Cubic’s Konrad Fellmann on Proactive Strategies for Identifying Cybersecurity Vulnerabilities

If you take any one thing by itself, nothing's hard. Honestly, security is not hard, Right. It's mostly common sense things. It's when you put it all together, right? And it's being that cheerleader, that SME, putting all that together. You're doing a lot of negotiation, really trying to figure out, when can we do this, how am I going to get money for this? I know it wasn't in the budget, but this came out and this came up and it gets hard to throw it all together, right? You're trying to juggle so many balls at the same time and there's so many different stakeholders that you're trying to deal with and everyone has a different opinion.

Welcome to the Ahead of the Breach podcast where we are dedicated to empowering security experts and practitioners with the knowledge, insights and actionable strategies to lead the future of cybersecurity. Here's your host, Casey Camilleri, CEO and founder of Sprocket Security. Now let's dive into today's episode.

Welcome to Ahead of the Breach podcast where we talk everything offensive security with industry experts. I'm your host, Casey Camilleri, and today we're talking to Conrad Feldman. Conrad, thanks for joining us today.

Hey, glad to be here.

If you could start off by maybe kind of sharing a little bit about your experience, your background, how you became a CISO and where you work.

Sure, yeah. I'm Conrad Feldman. I'm the VP of IT Infrastructure and Chief Information Security here at Cubic Corporation. We're based in San Diego. Been in this role, oh boy, a little over five years, but at cubic for a little over 12. So it's been a long time and one place I know in the beginning of my career, I started off in consulting, doing all kinds of different things within it. So my first real job was coding, so doing Java and HTML development and that kind of stuff. From there I found an opportunity to get into security. Never thought about it before, but someone was hiring, said, we'll train you up and teach you how to be a security guy. I was like, ah, that sounds kind of interesting. So it was at a consulting company and then from there, I think every couple years I found a new home at another consulting place. And one day kind of got tired of consulting and let me just try to see if I can make my own place secure and see how that goes. I think, you know, consulting, sometimes you can get frustrated where you'll go in and do a gap analysis for an organization or something like that and give them very nice detailed plans on. Here's A lot of things that you can do to improve your posture and make things better or pass your PCI audit or whatever it would be. Then you go back a few months later and see nothing happened. Like, oh, so it got a little disconcerting and wanting to try something else. But I loved consulting. I think there's so much to learn there. Being able to see, you know, hundreds of different companies, how they do things, what they do, plus the opportunities to learn. Just volunteering for different projects to do things you've never done before. Get worried a little bit, am I going to be able to do this? Because I've never even seen this before. What the hell, let's give it a shot. And it forces you to, to learn new things and build your experience. I think, you know, one of my favorite projects I did, and this was when I was really new in this firm and it was a project, it's probably going to date myself a little bit. But migrating Windows nt to Windows 2000, the whole domain and exchange and everything else, and building out the network for that, all things I had never done before. So I had like, I don't know, about an hour and 20 minute train ride to work every day. So I packed in my backpack, I had an MCSE book, I had a CCNA book and I was just reading. I think I got through those in about two weeks. Worked out. So that client had a new network. I had to physically build the racks, order all the power supplies and PDUs and put it all together, wire everything. So it was pretty interesting. I think that really got me more interested in IT and security. Just building something from the ground up, migrating all this stuff I've never seen before, hardening it all and seeing success at the end. So I think you have to be willing to go out and just figure things out. Right? You can't always just rely on someone else to have an answer. You got to go figure it out if you want to continue on and better yourself and move forward and go to the next level.

Absolutely, absolutely. I think being a security consultant is awesome. You get to see all those different environments like you said, and that really kind of improves your experience at a really rapid pace. But the hard part is, is where you're at right now, right where you actually have to implement these things. As a consultant, you could say you should do X, Y and Z. And it's easy to walk away and go to the next client, say you need to do X, Y and Z. But you know, the reason why nothing's changed is because it's really hard. So, you know, fold that back into your position right now. You have a lot of hard things to do. And, you know, Cubic is in the defense and transportation. Is there something in that industry that specifically difficult for you as a CISO to navigate unique challenges in that industry?

