Episode 6: A Conversation with Tony Cole

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda loop.com. Welcome. In today's oodacast we have Tony Cole of Attivo Networks. Tony's a long term friend and associate and so I want to Tony, if it's okay with you, give people my version of your biography and then let you correct the record if there's stuff I get wrong. I think if you're a practitioner in the cybersecurity space, you may already know Tony. You probably do if you're an executive and decision maker and haven't met Tony yet. Here's why I think his background is so interesting. He was in the army, you were a cryptologist, which is how do you protect our secrets using technology? And how do you break into adversaries technology to steal their secrets by breaking their encryption or understanding them better. But when I met Tony, you were at the army cert, the computer emergency response team for the army where you guys were deep into incident response and detecting when adversaries hit you and what to do about it. Then after a tour in Korea, you came back and you were doing more security stuff with the army and joint forces in the Pentagon raising their defenses. After an army career, you worked at Symantec, McAfee. You helped really accelerate FireEye onto the scene by bringing their capabilities to public sector countries around the globe, especially the US as their public sector chief technology officer. And throughout all this you were speaking and writing and thinking, worked in a couple startups and now you're with Ativo Networks where you are leading their activities when it comes to helping CISOs understand the power of this capability. Now I want to talk about Ativo later, but first, what did I get wrong with the bio? Did I hit the major points there?

Oh, you certainly did, but I actually was one of the lucky guys. I never left security. Even when I did the short tour in Korea, it was to go set up the regional Army Regional Computer Emergency Response Team in Daegu, South Korea. Yeah, you were right on track. About the only thing that was missed because it was a short stint was I started playing with Lance Spitzner and the Honeynet project when I was still at the Pentagon. Wanted to bring hunting pots in. The Pentagon battled with a lot of lawyers on that and that was a very interesting experience because I had all of the responsibility with almost no authority running network security. So on the backbone because of course all the agencies below us had the authority. We did not. So we would block and then get told, remove that block even after coordinating for a month over it. But anyway, I brought honey pots in the Pentagon and liked it so much that when I retired from the Army, I joined Recourse Technologies, the first commercial honey pot company. And then Symantec acquired us six months after that, so that that company went away with the technology very, very quickly. Besides that, you're spot on. The only thing I would add is it's a TiVo Networks, like TiVo, but Ativo that works.

Ativo Networks, yes. Tony, I want to return to this honey pots and honey nets shortly, because you were one of the first people to ever tell me about the power of these things. And Lance, of course, was a pioneer who was really helping a lot of people understand it, But I never met him in person. I read his books. You're the guy who helped contextualize this for me and. And teach me why it was so important that you could have a computer that could be targeted by adversaries. And you're watching that, and you see what the bad guys are doing. And from the early days when it was just one server, then it became a whole network of servers doing this. And each time, it seems like the adversaries eventually would figure out that they're in one of these honey pots or even a honey net. And so it was hard to trick the more sophisticated adversaries. So this has evolved over time, right? What's the current state of the honey pot or honey net?

Yeah, you bring up a really good point. I hadn't realized that you haven't previously met Lance. We'll have to fix that. He's on my advisory board. One of the first guys I brought over when I joined TiVo a couple of years ago. It's really interesting. You know, it relates directly to his line of thinking, if you know his background. He's a former army tanker, and he went into cyber security, and the first thing he realized is no one knew anything really about the adversaries in the space. So he started working with honeypots and created the know your enemy series. And his goal was to create a whole bunch of different types of honeypots, toss them out of the Internet, see how quickly they could get breached, as well as, you know, how much data they could collect on some types, you know, over a period of time before the adversary knew they were inside one. One of my favorite quotes in this area, back to the TOD side, but it's actually from. From the Brits, is from General Sir Archibald Wavell. So from his ruses and stratagems of war, 1942. And he says perhaps the most elementary principle of deception is to attract the enemy's attention to what you wish him to see and distract his attention from what you wish him not to see. So that's really where we are today. When you look at honeypots of old, they were primarily designed for the research side and people could very quickly ascertain they were inside a honey potential. So you would get an alert, you would capture a little bit of data. But there was no long term play inside honeypots. Today when you look at deception across the board, it's really a matter of building a set of decoys inside unused IP space, putting breadcrumbs and lures and other deceptive components across the production environments with no impact on that. And any touch of that entire fabric causes an immediate high fidelity alert. So you don't care if somebody knows they're in or not. We have many immature organizations that don't have a lot of capabilities that will go through and they use it primarily for detection. But we have a lot of lean forward organizations have very mature capabilities and they'll take their real gold operating system images and employ them inside the decoys so they can play inside that decoy environment for a long period of time and never know that they're inside a decoy environment because it's a mirror of the production environment for most aspects. So it's really, really different than honey pots of old where it was just very quickly identified to the fact today people can play in a long period of time.

