Commanders of the International Cyber World: Matthew Devost

Cybersecurity is indeed a serious business.

And.

Innovation in the cybersecurity industry is a serious business. So just to better understand who are the people that sit in this crowd, please raise your hand if you are an Israeli. If you're from Israel, raise your hand. If you're not from Israel, please raise your hand. Amazing. I think there are more non Israelis here than Israelis. This is amazing, guys. You walk those the halls of the university and between the different buildings. Remember, there are so many people. This will be probably one of the only chances you will get to meet them, exchange business cards, have a discussion. Don't spend your time with the people that you already know. Spend your time with new people. Make sure that you create long lasting relationships. I want to call the next speaker, Matthew Devote. He is a managing director of Accenture Security and he will take the stage now. Matthew, the stage is yours.

Thank you. They didn't want to mic me up while the Prime Minister was speaking because I represented a security threat. So. And I also wanted to be able to walk around. So it's a pleasure to be here today to have a clicker. Maybe I need to. There's a next. All right. We heard this morning about CheckPoint being started 24 years ago. I want to take you back one year prior to that, 25 years ago, when I was actually a student getting ready to go to grad school and I wanted to write my thesis topic on what I called the threat of information warfare. The threat to our national security posed by our increasing dependence on computer technology. And it was denied. It was viewed as not a valid national security topic to be talking about that issue 25 years ago. I think we can say now that the topic has been accepted into the mainstream. We have this event, we have events around the world, we have a great dialogue, new normal. We heard this morning how we're going to have cyber historians and cyber anthropologists, a whole field of study being incorporated into everything we do, which I think is an important aspect of what we're hearing here today. It is permeating every piece of our lives. Critical infrastructure, our individual privacy, the way in which we do business, all has a cyber component. Today I want to talk a little bit about some of the issues that we're facing, some of the challenges that we're facing, and then some of my thoughts, having been in this space for 25 years, around what we need to be doing from a thinking perspective to address those. So intellectual property theft, obviously a huge issue. We've heard General Hayden and others over the years Say that intellectual property theft represents the greatest transfer of wealth in the history of civilizations. That would be a significant problem. But we've also seen where that has been diminishing over time. We have diplomatic recourse. We have ways in which we can have conversations with each other around intellectual property theft to try and denormalize some of that behavior. We also have this issue that I call innovation parity, in which case, when you steal a lot of intellectual property, does it make sense to smart people on developing your own intellectual property? So we're seeing hubs of innovation emerge from areas that might traditionally rely on IP theft. Cybercrime, another huge issue. Cybercrime having an impact on the gross domestic product for some of the nations that are engaged in those criminal activities. And it's not just about breaking into bank accounts and stealing money. We're also seeing attacks where business processes are being targeted. You saw in the media just a few weeks ago where there was an attack against Facebook in Google in which the perpetrators stole $100 million from each of them. That was not a sophisticated attack in which the attacker went in, hacked into their banking systems and stole the money. They convinced someone to make a change in one database that resulted in $200 million being stolen from those organizations. So you see this refocus in the cyber crime domain, not just on traditional measures that we would consider, but also on stake studying these business processes, figuring out how to exploit the ways in which we do business. Because as we noted, everything is now in the cyber domain. We've also seen what I call the resurgence of ransomware, primarily around the fact that we have technologies like Bitcoin available that have allowed us to create a cybercrime. Companies in which you can go and provide your credit card number, convert it to Bitcoin and pay the ransom. So we've seen an ecosystem that is sustainable and that has caused a very large increase in just watching over the past year or 18 months in that type of attack taking place, espionage. And I'm a little disappointed because I originally had spy versus Spy as my graphic for this slide, but we couldn't use it over copyright issues. So I feel like I was on the same wavelength as Prime Minister at least. Why are spies in cyberspace? It's the same reason why Willie Sutton said, why do you rob banks? It's because it's where the money is, right? Our lives have moved into the cyber domain, so naturally our intelligence agencies are going to move there as well. So we see every nation out there actively going and exploiting These networks because they have to, right? It's part of their mission statement, it's part of their job. They've merged into that cyber domain as well. We have networks, including social media networks represent, if you look at it from an intelligence agency perspective, one of the greatest technological achievements ever, where a billion plus people are putting the entirety of their lives into that digital domain. So it's driving there as well. We have the non state actors, we have entities that are engaging