Odyssey Group’s Mario DiNatale on Understanding Your Cybersecurity Attack Surface

I try to buy myself as much asymmetry in this cyber landscape as possible against my attackers. Right. If I spend X and they have to spend xx, that's probably a more effective control for me. Right. Because I want to effectively have them spend more time, more cycles, more money to penetrate me than I'm spending on defending. That's just me not outrunning the bear. That's me outrunning, like, the person behind me. Right.

Welcome to the Ahead of the Breach podcast where we are dedicated to empowering security experts and practitioners with the knowledge, insights and actionable strategies to lead the future of cybersecurity. Here's your host, Casey Camilleri, CEO and founder of Sprocket Security. Now let's dive into today's episode.

Welcome to the Heather Breach podcast. We talk everything offensive security with experts and leaders. I'm your host, Case Camilleri, and I'm with Mario D. Natali, he is a CISO of Odyssey Group. Mario, thanks for joining us.

Yeah, my pleasure. Thanks for having me. Yeah.

How long have you been in cybersecurity?

My whole life, pretty much. Yeah.

Like, how'd it start?

It's like the hacker kid origin story.

Basically, like getting in trouble version or.

I feel like everybody got in just a little bit of trouble, right?

Yeah.

20, 30 years ago. I mean, there was. There was no like hack in the box, right. It's like we were all playing with other people's computers, right. That's how we learned.

But 25 years later, you're still getting in trouble, right?

No, I don't have time for that. I'm too busy doing PowerPoints and Excels now. If no one tells you that's what a c. So let's talk about that because.

Yeah. You ever read Glamour of the C Suite? Right? Is what PowerPoints, spreadsheets, talk about risk and budget.

Oh, yeah, for sure.

How much time do you spend in the council, you know, as a ciso, like actually slinging code?

There's zero technical fun in being a ciso, right? Like you're measuring everything in risk, constantly coming up with, like, new ways to quantify it, measure it, you know, and explain it as simply as you can. Right? Because at the end of the day, the business stakeholders don't want to hear anything in technical speak. You're going to lose them if you do that.

Right.

Like, you got to speak the language of the business.

So you're not coming to the board meetings being like cross site scripting, SQL injection, prompt injection.

I think that's your last board meeting. If you Do. That's just not the right audience for that. Right. This is the audience for that. There was a couple great technical talks yesterday where like, I miss this stuff, you know? Yeah.

I get the same feeling sometimes. It's like, I want to spend more time doing this and that. But, you know, it's like in business that's sometimes you have to hang your hat and say, there's much better people to like sling code and do the pen testing and the red teaming. But I like to scratch my itch every now and then.

Yeah. So H.D. moore did a absolutely phenomenal talk yesterday and I'm not gonna ruin it. Everyone should just go out and see it on ssh. And it was the best talk I've seen in probably a decade. It was like the old school. Well, everybody comes here to actually type talk where he's like, we did this fun, cool thing. We found these fun, cool bugs. Here's a tool. We wrote probably some o days in it. Go have fun with it. Here's the GitHub link. Nice, right? It's like that brought me back. I love that stuff. I miss that stuff. But, like, that's not the job anymore.

That was part of your journey though, right?

Like, that is the journey. Everybody starts there. It's always a lot of fun. Somebody actually brought up to me yester they remember. Somebody came and found me. They're like, I remember when you were like 11 years old at the Alexis Park Hotel and you hacked the hotel PBX and you were playing tap cell phone like recordings or like live cell phone recordings over the hotel.

But it was like 900 megahertz or something.

It was 900 megahertz? Yeah, yeah. I had like the Okie 900 and the tablet. Right. And like ABC News tried filming you in Dark Tangent. Like, flipped out. Like, wouldn't let them film you because you were a minor. Right. And that ended up sent me the screenshot of like, when I was the front page of ABC News, whatever, defcon. That was so many years ago. So that was cool. That brought me back. But, you know, that was 30 years ago. This black hat is not that black hat did not exist then. But yeah, that talk and like, you know, that experience yesterday brought me back to that. I was like, that's the origin story. Like, that's where it began, you know?

Right. How did you get out to defcon at age 11? The hacker in here, My dad used to bring me. Oh, really?