This is fascinating and I want to ask your views on a lot of other subjects, but when it comes to this, would you tell me about scale? Like in the old days, I mean, starting in maybe the late 90s, early 2000s, the scale would be maybe a small organization of 40 to 50 computers might need one Honey net or honey pot. And then you might scale up to thousands of users protected with a honey net. But it always reached some kind of upper limit of scale. What kind of scale can you guys go to today?

If you look back in some of the reasons they didn't have scale in the early days of honey pots and honey nuts was primarily because it was a bare metal build. Virtualization had not gotten to the point it is today. And you needed expertise in the operating systems, the applications, the data that you wish to collect, how to build a backend system to collect that data, you know, adversary understanding as well, you know. So how do you keep that data fresh? Very, very difficult in the old days. Today it's Very, very different. We've got number of customers in the Fortune 50, not 500, the Fortune 50. So that scaled it out and rolled it out globally. So it really does scale. It's very, very different because you can use machine learning to learn someone's environment, pick up the unused IP spaces, learn all the operating systems and applications that are communicating based on looking at the ports, and then deploy that in mass inside unused IP space with no impact on the production environment, and then use their existing infrastructure to, to deploy those breadcrumbs and lures in the production side that will lure an adversary into the decoy environment. So it's very, very different from the old days of honey pots and honey nets.

Yeah, this sounds like you've gotten the scaling thing down because it seems like it can scale to any size in a linear way. You just add more virtual machines and it will grow.

Yeah, there was a great paper the other day from a scientist at MITRE that was public put out there on the Internet and they were asking DOD in the defense industrial base, what? Why aren't you using deception en masse inside your cyber environment? So, good question.

Yeah, that's awesome. And I also want to ask your views on a lot of other things, Tony. One is you have been in direct contact with adversaries since the 90s and you've watched changes in the threat environment also. And back in those days, yes, we had low level threats, the hackers and the miscreants and some low level criminals. And we had some nation states were starting to wade into it. Now you fast forward 20, 25 years, every nation is into this with well resourced, nationally funded organizations and non government organizations that are supported but still extremely well funded. So very high end capabilities there. And criminal syndicates continue to invest significantly in research and development and are getting more powerful. Small criminal groups are also able to inflict damage and meanwhile we're also so much more dependent on it. It's become ubiquitous. And through your perspective on all of that, I mean, how have you seen the threat actors change over time? Any lessons for us on that?