Yeah, I think if you take any one thing by itself, nothing's hard. Honestly, security is not hard, right. It's mostly common sense things. It's when you put it all together, right? And it's being that cheerleader, that SME, putting all that together. You're doing a lot of negotiation, trying to figure out, when can we do this, how am I going to get money for this? I know it wasn't in the budget, but this came out and this came up and it gets hard to throw it all together, right? You're trying to juggle so many balls at the same time. And there's so many different stakeholders that you're trying to deal with. And everyone has a different opinion, right? The finance guys care about how much stuff costs, right? The operations guys care that you don't impact availability of the system by doing something new. The engineers are worried about how much time they got. Can we really go back and fix this code? So everybody's got a different worry, but everybody's also looking at you to make sure all this stuff happens, even though it's not your hands on doing all these things, right? So it becomes really, there's a lot of coaching, right? There's a lot of hand holding, excessive amounts of negotiation and really training people on what these things mean, understanding what risk is, why we have this risk. So it's all those kind of political aspects, right, that becomes difficult, but make it fun and challenging. And I realized if all those things weren't going on, they really wouldn't need me either. So you gotta deal with that. So you continue to have a job and make things successful.

Right now, in transportation, you wrote an awesome article on how cars have become the biggest threat to privacy. And, you know, being in the transportation industry, I think you mentioned something like top 25 car companies, 84% of them, you know, research and sell consumer data. And that's just crazy. And if you think about them, you know, especially on the consumer side of things, we're driving around in these cars that have what, 10 cameras now, probably like five microphones, like is it recording when it's in park? You know, like these are all the threat modeling things I'm going through as a consumer because, you know, I work in cybersecurity. But like, what's your take on this? You know, is, are we at a huge threat with privacy?

With cars, I have two different takes, you know, one that I professionally say and one that I just feel and tell all my friends and colleagues, right. You know that you're being watched constantly, right? Everything's there, right? In your house. I don't want to say the word, but Alexis over there, she's listening. And whatever's going on in your car, right? Especially if you got a Tesla or something, microphones, cameras everywhere watching, right? It tells you you weren't paying attention. So you can no longer use autopilot. I'm like, what? How do you know what happened?

It's looking at your eyes, right?

That's your hand, all that, everything's staring at it. And with, you know, gen AI and things coming out, it's probably get even more like that. And these are things we look at, especially on our transportation side. The main thing we do in transportation is fare collection for mass transit. So you'll find our systems if you're in New York, London, Louisiana, Chicago, Vancouver, Sydney, Brisbane. So many large cities around the world are using our systems and the one thing ensure we don't do is use data for any other purpose than what we're collecting it for. So we're not sharing data, we're not selling it with anyone. We're not even giving the majority of our folks access to it unless you absolutely have to. You're one of the administrators of that system or whatever it might be. It's one of the things that privacy is just going through the roof with so many different countries and states and cities creating all their own rules, right. Once GDPR came out, it just became crazy with the level of regulation around the world that we deal with from a privacy perspective. On the other side, what I know myself and I think, what I tell a lot of my friends, just your data's already out there, right? Someone has a pure personal sensitive data, it's gone, right? It's on the dark web. People know your Social Security number, they know your address, they know your phone number, they got your email address. That's why you get all those spam messages all the time. Your data's already gone. It's so it's now trying to just protect, you know, what is that really critical sensitive stuff that you have now and putting the onus on the companies that have that to do that for you. So trusting who you share your data with and if you're untrusted to protect somebody else's data, pulling that to heart and treating it like you would if it was your own.

Yeah, it's getting everybody on board with that approach too. Right. You know, from a company perspective, from the consumer, you know, personal perspective, you're right. Like your data is already out there all over the place. Right. So you just kind of be mindful of who you share with and what. But you know, our data is everywhere and it can be sold, it can be used and things like that. So when you're say, at cubic, you know, how do you build that into the culture of hey, you know, the data that we're going to collect is going to be the data that is needed to either provide services or enhance the product or something related to the reason of why we're collecting that data versus just collect it all and sell it. Right. So are those conversations, are you driving that culture? Is there anything our listeners can take away if they're having some of those same internal conversations or struggle of like, hey, let's collect it, let's sell it, let's make revenue off of it. And it's kind of like, ah, the security side of me says we shouldn't. How do you handle those?

Yeah, I think, I mean it starts with our customers. Right. And the contracts that we have, we review those very thoroughly with our legal team and contracts team and everybody else to make sure we're only doing what it states in that contract. We're not using that information for anything else. I mean we have millions of riders going through these systems every day. There's millions of riders passing through. Right. Whether you're tapping with Apple Pay or using your contactless credit card or buying a ticket or whatever it may be. Right. You're only the reason you're using. You just need to get from point A to point B. You shouldn't have to worry about what information is going in the system, what's happening to it. Right. And that's the way I look at it when we talk to our team is where we make sure that you only have the least privilege access that you need for that system. We do continual access reviews to make sure people only have what they need and are only doing what we need they're supposed to be doing. You know, looking at where our data is flowing, where it's going, making sure it's staying where it's supposed to be and not being exfiltrated, whether by a user thinking they're trying to make their own life easier or through other more malicious ways, but you know, keeping a continual eye on that to ensure it's only staying where it's only being used for what it's supposed to be used for. So different things come into play. Encryption and hashing and everything else that you can do to try and anonymize things as much as possible. But for our systems mostly you have to have that data, right? So you know who the person was, you know, just to charge them for, you know where they're going. So you can't really anonymize everything. You do have to have the information so you're properly billing people and things like that.

