Episode 12: Cybercrime and Cybersecurity Expert Lou Manousos

Informing your decisions with intelligence analysis and insight brought to you by the team@oodaloop.com.

Hi, I'm Matt Devoe at OODA and thanks for joining us for another Oodacast today.

Hi, and I'm Bob Gourley. I'm the Chief technology officer at OODA today. Our guest on the Oodacast is Luminous, the founder and CEO of RiskIQ. Lou, how you doing?

Hey, guys, thanks for having me.

All right, thanks for joining us. So, Lou, just by way of background, why don't you give us a little bit of your origin story, kind of step us through your career and how you get to start Risk iq.

Sure. So I'm a Midwesterner from Chicago, been out in San Francisco now for about 20 some years. So my beginning started. I was studying physics and I was walking in the quad at the university, and professor was rollerblading by me and he said, hey, aren't you that physics guy that knows something about computers? Yeah, like, yeah, we're trying to build a secure computer system at the lab. And this was Argon Labs in the Midwest. And so they needed help securing the network. And that's kind of what got me into cybersecurity. And I was doing like a lot of people, this is early, early Internet days, early 90s. I was doing a lot with Unix security and just generally as the Internet was taking off, and it turned out no one at the lab really knew much about that. So that's what got me into it. And from there I realized that was the guy running a lot of the meetings and organizing teams. You know, if you've worked in an educational environment, you know, a lot of individual contributors and not. Not many good technical managers. So me and a couple other guys at the lab decided to get into the startup game. And so that's kind of what got me into doing startups. And since then, I've done for startups. Risk IQ is my latest one. And I wanted to do something that was out in the Internet. And so my last business was an identity management company, which we sold at rsa. And identity is obviously a great business, but it's a technology that has been worked on for many, many years. And where I saw the threat going was really onto the Internet itself, as companies were using the Internet as their primary network. And then you were losing visibility. And that's what got me to Risk iq. So it's been a lot of fun.

Excellent. Any leadership strategies or things that you've learned along the way that you'd like to share with the Audience?

Yeah, you know, I think for me leadership is about enabling others and the best way to do that is to lead by example. You know, a good leader is a good soldier. And for my organization I try to look for and highlight certain things. The first thing is I think cybersecurity is a game, it's not a problem. And we have to really understand what matters to us, our business, how we're targeted, and, you know, finding people that like to solve puzzles versus just solving a problem. So leadership and hiring, I think go hand in hand to find that right person. The second thing is around people who are passionately curious about what they do and encouraging the team to express their desire to win. And if you find people who like to figure out the rules of the game, chase the bad guys, it's sort of a magical experience and can be much more fulfilled in your role if you're on the right kind of team. And that's assembling people around that kind of core. And when you think of hands on leadership, you can't find another place like cybersecurity. If you're not hands on, you're not going to understand the bad guy. Leading from an ivory tower just doesn't work. And it also just doesn't matter about your role. Even if you're a business guy in a technical field like cybersecurity, it's leading by example. And your team's gonna really, your team is gonna appreciate this. And I think of the team that I'm on, how I encourage others is like those are your peers and your boss. So for me as a CEO, I work for the board and I work for the shareholders. I work for my customers. Like the worst job, right? You have so many people you're working for. So those are, that's my team. But then there's the people that I lead that are under, under me and I want to make sure that they're getting the support. And you know, especially today with this crisis, you know, people are people and we've got professional development and all the personal issues that the team has to go through. So it's just really, really important to understand that not only are you on a team, but you've got people under you that you have to support. So that's what it means to me.

Lou, I've also noticed on this leadership theme, you're also a community leader. You've taken on yourself to lead some interesting community wide activities. For example, when I first met you, you were the first one that had brought this issue of Malvertising to the front and helping people understand what malvertising is and how adversaries can use the infrastructure of the Internet to target malicious code or, you know, take other malicious actions. And your leadership there, I'd love to hear more about what you were doing was with the Internet Society, is that correct?

