrency is as popular and prevalent as it is, but I do think that cryptocurrency is a big facilitator, both of avoidance of controls in the financial system and also of avoidance of legal accountability by people who live in non-extradition jurisdictions.

That makes sense. And I think that it's almost a little scary that it became such a layer for enabling it. Basically, I think both you and me at this point, you after studying ransomware for a long time and me without studying it for a long time, kind of being a casual observer of that, kind of concluded the same thing, that if cryptocurrencies weren't a thing, probably we won't have ransomware at all, like flat out wouldn't exist.

So it probably would still exist, but it wouldn't be nearly as prevalent a problem, I think. I think the friction in monetization would keep the problem much more under control if we didn't have essentially cross-jurisdictional cryptocurrencies.

That makes sense. And I think that— let's talk about the unique aspects of ransomware. To me, one thing that surprised me back in the day when I was asking other people about ransomware, there was this whole debate about, is ransomware malware, because some people prefer to think of it as ransom ops, when it's about the criminal group breaking in, doing stuff, and then, yes, using malware and other tools in the process. Because the motivation for this debate was that roughly several years ago, many anti-malware vendors claimed 99% detection rates for malware, but ransomware epidemic was just ramping up. So, it sort of like made no sense to a lot of people. They claim at least in tests, high rates of stopping malicious software, but then this one kind of malicious software became a big deal. And then somebody reset my brain a little bit by saying, it's ransom ops, not ransomware. So what makes ransomware unique? And do you buy this whole ransom ops, ransomware, not malware thing?

So I guess I'll give 3 answers to one question here.

Perfect. That's perfect. That works really well.

So the first is ransomware is not just malware. It is also ransom ops. Ransomware operators do sometimes use binary malware, which is specifically crafted for the ransomware operation. And in particular, that tends to be the piece of the ransomware operation which does the encryption and the exfiltration of the key. On the other hand, there are ransomware operations that don't encrypt files at all. They just exfiltrate data and extort you with disclosure extortion. Those frequently don't use any custom-crafted tools. They frequently use tools that are already present on the system or tools that are created by legitimate commercial organizations for legitimate purposes, but can be repurposed to dual use by the ransomware operators. In terms of defenses and, you know, 99% detection accuracy, at a previous employer, I actually tested a bunch of those packages, and the 99% figure is largely accurate. Right? So it really is true that modern anti-malware solutions discover the majority of malicious— I mean, the very large majority of malicious binaries on most systems if you just run them out of the box. But there are 2 issues with that. The first is that what happens after detection frequently requires essentially prioritization, disambiguation, and response by humans, right? So you get an alert in the SOC, and the SOC takes, you know, 10 minutes or an hour or something like that to execute a full-cycle response. And if you have ransomware that's trying to encrypt a system, it proceeds typically a lot faster than that, right? So the fastest Ransomware will encrypt everything that it cares about on a target system within a couple of minutes. So if you have a single failure or if you have a single slow response, you still get hurt. And then the other issue is, you know, essentially noise. And I'll come back to that later. But really, when you ask what makes ransomware a unique problem, What I would say is not that it's unique because it has, you know, a different binary signature or it's harder to detect or anything like that. I would say that the thing that really differentiates ransomware from other kinds of malware is that it deliberately inflicts suffering and, you know, real risks on Just regular civilians, right? So people who are trying to fill up their cars at a gas station or people who are trying to receive medical care at a hospital. And of course, that's part of the economic equation, right? The ransomware actor wants the victim to feel a great deal of urgency to pay and to pay a lot. And one of the ways that they create that sense of urgency is to create a lot of, you know, very real suffering on the part of people, you know, who will be observed by the public. And I don't think there's really another kind of malware that does that. And that's one of the reasons, you know, you're, you know, you're going to ask me later what made me personally want to get into this space. That's really my primary motivation is that a lot of the things that we do in security are sort of technical countermeasures to technical threats where the consequences are maybe not necessarily felt by people who aren't in the industry. This one really creates a lot of acute issues for people who are essentially just collateral damage. And it's hard to look at that as somebody, you know, who, you know, has technical capabilities to design countermeasures and not want to do something.