Yeah, my dad used to get. There was a running joke. Like, my dad used to get spotted as the Fed, like every year. Yeah. Every single year. The goons were just like, guys, it's Yoda's dad.

That's actually funny.

That's a good story, man. Yeah. My dad still loves telling that story at Thanksgiving.

Really?

Remember that time you made me go out to Las Vegas and I shaved my head every year to make them think I was a fed?

Do props for your dad, man, and take you out.

Yeah. It was definitely a cool dad thing.

Yeah.

For me. Yeah.

Yeah. So as a ciso.

Yeah.

Stock business.

Let's talk. Yeah.

What do you do for proactive security, like the offensive security you came from, that journey? Is there anything that you apply as a ciso? Any methodologies, any special ways you think about it as a CISO from the offensive side?

So I think that's where that gives me a little bit of an edge. Right. Coming from that technical background, having that offensive background and thinking about risk and where our risk lies in the organization. Right. Like there's all these metrics I use, all these technical controls that I measure, right. I look at them and I say, if I took a risk based approach to this because that's, you know, I work in the financial industry when we underwrite risk essentially on our business deals. So that is the language they speak. So we actually speak a common language. I'm speaking technical risk, they're speaking financial risk. But we can meet in the middle there, right. So I'm taking a risk based approach to our cybersecurity, our technical controls, right. I go and I measure it and I take a look at it and I say, I kind of have a slightly different approach to this than most csos. Right. Like I'm not going to go out and cover the entire risk landscape, Right. Because I think one, that takes too much time. Two, it's probably ineffective. I look at where essentially bubble sort, I'd say, okay, here's our highest areas of risk and here are where I can do the most good with the least amount of spend. And then I attack all those first. Right. I try to buy myself as much asymmetry in this, you know, cyber landscape as possible against my attackers. Right. If I spend X and they have to spend X X, that's probably a more effective control for me. Right. Because I want to effectively have them spend more time, more cycles, more money to penetrate me than I'm spending on defending.

Yeah.

That's just me not outrunning the bear. That's me outrunning like the person behind me.

Right, Exactly. Exactly what I was going to Say. Right. Yeah. All right, so how do you identify all of your attack surface? Right. Because you start with that.

Right.

Or do you have a different approach?

So that mean. That's an awesome question. I think I'm still identifying my. My complete attack surface. Right. So, like, in our business, like, we acquire other businesses. M and A is part of our growth strategy. And when you go and you would acquire a business, you acquire all their tech debt as well. And, you know, when I came in and I looked at my organization and I was measuring our risk and trying to figure out our attack surface, it was a big job. It's still a big job. I'm not ever going to be 100% certain that I've got it completely covered. Now, when you go and do that with another business, it becomes a much taller task because you have to do it in a much shorter period of.

Time, requiring another business. You don't even know what they have.

And then you immediately start integrating with them too.

Right.

Which adds a whole new level of risk. And it's unknown. Unknown risk. Right.

You don't get married on the second day.

The business grows shareholder value. I exist in service to that. I just try to make sure that whatever we're acquiring doesn't end up costing us anything. Yeah. So I'm an insurance policy for my company that writes insurance and reinsurance policy.

You probably got really good at underwriting yourself.

You know what? I never thought it was something I would say is fascinating to me, but actuarial science and understanding how they model risk for all sorts of different scenarios, whether it be like, catastrophic loss and, you know, like modeling, like hurricane predictions, they know how to price a policy and stuff like that I'm finding is actually helping me get better at understanding cybersecurity risk. Because I'm sure, you know, there is no great quantifiable metrics for cybersecurity. Everything everybody's putting out as far as metrics goes, you know, they're basically like.

Despite the book on how to quantify.

So it's actually a terrible book. People recommend it all the time. But he looks at like quantitative measures. Right. And they're not very qualitative. Yeah, right. Like you can say, like the input of this, and then we got X as the output. Right. Like, that doesn't really tell you very much, actually, because it doesn't tell you how effective it actually was. It's not telling you the inside story. It doesn't tell you how the sausage got made or if you're any good at making that Sausage. Right. So I think help me understanding my business better is actually making me better at understanding different ways of measuring cyber risk. I've looked at the models, and this is the dirty, dark secret of the insurance world. They're all making money by accident. They really don't have any very good models for measuring cyber risk.