Yeah, you know, it's absolutely amazing when you think about the history across the board from the mid-90s where we saw, you know, groups like hacking for girlies that were trying to show they were really cool because they could hack a web server and put up their own image, you know, and show their admiration for some woman, you know, I mean, it's really funny today where you've got organized crime making billions of dollars around the globe every single year. You've got nation states that are going after so they can better compete in the global economy, to nation states that have simply moved their espionage capabilities, the vast majority of it, onto the online world where there's less risk and easier access. So there's been significant advances over the last 25 years on online attacks across the board. And I think it's critically important that people realize that we're going to continue to see these changes, you know, year after year and day after day, you know, where adversaries are trying to do more things. How can they, from the organized crime side, how can they monetize things to the nation stateside, where if you're a target that they're after, they're not going to move off and go somewhere else. They're going to continue to raise the bar sophistication for every one of their attacks until they accomplish their goal. And that's what a lot of people don't think about. I see so many people that are dismissive. Oh, that was really, when you look at the evidence, it was a low level attack. Yeah, it was a low level attack because it was successful. If they needed to raise the level of bar, you know, to bring in new tools, you know, then they would have potentially done that. I mean, you don't launch a nuke, you know, to assassinate somebody, you know, you don't need to. Right. So you're just actually giving away the fact that you have nuclear weapons instead. You know, people use poison or something else. And I know that's terrible analogy in with everything that's going on right now, but it's absolutely true. Same reason you don't bring a safe cracker when you're trying to steal a laptop off somebody's desk at a house with an open door. Right?

Yeah, that is a good analogy and I think it makes a lot of sense. You don't need some, you know, super expensive zero day attack if someone doesn't have a patched system or if there's some other easy way to get in, or if you've stolen somebody's credentials and they don't have multi factor authentication, or if someone will click on the link to download the malware. You don't need this expensive zero day exploit to get in.

And that's one of the reasons deception is so successful. We help customers really start to understand how to build campaigns around how their environment looks today and to mirror that deceptive environment exactly the same. Maybe you've got 10%, 5%, 2%, 1% of your systems that are Patched because you have additional testing that needs to take place so you can make that slightly more alluring while still matching what your environment looks like inside the deceptive environment. And the adversaries pivot and go right after that deceptive environment almost every single time. So it makes it great fun.

Cool. Tony, I want to ask a couple other questions on other topics, if you don't mind. One is it's really related. You know, right now we're in this crisis like none of us anticipated. Although the fact is that global pandemics have long been talked about and in some ways predicted. I can't think of anybody who is really saying the scale of this is coming. So all of us are really focused on all of us good guys anyway. What can we do to protect ourselves, our families? What can we do to protect our employees, our friends, our country? All of us good guys are thinking that meanwhile the bad guys aren't stopping. It's like they haven't missed a beat. And it's really disheartening to think that so many good people now are put in this crisis and are really in a struggle and are fighting and trying to do the right thing. And the bad guys are still attacking and attacking and attacking. And now on that gloomy note, I wanted to ask you, what are you seeing the adversaries doing now and what can we do to prevent their or slow their attacks in this crisis?

Yeah, it's really frustrating that there has been no slowdown. There seems to be a lot of organized crime, you know, going after many of the same, same targets they have in the past, regardless of what those organizations are doing. I did an interview earlier this week for a UK publication and it's. It was talking about health care system. And quite frankly, if you read it, you'll know I was relatively angry when I was answering their questions because of these attacks. Going after health care systems, still looking at ransomware, still looking at ways they can monetize this pandemic. And one of the things I wanted to point out publicly and get it in the press, and, you know, I'm going to say here as well, is what people don't think about is that organized crime group going after one of these organizations. They might be working on a vaccine. So they may have just killed somebody in their own family by slowing down a vaccine. If that, you know, if that criminal's family gets infected ahead of time. And I mean, it's really frustrating. We knew organized crime wouldn't slow down, but you would think that they would steer clear of the health care environment of pharmaceuticals at this point in time. Because, I mean, they're trying to save lives around the globe. There is no cure specific to, you know, the United States or specific to Russia or specific to China. So. So any of these large companies that comes up with a vaccine, it's going to be shared globally and that company will profit on it. Sure. But nevertheless, the important thing is saving lives today. So to answer your question, one of the things that was very interesting is related to some of the attacks in the uk there's some groups now that are building, I don't want to use the term vigilantes, but I mean, nevertheless, they're getting together and they're trying to help companies and they're building a very large global structure looking for volunteers. So to help advise companies to build a better structure. I mean, many of the organizations today have massive issues around bandwidth when suddenly everybody's working from home. And because of their single tunnel VPNs, which are really important. I mean, it's good to have a single tunnel vpn, but can you do that when suddenly people are streaming Netflix on that same system and it's going to your corporate environment and then coming back? So now we see YouTube and others that are starting to ramp down bandwidth. Netflix is doing that in some regions. But we were going to see many of these same organizations move to split tunnel environments, which raises the risk posture again for many of these work from home people. So I think there's a tremendous amount of effort we can do as cybersecurity professionals just to advise everybody on best practices out there around the globe.