Yeah, we were, you know, as we were doing a lot of research in Internet security and threats and threat actors, I put up a website, malvertisements.org and just to track all of these malicious ads. And so I was invited to speak, I think it was at the Pentagon, something like that, which is how we bumped into each other on the topic. And I had a presentation I did called the Perfect Weapon. And advertisements are just designed, they're targeted, undetectable, they operated at distance, they scale crazy ways. So, you know, so risk iq. We were focused on understanding the Internet better and threats and threat actors that target you. And what we kept just running into is this Perfect Weapon, which was an ad that was being used to distribute malware and other types of threats. So from there we ended up building the and Anti Malvertising Working group, which just brought together different stakeholders. This was very early on, before the ad networks themselves actually took this threat seriously. I think now we're seeing a big change, I think, from both the ad industry. Advertisers really understand this is a serious issue, but. Yeah, but back then wasn't well known. You know, I'm a very technical person. I love this topic because it really is a great way for an adversary to gain a foothold.

Cool. Hey, you know, on that same thematic, some of my favorite conversations between the two of us and with others have been in evil genius mode. When we think about kind of the current state of the cyber threat and ways in which they might innovate in the future. I'd love to get your perspective, kind of what is your current thinking on the current state of the cyber threat? But then also, how do you think they're going to innovate over the next.

Three to five years? Yeah, I think everyone's business just went digital overnight. And that has added a new dynamic, the remote workforce and how we communicate with our customers, how every company has to communicate with customers. And you think about losing Internet access and what that might actually do, or compromising Internet access. Right now, I mean, your business is already limited because you're remote, but if you lost the Internet, you'd be in deep trouble. So I think there's a lot of attention on this problem. The threats are the same. It's just we don't have the same controls that we had in a, an office environment or, you know, a private network environment. So, you know, for us it's all about discovering the unknowns and understanding what is exposed to the Internet and what threats are out there now that this attack surfaces. You know, everybody's personal residence. So it's an interesting problem and I think we're going to see it evolved pretty rapidly over the next two or three months. Right now, like as of today, it's a lot of the same threats that we've seen for the last couple years just magnified against the COVID 19.

And Luke, can you discuss a little bit more about that magnification and how things have changed because of COVID 19? Because, I mean, there's some very despicable actors out there doing bad things right now. What are you seeing?

Yeah, so we put out some reports on this and we can talk about that too. But generally speaking, if you look at email attack vector, the COVID scam is now the top lure. You look at domain name registrations for malicious domain names. I mean, there's thousands of new malicious domain names coming out. It is difficult to tell between the good, the bad and the ugly because the pandemic's only been active for the last three or four months. So, you know, when you see new infrastructure on the Internet, most security teams will flag that as suspicious because how often do you really see new infrastructure? But right now there's just a lot of new infrastructure. Just in the last two months, we have over a million newly observed host names that we've observed. And it's not that all those are bad, but you've got scams, fake stores, very vulnerable sites that are being stood up. So it really is just the raw magnitude of what's there and sorting through it is a big, big challenge for everyone.

How has it impacted you at risk iq kind of personally, has it done disrupted operations? I'm assuming, you know, the bulk of the team in the San Francisco area, you moved to a work from home type environment. How have you and your team adapted to this personally?

Well, we had a head start. San Francisco was one of the first cities in the United States to call a shelter order. And like everyone, we were shocked. We were even more shocked because we were the only city really getting locked down. So of course there's a big healthy debate in the company of what are we going to do? Are we going to call shelter orders for the entire company or just the people located in the Bay Area? So we Ended up just doing it across the board. We thought that was the right thing to do and in hindsight it clearly was the right thing to do. But that gave us a healthy head start. From there we just noticed pretty quickly that a large percentage of our staff had already been working from home, you know, maybe a day or two a week. And so they were just adapted almost instantly. Of course, customer facing teams, people who travel often, this was not a real big deal for them, became tougher, I think as everyone has to deal with the family situation and just having having a private workspace in their home for extended period of time. But I think for the most part our staff did great and having that head start was really, really useful. And as the shelter orders get extended, we're doing more for the staff, giving them a budget to spruce up their home office and just encouraging people to take it easy, schedule their day properly, make sure they have breakfast, lunch and dinner. Simple stuff. But it's really important as a leader that we remind everybody to pace themselves. Cause it's just too easy to work from seven to seven every day.

So almost like going to a conference with the 3, 2, 1 rule. You gotta remember to get some sleep and to get some meals and to.

Take a shower every day. I think it's important to establish that routine. Yeah, yeah. And it's, you know, and as a cyber security team, there's just so much bad stuff and adversaries are really active and we love to hunt rabbits here, we love to chase them around and there's just so much to do that. Yeah, you can find yourself at one in the morning just chasing the next thing that's going on and that's what we are here to do. But you gotta pace yourself and hand stuff off to others. And so we're working through that with the company right now. It's an interesting time.