Nice. Great insights. Would you think about building a team and culture in cybersecurity at your corporation? What's your strategy? What do you look for?

Yeah, really? People that can be self sufficient, people that like to learn, people that like to grow. Yeah. I think I see two types of folks kind of in my career as I've been going through when I started to now. And there's the folks that they get a job and they just do what that job description said, right? Just going to do exactly what it says, no more, no less. And that's it, I'm doing my job. And then there's folks that like to learn, like to go dig in, like to figure out how something works, like to get outside of their own wheelhouse and expand their horizons and just try and help out more. And those are the folks I like right now. I wouldn't be where I am today if all I ever did in that first job was just what the job description said, right? I like to get out, learn different things, figure out how different projects work or different products work. Figuring out on my own how to configure that firewall or that Exchange server or harden that Windows system or whatever it might be. Right? But I like the people that know how to Google, right? Google's your friend. Get out there. All you got to do is go search, right? You know, if you're somebody that gets to a place that I can't figure this out and you give up or all you do is send a bunch of questions to somebody else on the team, how do you do this without ever trying to figure it out? That's not what I need. I need people that are going to go figure out how to do things on their own, right? That like to explore, learn and really make a bigger difference, right?

Yeah. It is changing so fast, rapidly, right? Everyone in their cloud environments, it's all dynamic DevOps, right? All of that. You need people that can keep up with that. Both from the learning perspective, as well as, you know, just being resourceful. And that's one of the things that we look for as well, you know, kind of like from the offensive side. It's like the hacker, right? The hacker needs to be able to learn that new trick, that new technique, right? And they need to be resourceful in doing it. So those are great key things. So if you're looking to get a job, you know, that's. Those are wise words. What about AI, though? Everyone's talking about AI, right? AI this, AI that. We have been for way too long, unfortunately, and sadly, I'm going to contribute and by asking you the question of, like, you know, how is it, at least in your industry, how is it shaping the defenses that you guys are doing? What's the impact on AI in defense and transportation?

Yeah, I think there's the two sides, right? One on how can we leverage AI to do better, and the other is how are the attackers leveraging AI to also do better? Right. You've noticed, I think if you go past the past year, right, when is it last year, every conference you went to or every security discussion with AI, I really got sick of it because it's annoying that everything people were talking about was AI, AI, AI. And it's all ChatGPT that started that, right? I love ChatGPT, right? It makes it easy to do performance reviews, write policies, figure out some query to use in Azure ad or something like that. It's made my life tremendously easier. And going back to that, how do you figure out how to do stuff on your own? Perfect way to go figure out how to do stuff on your own. Hop in ChatGPT, ask it to be a Palo Alto expert, and then give it some questions. It'll tell you exactly how to do it. But one thing we've noticed is, say, phishing messages, Remember, it used to be in broken English and they weren't really using words or sentences, right? And there'd always be some misspellings and things. They fixed themselves, right? They can go to ChatGPT and make that phishing email sound so much better, right? That it doesn't sound like it's coming from some dude in Russia that has broken English. Now it sounds like it's from a normal American guy. Say, if you're in America and it sounds perfect English and very professional, and it's just easier to trick you with those messages now because, you know, the things we used to train people on, you know, watch out for the spelling and sentence structure as you're Looking at these emails, that's gone. They've worked it out. So, you know, attackers are using it that way also, you know, they're able to better construct their attacks. Right. They're probably getting a lot of guidance from all kinds of Gen AI to do better on their end. And like, what I'm saying now for the most part is a lot of the security products we're using are starting to incorporate gen AI in the products to make it easier to do things. Right. So instead of trying to remember the query language to type something in there in your SIEM or any of your other security tools, now they're making it so you can use natural language and just state what you want and it knows what you're asking. So it's making it easier for our defensive guys to figure out how to do some things that before they might have had to memorize a lot of queries or look some things up. So it's speeding that process up. I think there's lots of opportunities for AI to do a lot more of that correlation in the back end with your traditional SIM tools and things like that. So I think it's just going to kind of put our tools on steroids a bit and just, I think having that additional helper that understands what you're asking for in a easier manner. Right. That it's going to make our lives a bit easier. So I'm pretty excited to see where it goes and on our side anyway, versus the attacker side, but to see how these companies can make those improvements. But I think we're still in the early phases of seeing where it goes and how it can improve our lives.