I'd love to make money by accident.

That's. That's essentially what they do. They're making money by accident. So I'm actually working with them, you know, as kind of fun data science project to create some real actual models. Because I think I freaked them out. I said, guys, especially after this whole CrowdStrike thing. Right.

We're going to talk about that.

Yeah, we'll talk about that later. Yeah. Because everybody wants to talk to me about the CrowdStrike. Yeah.

I thought of you. CrowdStrike.

Yeah.

Tell people why.

But I told them, I was like, look, we don't know actually. Or you guys don't know how many potential black swans we probably narrowly miss every day. Like, we could be close to having one of these, like every other week. You definitely don't know. I definitely don't know. Right. They came to me like, what do you know? How do we measure this in the future? I'm like, yeah, that freaked them out because wipe their books out. They don't want to take hundreds of millions of losses on the books from another one of these events.

Right.

So, like, now they have like a more of a vested interest in my little pet project of trying to understand this and try to create better models for this sort of risk.

You can share. This sounds like a great blog talk.

I really have nothing to show for right now, unfortunately. That would probably become the intellectual property of my company. But, like, I believe in being a good steward, giving back, open, sourcing what I can. But that's a conversation I got to have with the lawyers.

Yeah, right.

That ultimately is not going to come down.

You have a conversation with the lawyers. It may not go.

I would love to.

Yeah, that'd be cool.

Yeah.

Let's circle back on that CrowdStrike thing. Cause that happened. And I thought of Mario from eight years ago. Yep. Eight years ago. You gave a talk on what?

Yeah, so that was prior. So post DNC hack, I think everyone looked at that CrowdStrike report, right. And a lot of people just took it for granted. But like, anybody in our industry looked at it and went, this doesn't make any sense whatsoever. Right. Like they were talking about like, you know, we captured X, we captured this. Like, they didn't really talk about, like, how they did it. And like, I don't think anybody in the room actually believed that they did in the cybersecurity room actually believe that they did. And then also, like, the IOCs they gave out were like, absolutely terrible. They were like, you know, Yahoo email servers, they were powershells. Nobody can use any of this. This report is completely falsified. Right. But I was really the first person to actually go out there and speak up about it. And that kind of changed the cultural zeitgeist a little bit. In hack slides in nation states, a lot of people at the time attacked me for it. They said this was basically crowdstrikes, marketers. He'd be like, oh, he's pro Russian. He's just trying to get the Russians off the hook for this. And really that wasn't the case at all. Like, I believed it was Russia. I was just saying pro Russia. Yeah, no, I was just saying this report is lies that you guys manufactured evidence and then. Then tried to pass it off as real forensics. So I was attacked for that for a little while. But then it was like five years after that in congressional testimony that they actually had to testify that, like, no, they actually didn't capture any of that data. Right. So, like, they had to come clean that they were effectively dirty. But also in that talk, I was really, really skeptical. I dug into crowdstruck a little deeper. As a company, I was extremely skeptical, right? Like, if this company is capable of manufacturing evidence, lying to Congress, what else are they doing as a company? Because this is probably not where the rabbit hole of unethical behavior really ends, right? So, like, you start looking at some of, like, the independent analysis of where their sensor was at the time, the Falcon sensor, and like, it really wasn't doing a whole lot. Right. And not only that, like, anybody that tried to publish independent benchmarks, they were going after legally.

Legally, right.

That to me was also a red flag. I tried to warn people. I was like, hey, this company is doing a lot of things wrong. They have a lot of great marketing, and I'm sure their sales guys are buying you guys a lot of great stakes. But they are essentially engaged in unethical behavior all the time, right? Maybe don't interact with this company or have relations with them. Right? Which leads me to now where they've had this huge malfunction nine years ago. I'm telling people, stay away. They've had this huge malfunction. And in the news, you hear people saying, like, not the CrowdStrike EDR company had a malfunction. Right. Crowdstrike, the cybersecurity company, had a malfunction. Right. And to all normal people, they can't tell the difference. Right. So it makes the entire cybersecurity community, entire cybersecurity vendor, ecosystem, all look bad now. Because now they're all going to say, how do we know you're not going to have CrowdStrike moment? I have my executives saying, like, could this happen to us? Right. Like, they've gone and done damage now to the reputation of the cybersecurity community, cybersecurity professionals, where now my executives are looking at me a little like Leery, saying, what are you guys doing exactly? Could you take down our business? Like, we thought you guys were an insurance policy, but now we're looking at you like a liability. Right. So CrowdStrike has a lot to answer for. Not just to, like, their customers, but to the entire cybersecurity community.