Right, okay, good. That's helpful. Good context. And I think that's the kind of thing that a lot of us can help with is what are best practices that you can implement today to improve your risk posture for small businesses and large businesses and for the workforce deployed at home. So let me come back to deception technologies because we talked about the enterprise use cases. Are there new use cases at the very small scale for someone who's working at home? Maybe I should ask it this way. What is the smallest scale that makes sense for Ativo to support a deception use case?

Yes. So we have a lot of customers in the small to medium enterprise side. You know, we have, we've got a blog that was done, you know, a single practitioner of security, you know, I guess the CISO for a very small company, but they're, you know, they have no one else on their team. So we have some very small customers as well. And many of Them are primarily using deception for a detection fabric because these are high fidelity alerts. We help them build it and design it so it's well tuned. You know, whitelist any of the specific red team tools that may be utilized so you don't get false, false alarms inside the system. And then you get really, really good, you know, detection, you know, where many of your other preventative pieces of technology fall down. So what we tend to see is some of those same organizations as they mature and they move across that, not towards a lean forward because obviously, you know, we've only been around for, since 2014 shipping product, but I mean we've had some customers have been with us for quite a while and they've started to shift more towards at least the middle where they're more experienced, they've got more data and they're starting to study the adversary a little bit. So you can use it just for detection all the way to the very large customers we have that are very lean forward that are studying the adversary, using it for a detection alert have integrated into the 30 odd partners that we have out there, the Ciscos, Palo Alto's checkpoints, Fireeyes, you know, CrowdStrike pick. Right. So we're integrating all those so we can work with the, the automation pump, threat intelligence coming out of the decoys into the threat intelligence environment that they have. So there's a lot you can do on that enterprise side but a lot of the small organizations, in answer to your question, really use it primarily for detection because that's what's critical to them. Identify that adversary, kick them out, close the hole that they got in and look for the next one and they'll keep their environment dynamic and updated.

Great. So let's say there's a small startup and they have maybe they've got their first round of VC funding and they have 20 employees. Are they potential user of Attivo?

Yeah, absolutely. And you know our deception fabric runs across on premise in hybrid. So if somebody's partially in the cloud, so, or completely in the cloud, it doesn't matter. So you can build deceptive S3 buckets, deceptive Lambda functions, deceptive configuration files, deceptive credentials in the cloud and you can do that on aws, Google, Oracle, Azure. So you know, there's tremendous amount of ways to do it. A lot of these startups of course are mostly cloud based and we play in the cloud as well so it's much cheaper and easier for them to implement deception right from the start.

Awesome. Tony, I got a couple other questions on related subjects and the first you've really already hit on multiple times. I just want to return to IT to make sure we didn't miss anything. And that is I wanted to ask you your views of, you know, cybersecurity best practices and maybe I should shift that because you've already hit a lot of them, but your views of cybersecurity best practices that we can put in place and also a bit about what you're optimistic about because there's so much gloominess in cybersecurity today, but there's also so much good going on and I love your views on both of those.