Yeah. From the attacker perspective, it's crazy how beneficial it's been to us. You talked about social engineering and phishing. We're basically saying, hey, we know User X has this title in this role at Company Y, and let's go ahead and craft efficient email that gets them to click on this link, you know, read the LinkedIn profile for their job description of where they're at, you know, tailor it to say a software engineer or tailor it towards human resources or, you know, customer support in the industry that they work in too. Right. So like, and yes, all the spelling mistakes go away. Right. And so the attackers are using it. Like from our testing team, we're using it and it's increasing the success rate that we at least get someone to perform some sort of action that we're requesting. So it's crazy. Yeah. You know, as far as AI and things like that, beyond that how do you see the role and responsibilities of a CISO evolving over the next coming years?

Yeah, I think it's really being that person. You know, it's wearing a lot of hats and it's. I think a very important part of the job is pragmatism and being able to talk to people. Well, not just talk to people, but listening to people and understanding what they're doing. You can't succeed in this job if you don't understand the business and what the business goals are. Right. I've seen a lot, see, especially in over 20 years, I think, you know, at one point it was referred to as the department of no. Right. You bring stuff to the CISOs. No, we're not doing it. No, no, no, no. So, you know, one thing I'm trying to take out of the vernacular is we don't say no. Right. You need to listen to what the business is saying. Ultimately, the business, they're the ones making money. We don't make money. Right. We're insurance is what we are. We're not generating revenue for the organization unless you're in a security consulting company or something like that, I hear. Thank you. We don't generate revenue. Right. We're there to provide that insurance, make the customers feel happy and comfortable that we understand what we're doing and we're protecting that data in those environments. So when folks come up and they have an issue because maybe they got blocked on the firewall with something or some emails not making it through all the security controls that they really need, it's listening to what they're saying. You might not be able to do exactly what they're asking from their request. Like, I need you to whitelist this IP address or whitelist this domain or this email address in the security tool. So I get all these messages. She might not be able to do that, but you can figure out what they need and why they need it and come up with the workaround. Right. Because we have to make the business successful. We're going to continue to drive revenue and do well as a company and protect our customers. So I think that's where the mindset has to be, is that we can't just block everything. We can't just not do things. We can't just implement every single security control and tool that exists, or the business will come to a screeching halt and won't be productive and won't deliver on time and, you know, won't be able to meet SLAs that our customers expect. So you have to be able to, you know, be pragmatic about it, listen, understand what they're asking for and come up with that solution that helps them do what they need to do.

And what advice would you give to companies that are looking to improve their cybersecurity posture?

Yeah, I think a lot of it is getting back to the basics, right? Everyone gets excited about every new tool that comes out AI everything like that. But you still have to have defense in depth, right? You can't just rely on that fancy new solution that came out to protect you from every breach and thing that's going to happen. You have to train your people, right? You have to make sure that they understand security needs to be built in from the beginning. You need to get everybody on board and understanding this is for our company, right? It's not just you that's impacted, it's everything, right? If we have a breach in one location that affects the company, not just that location, because it's our reputation on the line. So it's really building that support across the board, right? That security is a core of tenant of what we do to protect this company. And it's. There's just so many components about that. So it's really being that cheerleader, right? Getting people on board, getting to understand the importance of it. But you've got to do it in the terms that they understand, right? So if you're talking to the finance folks, do it in monetary terms. If you're talking to engineers, right, do it in engineering terms that speak their language. Don't just speak your language, understand how they want to hear things and what makes sense to them. Because it's not the same message to everybody in the company, right? Everybody has a different role to play. And you got to figure out how do I say it in a meaningful way to that guy so that they understand it?

Yeah. So it's just not buying tools, is that what you're saying?

Not buying tools. But you know, I think that a lot of folks have got away from the basics, right? You still got to do your patching. You still got to get rid of the end of life operating systems. You still got to go check your ACLS or NSGs to make sure you're only allowing the right traffic in and out of the environment, right? And I think people forget that those layers of defense are there for a reason, right? Because if that one fails, say some one of the network engineers accidentally adds any rule on the firewall, on that perimeter interface, Whoops. Now everything's coming in, so you need to make sure, yeah, we have EDR and all the systems inside. We have everything configured properly. IDS is up and running, signatures are current. So you've got to still make sure all those layers are there. I mean, I've seen in some cases people like to do risk reduction for internal vulnerabilities and the only justification, they say, well, it's an internal system. Okay, it is today, but what happens tomorrow when someone screws up on the firewall or does this or clicks on that message that they shouldn't have clicked on? Right. So it's, we have to do all those bits and pieces.