Lou, I think that kind of advice applies to just about every corporation today in the digital world. And I think it's important. I'm glad you mentioned that and I wanted to ask some like a follow on question. You're also one of the most widely known in the cybersecurity community. I think every CISO for the most part knows you and I imagine you've already had a lot of conversations with them about what they should do as their workforce has transitioned to work from home. Any other advice you can share on that for those CISOs that haven't called you yet?

Yeah, you know, life's a journey and boy, I mean this is an interesting stage in that journey it is. And so, you know, that's been the general theme of all my conversations is, you know, this is an interesting time and we're going to get through it. And it's important to work closely with your trusted circle and the partners that have been there for you over the years. Right. And just we got to support each other. And I feel like that's overwhelmingly the theme that of the discussions that I'm having. And you know, the other part is I'm hearing a lot of people have stood up pretty complex programs and in reality it's really simple things work. And now with everybody working from home, we're starting to see like, well, gosh, you know, threat actors can still do their job and how do the systems that we built adapt? And you know, your vendors, your supply chains, you know, we're all peers right now and it's just super critical that we can keep the security programs operating. So yeah, my general advice is I think there's a great lesson here in terms of what we need to do. These Internet based threats are clearly difficult to stop. And now everyone's network is the Internet. And that's something that I'm spending a lot of time talking to people about. Great.

You speak of kind of community engagement. I noticed one of the things that Risk IQ started doing early was a daily intelligence report around COVID 19 that was covering not just kind of the latest statistics, but then the things that were impacting business operations. Early on it was tracking which companies had issued a work from home order, what cities were shut down, the extent of the shutdown, that sort of stuff. Can you kind of step us through what was the catalyst for putting something like that out?

Yeah, I think being in the Bay Area and having the shelter order hit us early, we were getting a lot of questions from, you know, other leaders and peers and customers about what's going on in San Francisco. And so we, within 24 hours we were putting that report together and we just saw a dramatic uptick in threat infrastructure. And we saw a dramatic uptick in just misinformation. And so all the security leaders that we work with. It wasn't just about the cyber stuff. It was about regular things like what if my team can't come to work tomorrow because they have to babysit their kids. Right. Or parent their children. That's gonna hurt our ability to operate our security operations center. It's gonna hurt. It's going to just impact our business in ways that we have never really faced. So when we did that reporting, we wanted to extend it to cover all of the more traditional physical security issues that teams are facing as well as the cyber issues. It was a pretty easy decision for us to put the time and effort into that report. It takes us. We publish it every day and it's free. About 100,000 people in the Risk IQ community that either come in to use our products or passive total. You know, giving this back with no expectation of anything in return was just a brain dead, simple decision. And primarily my motivation was let's fight back against these miscreants that want to take advantage of this Covid crisis. It's just, you know, that's what we need to do right now, is do everything we can to keep things running and then prevent the bad guys from disrupting our infrastructure. So that's why we did it. And it's been interesting. A lot of people get a lot of value out of the physical report as well as the cyber parts of the report.

Excellent. It's a great resource. We'll make sure that we put a link to it in the notes as well. It is something. This is a unique issue. Obviously cyber affects Everybody, but the COVID 19 themed cyber attacks impacts everybody on the globe. I think some of the statistics coming out of the US government is that every single country has been targeted in some manner with a Covid related lore. So I don't think we've ever had an issue that's brought such common ground.

From a threat perspective. Yeah, we look for a signal in the noise and this particular signal was so strong, it just was astounding. From very basic scams, you know, phishing, traditional phishing lures all the way through, you know, malware based attacks, ransomware. It seems to be a very quick motivator for the bad guy.

Right, Lou, I have another leadership based question and this whole discussion has been great for great advice for leaders and I appreciate that. One segment we didn't talk much about is the board of directors of a large Fortune 1000 corporation. That kind of strategic thinker and strategic leader. Any advice for that individual on what they should be thinking about the cyber threat and how to respond to it?