So, not that it's my excuse to use the word cybernetic, but it has taken the damage out of the IT realm, out of the cyber realm, into the realm of physical world, normal people's lives, that type of stuff. That to you is the principal difference. And that's actually a very interesting take. I'm sort of interested in exploring more, but a little later. So, you're also solving this problem. Now, this is like maybe I put my Maybe you put your marketing hat on, and you work for a startup, and you plan to solve it, or you are solving this. So tell us how.

Yeah. So it goes back to the previous question, right? One of the reasons that conventional controls are not very effective against ransomware is because they are designed to detect and counter a broad spectrum of risks, right? So essentially every kind of malware and other malicious activity, human malicious activity, that might be present on a system. And that approach inherently comes with this problem of noise, right? So if you're trying to differentiate all the good behavior in the world which is a very large amount of behavior, and, you know, from all the bad behavior in the world, which is, because it's a Turing-complete system, in principle infinite, right? The statistical overlap there is gonna be very large. And that's why you probably aren't going to get much better than 99% detection, because there's gonna be a bunch of stuff that is in the false positive, false negative, statistical gray area that is going to require human adjudication. And as long as you have human adjudication, the response is going to be too slow to prevent catastrophic damage on a target system. So I would say that the main thing that we're doing to solve this problem that's different from what other people are doing is we are on purpose ignoring every form of malicious behavior that isn't specifically ransomware so that we can be much more accurate and much faster in the response to ransomware specifically.

So that means that the— you described this speed advantage that if you're acting against ransomware at human speed, you likely lost. But if you're acting on machine speed on all malware, you would probably miss things. So you're kind of trying to build a case that you need to act on machine speed specifically for ransomware, and then you're in good shape. Kind of— sorry if I'm paraphrasing without missing some details.

That's exactly right, except that I would add one wrinkle, right? So if you are proceeding at machine speed against all forms of malware and human malicious behavior, you will probably either miss things Or you will take action on things that are not malicious.

Right. It's not even you think. It's the fact of life at every SOC and every company. Like, it's kind of like, it's just the Fact with a capital T, perhaps.

Yeah. And if you want to automate the response, you know, missing things is obviously bad because you're going to get your system encrypted by the bad guys.

Yeah.

But acting automatically on a false positive is also potentially pretty bad, right? Because what you're going to do to respond to, for example, an attempt to encrypt all the files on a system is you're probably going to suspend operation on the system so that changes can't be made, right? Because that's the way that you prevent integrity damage in today's system architectures. And what that means is that you're essentially taking the system out of service. Well, if you do that a couple of times a year for a critical system, that's pretty bad, right? I mean, and so if you're going to take automated action at machine speed, you need to have confidence that you're very, very accurate.

I mean, that makes sense. I mean, of course, how you act and what you act on still becomes a bit of a challenge, right? Ultimately, if you say we're going to act at machine speed, and then you produce false positives, then people hate you even more than if you miss things. I mean, we went through that with malware, with IDS in your childhood.

So, I mean, actually, I'm older than you think, but my youth, let's say.

Yeah, okay, fine. IDS in your youth. And so, yes. But so, here's the side problem to this. So, if what you're describing Sounds logical in retrospect. Well, after you described it. So, is startup really the best way to solve it? Because I think to really make a dent, you need to have a massive deployment base, right? So, shouldn't somebody like CrowdStrike or Microsoft solve this? One of them has a large, as we learned recently in the news, deployment base. Another one has the whole OS going. So, is the scale of deployment necessary? But then also, let me add a twist to this, if I may. Presumably, you'd argue the startup can solve it because the existing tools have not solved it. It's a fact, right? So why haven't they?

So let me answer the first question first, and then remind me if I forget to move on to the second one. I would say it depends on what you mean by solve. the problem, right? Okay. So if by solve the problem, you mean make ransomware disappear from the landscape of IT entirely.

Yes.

That is probably not something that a startup can do out of the gate, right? I mean, a startup could grow up to do that, maybe. But there are other definitions of solve the problem, right? And, and really, I think the way I would like to think about this is there are corporations and there are business functions which are highly critical to society, right? We found out that Colonial Pipeline was critical to the delivery of gasoline to the entire East Coast of the United States, right? A startup can certainly solve the problem of, of protecting a couple of critical applications at a reasonably large number of consequential corporations, and thereby protecting a whole bunch of people out in the general population against disruptions that are really material in their lives. And that is— and number one, that's what we're trying to do.