in theft of content solely for the purpose of releasing it online. With WikiLeaks phenomena, we see tools that are being released online, we see those tools being exploited by bad actors, we see entities and proprietary content being posted online. They might not be trying to steal your intellectual property, sell it in the black market. They might be stealing it and releasing it on the Internet. One of my best friends to date, if you go search on his name, the number one result returned is a WikiLeaks page as a copy of an was compromised as part of the WikiLeaks attack. So forever his life has changed. Every time you search for him you get this private email that was which makes it very easy for you entities, attackers to create a dossier around us as individuals. I view 2015 as a very bad year for Matt DeVoe. I had a participation in a health records breach in a credit bureau. So financial information. And then for those that aren't familiar with the Office of Personnel and Management, that is where you fill out forms for folks with a clearance in the United States, where you provide the entirety of your life, all of your direct family, every place that you've lived, references, everywhere that you've worked, your foreign contacts, your foreign trips, etc. Think about the targeting that you could do against me. Just based on what was released in 2015, it's pretty substantial. Health, financial, personal information. I'm thankful to date that this is a triangle and not a square, because if it was a square would mean I was also compromised in the Ashley Madison breach. So there are some things to be thankful for. And I've spent a long part of my career going back 25 years thinking about this in the context of critical infrastructure attack as well. And one phenomenon that we always speak to is this disconnect between capability and intent. If you think about a terrorist organization, do they have the intent to target our critical infrastructure and cause some sort of sustainable attack? Yes, they do. Do they have the capability? No, not today. Then you think about a nation state. Does a nation state have the capability to engage in a targeted attack against Critical infrastructure. We've seen in and out that yes, they have that capability, but do they have the intent? No. Global economic interdependence. We have lots of classic deterrents that prevent us from engaging in wide scale critical infrastructure attacks against each other. So deterrence plays a huge role. But we need to recognize that we already do have some deterrence measures in place. What we need to worry about is where these lines start to converge, where those attackers that have the intent develop a full capability, or where the geopolitics change, in which case an entity with the capability develops the intent to target critical infrastructure. So when I get worried at night, I worry about the alignment of those two intersections where we would have a sustainable attack on critical infrastructure leading to some sort of horrific type event. Right. A power grid going down would have an impact on public safety. We wouldn't be talking about Google losing $100 million and being able to recover it. Completely different context. So a critical infrastructure attack is going to have that sustainable impact to public safety. It's going to have that economic impact. And we need to be worried not about how those attackers are viewing that critical infrastructure space now, but how they view it in the future. Here is our opportunity, we heard during some of the fill this morning, the opportunity to maybe create a new, more secure version of the Internet. We have the opportunity as it relates to critical infrastructure as we develop new emerging technologies like the Internet of Things, to think about security upfront, to prevent what I call this strategic penetration for future exploitation. And that's where an attacker will target critical infrastructure without the current intent. They don't currently want to take a power grid down, go after an oil refinery, but they can envision a world in which they might have that intent in the future. This time shifted intent and those types of attacks, I would argue, as you think about topic this week, look much different from the types of attacks that we're used to dealing with. They're not going in and engaging in destructive behavior. They're not going in and exfiltrating lots of data. They're going in and establishing a capability that they can use in the future. So shift a little talk about how we address some of these issues. What are the frameworks that you need to be thinking about? We have a commercial that was famous in the 1980s in the United States for Dunkin Donuts, the coffee and donut chain where the guy woke up every day and said to make the donuts. And I feel like in security we're kind of faced with the same thing. It's time to make security. We wake up, you go to the conference, you buy the technologies, you implement the technologies, you kind of in the routine. I've spent my career as a red teamer and what you see being made on stage here obviously is a very robust chain link. And as a red teamer, this is the reality that I'm often faced with. The best aspirations don't often lead to perfect implementation. And to take it one step further, how many times do you think that that padlock was locked and unlocked despite the existence of the zip tie there? They accepted the security deficiency very visible. They had great aspirations from a security perspective, but poor implementation. So that's one of the things that we need to address. We also for 25 plus years have had this disparity between attackers and defenders. We like to speak to the attacker advantage, the ways in which the attack can outpace the defense. Neal Stephenson in his book put it very well, when you're