Well, right now I think today with COVID it's maybe a little different. But your security team needs the support of the board and you have to have a dialogue and that dialogue is going to bring up issues. So anytime you have good communication, you're going to hear things that might make you think, gosh, are we not that secure? And I think that's good. I would advise, I would advise Boards to keep pushing on their team and get uncomfortable with the news that they're hearing because that just means that your team is finding issues and if they're finding them, they're fixing them and then they're learning how to respond to incidents. And that at the end of the day, that's what it's all about. You're going to need the ability to recover and the board will have to understand what that means if there is a breach. So improving communication with the security leadership is a real critical part of what I look for. And if I ever hear from a board member, they're asking questions. We've been briefing public boards as well as large private boards and just giving advice generally of what to look for. And you know, just really starts with getting good, solid security leadership and making sure you've got a CISO that you feel is a true executive that can communicate to you and pretty basic stuff at the end of the day. Right? Thanks, Larry.

Great. Obviously you guys are providing a great source of information, but you personally, you know, what type of sources do you revert to? Do you know, to keep yourself informed and making good decisions?

So I get my data largely from the front lines, you know, what's going on in real life every day and so understand what the adversary is doing, look at actual attack information. And what's a little bit different about riskiq is we have this corpus of information that we can draw on because we operate large, large scale Internet collection. So we will look in our own data sets when we hear of an incident from a customer or a partner and correlate to see how serious is this issue. Is it impacting everybody or is it just happening in one specific vertical or is it just happening to one particular company? So for us, I think it's very important to keep alignment with what's really going on in the front lines and then understand the scope of the attack. And as I mentioned earlier, it's like looking for the signal and the noise. And so right now a lot of the signal that's out there is Covid related lures. And so we're drilling in on those very deeply.

Excellent. I always like to ask, you know, you've got the physics background, obviously the technologist in cybersecurity. What types of books and things are you reading right now that were stuck at home in quarantine?

Yeah, no, it's a good question. So there's an essay, a series of essays, a book called what if by Crawley. And it's interesting because it talks about what if this happened, what would the result have been? And I thought with COVID I was like, wow, this is a really great book to read because this is the what if scenario that so many of us have been planning for, for our whole career and now we've got this major incident that's affecting us. So I think everyone in the risk field, not just cybersecurity, would get a kick out of this book. It goes back to really the beginnings of recorded history and what if what did happen didn't happen, if it went another way? And yeah, there's some interesting things in there that you can correlate to what's happening today with COVID So what if? That would be my book and my recommendation for you guys.

Excellent. I have to check it out. I think that's one of the difficult challenges around this. Anytime you're making data driven or model based decisions, right. It's always difficult after the fact to say, well, what was the course of the path not taken? So those are great intellectual exercises I think, to go through that kind of thinking, that what if thinking also feel like that's going to be the source of huge misinformation campaigns going into the election. Going to be a lot of preposition and what ifs and why didn't and you know, that sort of stuff is going to be widely discussed over the next six months.

I think it's already happening. I mean there's a lot of misinformation out there already. And you know, if you, if you're in the government field, you know, law enforcement, you're getting, there's a lot of pressure on and even in the private sector to let's protect against these attacks. And right now everyone wants to focus on the COVID threat. But yeah, in the fog of war, we've got an election coming up, we gotta stay focused on that as well.

And a lot of gaps and seams as you mentioned, just relating to everybody shifting to work from home. Right. So a lot of adversaries looking to exploit that as well.

New infrastructure, Right. And the reason that new infrastructure is scary, it's new and people make mistakes when they stand up new stuff. And so companies are needing to support this massive shift from an in person environment to a completely remote environment, both for their staff, but also their customers. So there's just thousands and thousands of new things largely in the cloud because we can't get into the office to configure stuff. And that's a big opportunity for misconfigured systems and then misconfigured systems can get scanned by an adversary. If it's crimeware, then, yeah, you're gonna see ransomware. You're gonna see basic attacks that try to monetize. If it's a nation state, then who knows what happens? But yeah, right now I think keeping and discovering what's being stood up by organizations is really, really important. We want the business continuity sense.

Right? Thanks, Lou, for the time and all these insights. This was incredibly insightful and much appreciated.

Yeah, thank you, Lou.

Thanks for having me. Great.

All right, thanks, everybody. We'll put links to the resources we discussed, the book and the mailing list and also to riskiq.com itself in the show notes related to this episode. Thanks, everybody and have a great day.

Thanks for listening to this OODA Loop production For the latest analysis on cybersecurity technology and global risks, please visit www.ooda loop.com.