Mm-hmm.

And number 2, you know, that is enough of a bite out of the problem, you know, that it can give you a platform for addressing the long tail of exposure in other environments going forward. So I'm not going to say, you know, that we're trying to eliminate ransomware from the face of the earth in the next few years, right? What I am going to say is that we're going to build a capability to protect a designated set of critical applications against impairment.

Right. And I think that does count as solved. Of course, yes, you're right. I maybe pushed it too far by saying disappear worldwide. But even if you show up and say, hey, I'm a vendor of this tool, and if you buy my tool and deploy it, these applications probably would not suffer from ransomware no matter what or something? That's a pretty hard case to make, but I think that you would be making a big dent if you do that. That's good enough. That's solved because ultimately we don't have anything of that sort today. We have ways to go after it, but we don't have the way that more or less guarantees good results. Sorry, that's a fact, right?

Well, I mean, I think, and again, maybe we'll return to this later, Back in the '80s, there was a theory that we were going to develop systems which were demonstrably secure in the sense of a mathematical proof via high assurance evaluation.

Rainbow bullets and stuff, right? Rainbow series.

Yeah. And we did not ultimately go down that path. So, so we are where we are in terms of the baseline integrity of the environment, and we have to operate in that environment. So the idea that we're going to completely eliminate a class of threats is not super plausible because it just, you know, the economics of it are too daunting, right? But—

Yes.

The mode of operation of the security industry today is based on risk prioritization and risk management. And I think There's good evidence that ransomware is a very substantial risk to consequential corporations. And what we want to do is we want to turn it into an ordinary risk instead of an existential risk.

That makes sense. And by the way, I love your point about eliminating classes of problems because I've used to challenge people with that question. And many years ago, somebody stood up and said, Yes, I can, Anton. I have a threat factor, a threat scenario that is completely solved. And I just froze in place and he said, data theft by stealing typewriter ribbons. At which point I was like, you win. This is really solved.

It probably is functionally solved, although tomorrow we will read that somebody in the basement of an intelligence agency was still using an old typewriter and it got stolen, and therefore, you know, something happened. Just because if you say something like this out into the ether, you always get a counterexample because the universe loves to laugh at us, right?

Fair point, too. That is a fair point. So another thing I want to discuss is that ransomware and this whole situation around ransomware is kind of a symptom of a larger problem. At least you implied to that in large discussion. So what is that larger problem? And if it's cryptocurrency, I'll cheer, but if not, I'm super curious to hear what it is.

I would say that cryptocurrency is a facilitator, but it is not the problem that ransomware is a symptom of. I think ransomware is a symptom of the fact that the security industry from the beginning, from the time of the Anderson Report, Mm-hmm. Back in 1972, I think, got the priority order of confidentiality, integrity, and availability wrong. So the right order for those is that integrity should be the highest priority, because if you can't guarantee the integrity of your defense mechanisms, then none of the other properties can in principle be achieved. So I would say that what we have signally failed to do as a security community over the last 50 years is to focus on integrity first, availability second, and confidentiality after the two of those are assured.

Whoa, that's drastic. That's That would be like almost like blowing everything up and starting from scratch.

So yes, that's right. I mean, so if you know a little bit about me, you know that for many years I have been advocating blowing everything up and starting from scratch. And I don't do that just because I enjoy explosions, right? Although I will plead guilty to that too. But I think it is pretty clear That the fundamental models, you know, that we have built for securing a very complex world in which everybody is connected to everything are not keeping up with the threat environment. And so, you know, reconsidering some of these foundational assumptions is probably warranted just on the basis of the difficulty that we're encountering operating the solutions that we have built.

I think it makes sense. And I think that, well, if we had another half an hour, I would probably ask you— well, you know what? I really do want to ask that. So, we are both somewhat jaded and maybe a little cynical from doing this for quite some time, maybe me more than you, I don't know, maybe you more than me, who knows? The point is that I'm trained to think that any solution that involves blowing things up and restarting is going to fail because of inertia. It's almost like when I left Gartner and I wrote my lessons from me being at Gartner for 8 years, my number one lesson was IT inertia is the strongest force in the universe. People will say, we're going to use Windows NT in 2024 or something. Stuff from the past is still with us. So, what would you say to that? If you say, well, we need to redo things, and they're like, stop, When you involve redoing rather than applying duct tape and Band-Aids, then it won't work.