Yeah.

I almost reached for the Jesus juice again. That's okay. You need it.

You're passionate about that. Hey, you know, when you're. You're right.

Yeah. Cheers.

Yeah, that's great. So proactive security.

Yeah, let's get back to that. Right? Yeah.

You know, we both have the same journey where we went through our cybersecurity journey. And it was definitely kind of that red team pen testing, proactive approach. What do you do inside the organizations that you advise? What do you recommend people do for, like, a proactive approach? How do you stay ahead?

Yeah. So I think I was going somewhere before we were talking about, like, measuring risk. Right. I just went down that rabbit hole a little too deeply. So that offensive experience gives me, like, an additional insight where I can just say, oh, yeah, okay, I know that's the weak Jenga brick that's going to cause this all to fall down. Let's fortify that first. And I can be really quick on that. Right. That makes me move faster in my business. Right. But, like, you know, how do I then I know where you're going.

Yeah. So how do you get a little bit deeper to know that? Do you rely on your team to do that? You know, do you build a red team to do that? You partner with someone. Like, how do you get that understanding? Because if you have that background, you might understand that better, but someone listening might be like, I came from the blue team. Like, I don't have that offensive knowledge to maybe know that that's the path I go down to. So, like, how do you do it today?

So I'M big on leveraging the group IQ of the team. I can't be the smartest person in the room. I hire people smarter than me. Yeah, right. Hire smart people to do smart things. Right. Additionally, like, that's not my job anymore. Right. I'm the C. So. Right. Like I've got to hire smart people to do that and I got to be able to trust them to do it like properly so that I can effectively do my job properly and reporting what these are and getting the results. Right. So it is an integral part of testing your controls. I think it's part of every compliance framework or audit framework is anything you report the risk, you remediate it, but you also test it. Trust buff, Verify. Right.

Yeah.

Like Ronnie Reagan. Trustbuff. Verify. And you have to have the pen testing component to verify the security of these controls. It's one thing to say like, oh, yeah, we fixed that. That's another thing to actually test it and make sure that's right. Because how many times has somebody told me they went and fixed it and it really wasn't.

You got me. Right. More than once. Oh my God. We actually see this all the time because we test continuously. We actually will identify something and be like, okay, something as simple as like default credentials on some sort of application that you put out there.

Right.

Okay, we found that. Right. And we report on it. They fix it. Right. And we validate that they fix it. Right.

So how many times does the fix open up another problem? Yeah. That you also find by going back and verifying.

Yes. Where I was going with this is actually like, oh, we fixed that. Right. And then the pipeline goes out again. You didn't fix it in the pipeline, you just like, you just redeployed it. Yeah. So like a month later or week later, however often they deploy, they'll just do it again and then boom, we see it again. It's like the regressions are actually, now that we're looking continuously, the regressions are happening like all the time.

And by the way, the bad guys don't care that you fixed it last week and now it's back. Right? You're happy that it's back? Yeah, yeah. So that it's back.

Yeah. It's same thing's happening for the network. Right. As we move the infrastructure to cloud providers and things like that, you know, we now have infrastructure as code. Same thing's happening now. So like now that we're always looking for this, we're like, oh, shoot.

Magnitude of those breaches increases drastically at that threat Surface too.

Yep, good points. Definitely. So what about on the blue team? You know, we've been talking a lot about red team, but like defending and patching and fixing that, like how do you prevent the problems I just like mentioned, Right.