Yeah, well, the best practices, I think it's really important a lot of people stand up and talk about we've got to do the basics first and the basics are critical. But unfortunately, and you know this very well, Bob, we've been talking about the basics, cyber hygiene for 25 years now. So we definitely need to do it. It needs to have a plan, it needs to have a focus inside your environment. But you can't do that alone and keep all the adversaries out. So you've got to look to new types of technologies, you've got to monitor that. And that's one of the pieces, I think, right into the next part of your question. That to me is really good news is there's a lot of innovation taking place in this space where around the globe lots of companies that are coming out with new creative ideas on how to stop the adversary. And I think that's really good. Unfortunately, you know, it's also got a specific problem too, and that's the fact that when CISOs are trying to track technology, there's an overwhelming amount of information, there's thousands and thousands of vendors now and they don't know what to pick. So I think best practices around cyber hygiene is a critically important piece of. But also having some type of team, if you've got the capabilities to build a lean forward small team, looking at technology continuously to see what fills some of the gaps that you have. And I think the last piece I'll add in that is every CISO probably knows it already, but I'm going to say it anyway because it's so important because so many vendors never say it and that's there's no silver bullet, there's no perfect solution, everybody will get compromised. And I think that's another good point. In this environment, people now really understand they're going to get breached, how they react and how quickly they identify it. So it's what can have a significant impact on countering. You know that breach, right?

Okay, awesome. And you bring up a couple other things. Just a follow on question or first a point you remember. You're old enough to remember the old days when we would come together in conferences like rsa. And actually the last RSA was just February. I don't know if we'll ever do that again. But when they do Those big conferences, 500 vendors on the expo floor, and as a technologist, I want to talk with every one of those. And if you spend one hour with 500 vendors, that's 500 hours. It's going to take you 10 weeks to get through those. It's impossible. And the CISO, as you just mentioned, is overwhelmed with so many of these kind of capabilities they need to study. I like the point you make about the you need to stay continuously aware of what's out there. The hard question is, how do you do that? How does a CISO stay continuously aware? Besides taking every sales call from every vendor that wants a minute of your time, how can you proactively lean forward and know what the capabilities are?

I think there's a lot of different ways to do that. I like what financial services is doing. Many of them have a lean forward team that's looking at new capabilities and they'll build operational components for what they really like in small pilots and if it's successful, they'll expand it out, then hand it over to the operations team. So I think that's a good way to do it if you have the capabilities. I think one of the other things you can do that's critically important in this day and age of so many vendors is to build a really good relationship out there with your peers in the industry, in your vertical and have those conversations continuously. Go to organizations like OODA Loop and look to see what they're talking about and have those conversations through them and through others with your peers to talk about what worked for them and what didn't work. Because quite often we see technology where organization just keeps renewing it and renewing it, but there's very little value in it. They're stopping 40% of scans with something that was really good 15 years ago and yet they still continue to spend on it. The best thing is talking to your peers.

Great. Yeah, great advice. Well, Tony, thanks for all this. I really, really appreciate it. And I wanted to end with kind of a concluding question. If you have any wrap up thoughts for us on any advice or guidance that people should consider going forward, anything that we ought to be aware of, of the coming threat or any kind of concluding comments.

Well, you know, in this age of doom and gloom, I posted something on LinkedIn that got a lot of coverage and I didn't write it, I just wrote some comments around it. And it was, you know, thinking about, you know, all the pandemics that have happened over, you know, recorded history for humans. And we've gotten through all of them. Some have had a massive impact, some have had lesser impact, but humans have gotten through them. We're going to get through this. If you relate that today to cyber attacks and, you know, the advancing capabilities of our adversaries, we're going to get through that as well. We're going to get better at cybersecurity. We're going to have more discussions around the globe, start to build cyber norms and potentially start to really prosecute these people and at least limit the nation state attacks to espionage, something that's been going on for millennia. So I think that the world is going to get better. The world is going to advance with technology and we just need to do our best to help, you know, and leave it a little bit better than it was when we first started out. Really appreciate your time and thank you for including me, Bob.

All right, well, thanks, Tony. We'll see you later.

Thanks.

Thanks for listening to this. OODA Loop production For the latest analysis on cybersecurity technology and global risks, please visit www.ooda loop.com.