Against that, I would argue that you don't throw everything away and the next day wake up and start over. Instead, what you do is what Clayton Christensen suggests in his book, The Innovator's Dilemma. And you figure out what the right next model is, and you apply it to a particular limited problem scope, which is ripe for disruption. And then you expand the deployment base of that new type of solution beyond that limited scope to other scopes until it eventually becomes the dominant So, I think—

Exploding, but gradually. That kind of— Yeah. We do everything, but slowly.

Yeah. So, the future is here. It's just not evenly distributed yet, right?

Okay. I would take that. I think that's the best counterexample to, oh, if you're doing it, it won't work, that I've ever heard. So, given limited time, what made you personally get into this space? You could have stuck to identity management. Sorry, Bob. This is like a comment I had to make, and now this is the perfect chance. What motivated you to go and, you know, fix ransomware?

You know, so it's funny, identity management. So I guess I started working on identity management back at the time when I took over the chairmanship of the SAML committee. But by that time, I had already been working on security in a commercial context for like 15 years. I started out doing communications protocol, you know, cryptographic protocol security, operating system security for OS/2 and AIX. you know, designing secure operating system kernels, helping IBM run an orange book evaluation process for OS/2. So in a sense, I'm coming back to a bunch of things that I did in my career before I ever got into identity management. And in terms of why work on this particular problem, I think it does go back to what I said earlier, right? That the The problem really affects ordinary people in a way that other security problems that are experienced by big enterprises don't necessarily do. And I feel like at this point, I mean, I've been working on security for 48 years. I've learned a couple of things along the way. And if I'm going to apply all of that to one more problem, it felt like the right thing to do.

Yeah.

to pick a problem that really had an impact on people outside of the data center.

I think that's motivating. That would be motivating. In essence, ransomware is the thing that crossed over from the digital realm. And I think that's kind of— maybe that's the thing that the original cyberpunk sci-fi writers were warning about. It's not the virus that goes into your mind. It's the type of malware that hurts you if you don't use computers. Like, kind of, maybe I'm overdoing it and I'm going too far into the field, but you're right. If you don't use computers, you can still suffer from ransomware. You wouldn't suffer from, oh, my Windows crashed. Well, in this case, the harm is outside of that realm. So, traditional closing questions. One tip, I guess, on fighting ransomware. If you want to be, you know, cheap and cheerful, you can say, buy my tools, but it would be kind of boring. And one piece of reading. It can be anything. It can't be Anderson Report. I'm adding this one to the notes already because some people would be super impressed by some insightful piece of cyber reading from 1972.

So if I were going to give a tip, it would not necessarily be about ransomware in particular, right? So maybe for my fellow security practitioners rather than for the general audience, my tip is, That ontology is the enemy of security, right? So ontology is the philosophy of enumerating the collection of things that exist, right? So this is a fancy way of saying that what always kills you in security is your assumptions, and in particular, your assumptions about things that you don't need to worry about, right? So going back frequently And figuring out what you assumed was not going to happen. And maybe even taking this contrarian position that here is a thing that I believe is impossible or highly unlikely, and not even trying to figure out how it would happen, just saying, okay, let's assume that that impossible thing happened. What would happen next?

Right?

That's a super useful exercise. A piece of reading So, there are a million things that I could suggest. And so, Homer's Odyssey would always be my first suggestion for anyone, just because I was a classics major and it's amazing. But really, to stick sort of on the topic, the thing that I have read most recently that I thought was really informative was the root cause analysis that CrowdStrike published about their recent incident. And the reason that I recommend this is because people love to have reductionist reactions toward incidents and failures and what have you. The root cause analysis report there makes it really clear that this was a very, very complex failure cascade. There were 3 separate flaws that had to interact in exactly the right way for that outage to take place. And if people want to understand the complexity of a security system and all of the things that you have to get right to make sure that everything always functions correctly, it is really a very clear and interesting read.

Perfect. Thank you very much for this. I really appreciate you being on the show. And of course, it was nice to see you after all those years.

Absolutely. Great to see you again, Anton, and take care. I hope I will see you again sooner than the last interval.

And now we are at time. Thank you very much for listening and, of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton underscore Chuvakin and underscore Tim Pico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security.