So you can't leave the blue team guys out in the cold. Right. They want to do fun, sexy stuff too. Right. However, like if you're training them to be red teamers, you're going to make them less effective at their job. You've got to give them like a tool, a platform where they can go and kind of like not have to be an expert in red teaming. Just know enough to be dangerous, know enough. They want to go test something, then like go click, launch it, stuff like that, then they can verify their controls. Right? Like something easy. Right. And also like anytime the blue team guys aren't staring at their piles of log data is potentially slipping through. So like you don't want them over there testing out like a Kali Linux like installation and standing it up and stuff like that. Like, please don't be doing that. Like we'll provide you with a pen testing platform. We'll provide you with top tier pen testers and you can ask them, hey, I want you to come look at this, I want you to verify these controls. You know, a lot of times what my blue team loves to do is say, all right, we've done some really elaborate detection and engineering efforts around these pieces of threat intel that we have about threat actors working in our vertical. We need to make sure that they actually fire when we want them to. Right. So like can you guys build an attack that emulates this adversary using this type of attack so that if this happens for real, we know we can detect it. Right. And that's incredibly valuable to them. Right. Also in the testing and tuning phase of detection engineering for the blue team, we like to engineer what's called a non brittle detection. Because if you look at like the Threat Hunters Pyramid of Pain, right now at the bottom you've got like the forensic artifacts, like, like IPS and like host names. Like if the threat actor just changes their IP like that, that doesn't fire anymore, right. That's a useless attachment. So my guys are really focused on top of that pyramid. Like the TTPs like their behaviors, right. And those are really hard to engineer correctly. So like when they get those, right, and then they've got like a red team campaign designed to emulate that adversary and trigger that alert, sometimes it's going to be overly noisy or sometimes it's not Going to be noisy enough, right? So running that campaign, running that attack over and over and over until they get that engineering effort just right. Like in the Goldilocks zone for the day that we hope never comes. That's an immeasurable valuable to the blue team guys.

Nice, nice. So you're giving them a little bit, right? You're not giving them, hey, here's a Cali Linux box. Go knock your socks off. Right? You know, it's give you a little bit as it relates to the work that you're doing, right.

At the end of the day, this is a business, not a hobby. Yeah, right. Like going back to like hacker kid days. Like, yeah, if that's your hobby, go ahead and stand all that up. Go and do that.

Right?

Knock yourself out. Have fun, kid. Yeah, this is a business. My guys need to be all like, hey, I need X, Y and Z. I need this executed. I need this happening this time. We need to test it, we're ready to go. Right. The Blue team, the SoC is a business unit of their own, operating underneath the information security business unit. Yeah, it needs to operate as a business.

So when you're doing those validations, are you kind of comparing that to like mitre, ATT and CK framework?

Yeah.

How do you kind of measure that and figure out which controls are you going to validate? You know, where are you going to build the detections in there? How do you kind of prioritize and think about that?

So again, everything I do is different, right? So like, this is the approach we take. So when you look at like the MITRE, ATT and CK matrix, I see a lot of CISOs make what I consider a mistake all the time. They say I want to detect everything, everything, I want all of these. And counterintuitively, I take the opposite approach. Because if you look at the entire library of the mitre, ATT and CK matrix, right? Like not all of them pertain to my environment, not all of them pertain to my vertical, not all of them pertain to even the types of systems we run in our business. So if I dumped that entire library into the sim, which is effectively supposed to be a high performance database, you've done two things. You've slowed down the database. So now when the attack that I need to see comes in, it's going to be late. Or now I've just filled my SOC operators screen up with useless noise and they're going to end up missing that attack. I mean, when you're getting attacked, it's attacker advantage. You're already behind them as it is, and you're playing catch up, right? It's like the last thing you need to do is give them even more of a head start.

Right.

So we take the opposite approach. We go, hey, all right, what do we know? We have. What do we think we might have? What are we up against? And let's build those instead of, like, the build the wall approach, which is, you know, fill out everything. I call it building the minefield. Right. Like, we selectively drop our traps everywhere, and if we get enough of our traps hit, we're like, this is higher fidelity, Right?

Yeah.

Let's move.

Yep. So it's you and team essentially reviewing that kind of to say, all right, which ones are we going to focus on?

Yeah, you have to. It's a business. You have to operate like a business. You've got to measure its performance. You got to make sure that you're staying on top of, like, the latest trends and what new attacks the threat actors are looking to use. And, you know, a lot of times we're doing detection engineering for stuff that isn't in the mitre, att, and CK matrix. Right. Like, my guys are actively using fake Twitter accounts, following the bad guys. And as soon as they see them bragging, boasting, dropping, essentially narcing themselves out on their latest attack methodologies, my guys are like, thanks for that. We take it back. We build it, we test it, and we deploy it.