wrestling for possession of the sword, the man with the handle always wins. In defense, we've always had our hand on the blade. And that's a disparity that we need to address as well. We need to be finding those technologies that allow us to gain some bit of defender's advantage. And how do we do that? Maybe we do that by thinking about security a little bit differently, thinking about what we determine to be success, thinking about what metrics that we use. Big fan of traditional business management. Jack Welch is known as one of the greatest managers in the world. And he has this quote that you get the behavior that you measure and you reward. What things are we right now from a cyber defense perspective, what things are we measuring? Are they the right things? I'm guilty of it as well. I've sat in a briefing to a board of directors and I've said you had 250 high level vulnerabilities and now you have 245. That's better, right? 250 to 245 is better. We've decreased the number. But maybe it's the wrong way to be thinking about that problem. Maybe we should be thinking about it first. From a time to detection, those metrics with the checkpoint presentation, reducing that time to detection from a number of months to a number of days to. Abilities, from 200. Thinking about how you measure cybersecurity and what we determined to be success in this space. This is a psychological study for those as a participant, you would be brought in and you would be sat down in front of a TV screen and you're told very simply that you need to count the number of times that the players in the white T shirts passed the basketball amongst themselves. They then proceed to pass the basketball amongst themselves. Halfway through the video, a person in a gorilla suit walks. Video viewing are then subjected to a survey in which you're asked if you saw the gorilla. 50% of the participants missed the gorilla. That, to me, is a great analogy for how we're engaging in cyber defense right now. Right? We think about, we put a security operation in place, we've got tier one, tier two, tier three levels of support. But what are we doing to actively hunt? What are we doing to prevent this ion glass that prevents from seeing the gorilla that's walking into our network? Or to steal the analogy from this morning, that prevents us from realizing that we're walking around in knee deep, Not just monitoring of network, but hunting on the network. How does an attacker see the network? How can we protect against that? Recognize your attacker is not a one or a zero. We heard that earlier today. Can be traced back to a human being, which means that incorporating think about security is very important as well. Right. We need to understand what attackers are targeting us, how they might target us, how they're targeting our peers. Recognize that there is a living, breathing human adversary on the other end, that the ones and the zeros are just the mechanism in which they're targeting us. So again, bringing a threat intelligence approach into the equation, recognizing that some of our old concepts around cybersecurity need to be abandoned. Perimeter security. We heard this morning from the creator of the first firewall that firewalls are not sufficient. What do you do if the attacker is already inside your network? How does that change your security posture? I had the opportunity a few years ago to help the Department of Defense in the United States create their first cyber strategy. And one of the things that I was a huge proponent of, that I argued over the most, was this case for presumption of breach. How do you think differently about security? When you assume the attacker is already on the network and you have to keep going, conducting your job, business as normal, it gives you an entirely different model to be thinking about. Another great quote around planning. We engage in a ton of planning around cybersecurity, right? So no plan survives contact with the enemy. How are you exercising that plan? Or as Mike Tyson said, a little bit better. Everyone has a plan until they get punched in the mouth. This highlights the importance of red teaming I mentioned I'm a red teamer by trade, so this is an important slide for me. But we need to be testing our networks from the perspective of the attacker, not with the gloves on, the gloves off approach. You know, if you were training to fight Mike Tyson, would you train just hitting a static punching bag, or would you train with a sparring partner? That's going to allow you to exercise yourself, to see how a human attacker sees you, identify those weaknesses that you can correct. So we have to be engaging in realistic red teaming to understand how an attacker sees us. And that gives us the advantage to learn from our failures in cyber security. We have this bad habit of only learning from those failures that are the result of. Of a breach, the result of something bad happening. But if you engage in red teaming and exercising, you can actually discover those critical vulnerabilities, discover those issues. You can fail, maybe even fail at scale without there being real impact from it. Lots of reasons to be a pessimist around cybersecurity. We talk about the attackers having the advantage, et cetera. But there are also a lot of reasons to be excited. And I think that's probably going to be the highlight of your week, is thinking about how these technologies are going to change the domain from a cybersecurity perspective. Being able to introduce behavior analytics, machine learning, artificial intelligence, all things that we know the attackers are going to adopt in their way, that they attack us. We are going to be able to use those technologies from a cyber defense perspective as well. And that's something that we should be excited about and optimistic about. And with that concludes my remarks.