And the perimeter is changing too, right?

Oh yeah.

It's like as things move to the cloud, it's not like, hey, it was internal, it's like it's somewhere else. It's not even, you know, who knows where it is right now. Right. Those primers are morphing. Right. And identity is now the perimeter as well too.

Even for our environments. You know, they used to just be. It was a back office environment. That's it. The only way you're getting in There is you're VPNing and you have two factor authentication and then you can go do what you need to do. But now, you know, as things change, more people are using, you know, mobile apps, things like that. Now you're exposing more APIs and you are, you do have exposure, right? Those APIs talk to something in that back office. So you have to make sure all those layers work, you design your code properly, wafs in place, everything else so that you're protecting yourself at all those layers. Yeah, the attack surface is just crazy now because no one's just an on prem environment. Right? Everyone's using dozens, if not hundreds of SaaS apps in their organizations. Do you know where all your data is going? Do you know how many SaaS applications your organization's using? You know what have you authorized? What haven't you? Do you really know where all your company data is with all the applications that exist out there? It's just by tenfold at least is what that attack surfaces change in the last 10 years.

Yeah. And it's crazy at the pace that's changing now too, because of, you know, everything like DevOps and cloud and it's just, it's crazy. It's not. We push code once every two weeks, we push 20 times to production in one day. Right. And so it's easy to accidentally expose that API endpoint that you, you didn't plan on doing. It's even harder to actually identify that it was accidentally exposed. Right. Is there any like proactive things that you guys do to identify weaknesses and vulnerabilities in all areas of your environments?

Yeah, I think it starts from again, we have nice tools that help us, you know, as we're say, developing something new that help generate what the security requirements should be for that. Right. To help model what security should be so that we can provide that to the engineers and ops folks ahead of time before they start thinking that the thing is ready to deploy. Right. So thinking about security from the beginning. But all those other things, all the routine things people should be doing, like all your routine vulnerability scans, making sure you're taking care of that stuff, periodically checking your ACLs to make sure no one made some weird mistake. We are ISO 27001 shop. So, you know, making sure you're continually compliant with your controls, checking the effectiveness of your controls, make sure. Is it really working like I thought it was? If we put it in place, you know, six months ago, anything change, did the environment change where we need to adjust things or anything like that? So it's really meant the governance side, right? Perform your continual compliance checks on your controls to make sure there. So it's not just the security monitoring of all those events that all your tools are stating, but it's validating that your environment looks the same way. It's, you know, you intended it to be so that configuration management of that. So it's all of that. And of course, you know, working with folks like yourselves on periodic penetration testing, especially if you're rolling out anything new, you want to know what's that attacker's viewpoint before we roll that out there, I want to know what that might have would say about this before I say it's good to go for the public.

Right. Try to limit those surprises. Right. CS don't like, you know, security incidents, surprises.

For me, you know, what I tell my folks, especially my GRC folks, is whenever we go through an audit, we know we have to be PCI compliant, we know we're ISO certified and do these things. We know when the audits are going to occur. There is zero reason we should have any findings when those auditors come in. Right? We should have checked everything before they came in. So if there's a major finding, it's because you all didn't do your job and validate and perform the governance that's supposed to be your job to ensure all those controls are working properly. And we're doing the things we're supposed to do. There should never be a critical finding during an audit. Right. You should know if there is, it's because you're not doing your job and understanding what your environment looks like and how the controls are supposed to be operating. Spot on.

That's probably going to be the quote or the tagline for this podcast. Conrad, it's been great. Unfortunately, that's all we have time for today. But if anyone wants to follow along with your work and what you're doing, where can they find you?

Yeah, you can find me on LinkedIn. I think I'm the only Conrad Feldman out there.

Oh, easy enough. Well, this has been an amazing conversation. I appreciate the time and thanks for joining.

All right. Thanks, Casey.

Thank you for listening to another episode of the Ahead of the Breach podcast. If you enjoyed today's episode, please leave us a review on Apple Podcasts or Spotify. If you're interested in exploring how Sprocket is shaping the future of offensive security, be to sure sure to check out our website at sprocketsecurity. Com. Thank you again for joining us. See you on the next episode.