Yeah, dude, that's so awesome. And that's about fifth time you reach for that Jesus juice.

It's starting to taste better. Cool.

How about top misconceptions or blind spots?

Yeah. So just like we talked about building that minefield of detections. Right. A lot of people feel like my primary source of telemetry is my edr. Right. I think that is the primary misconception. That should never be your first line of defense. Right. Like, you take five minutes walking around this conference floor, and every person here has got five new obfuscation methods for making sure their payloads aren't getting picked up by any of these vendors. EVRs. Yeah. Right. And that's just us doing that. The numbers for, like, cybercrime losses last year, like, exceeded $10 trillion. The bad guys have dedicated teams of reverse engineers doing this way better than us. They're coming in and they're bypassing the ERs all the time, because that's their job, that's their business, and they're exceedingly good at it. So you have to be planning for not having telemetry for the edr, you have to have multiple sources of telemetry coming back to the SOC operators and you have to make sure you have overlapping detections so that if you lose one or two of them, you're still getting the fidelity on that minefield. Right. And you need to make sure that if you're not getting telemetry from your EDR and you're getting hits from other log sources, you have another means of taking action on that endpoint as well because you now know your EDR is compromised. Yeah, like I'm giving away secret sauce here, but like, that is really good and complete detection program.

This reminds me back, like in my early career, I was applying for a job and I asked the question, you know, to the manager of cybersecurity. I was like, what do you guys do with, you know, all the threats and malware that might be on your network that you don't know is there? And it's like, oh, we have McAfee. So whatever McAfee alerts us of, you know, we're pretty much covered. I was like, dude, I'm not going to work here. Like, this is going to be a.

Constantly bad, just a bad headache every day.

So it's like, it's true. You just can't rely on, like the edr. Another example, I was in this room, there was like five different red teamers last night. And each one of them brought to the table some new defensive Asian thing that you know, like, oh, yeah, I'm using this. Oh, I'm using that. Right. And so you're absolutely right. Like it's a cat and mouse game. And if you're relying on just this one business, this one solution, this one set of telemetry data to like, give you the things you need to know, you're going to have many bad days.

Yeah, I'm going to geek out on you for a minute. So back in the day, you know, pre CISO days, we used to fuzz the EDRs themselves because they're already running in God mode. So if you can find it o day on an EDR product that you know you're going to be going up against in an environment, you know, you've already got system level access, you're in, you're done. And the dirty laundry of the EDR industry, which was just exposed, right, is that most of them don't have a really good software QA process. Most of these pieces of software are really terribly written. Cybersecurity companies are putting out bad cyber software and it's Making it easier for the attackers to own the systems, depending on which EDR manufacturer they've chosen.

So are you increasing or decreasing your attacks? You know, right, like, absolutely.

Yeah.

That's good stuff. And seriously, that's actually refreshing to hear that take though.

You know, nobody wants to admit the emperor has no clothes.

Yeah.

I think if I've ever been known for anything in my career, it's always been being extremely openly honest about the dirty laundry in our industry. Airing it out there and saying we have to do something about it and if we don't talk about it, nobody's going to do anything about it.

How do you get better? Right.

So the cybersecurity community has to self police itself. We have to do better. As part of that, it's holding the companies that represent all of us and our collective reputations held to a higher standard.

Absolutely perfect. We'll end it there. Mario, if anyone wants to follow the work you're doing or get in contact with you, how can they do so?

Come to Black Hat Twitter X. I'm Ariogdnitali LinkedIn. I don't really check that often. Don't hit me up there. That's about it. Unless you like food pictures Ariogdi on Instagram.

Nice. All right, Mario, appreciate it. Thanks.

Always a pleasure, brother.

Thank you for listening to another episode of the Ahead of the Breach podcast. If you enjoyed today's episode, please leave us a review on Apple Podcasts or Spotify. If you're interested in exploring how Sprocket is shaping the future of offensive security beginning, be sure to check out our website@sprocketsecurity.com thank you again for joining us. See you on the next episode.