Cybersecurity - Matt Devost, President and CEO of FusionX

Come grab this clicker. Hey, good morning. It's great to be able to talk to you about these issues. Just a little bit about my bias as it relates. I work a lot on managing risk. Right. So a lot of what I'm going to talk to you about today is risk related, but I don't want you to put that in the context of the opportunity as well. A lot of discussions yesterday about risk, vice opportunity, a lot of my focus is on risk, but I don't want you to lose sight of the fact that in a lot of these spaces that there's opportunity as well. And a lot of these risks tend to be very dynamic and complex and are things that need to be managed, which is something I'm going to stress as well. Just like you would manage a company, there are risks that need to be managed within your organizations. And cyber is kind of one of those key risks that's emerged here over time. My context for talking about cybersecurity, if anybody's seen the Matrix, is too many people have been taking the blue pill for too long and that it's time to take the red pill and kind of look at the reality of the issues that are facing us. I've been focused on cybersecurity issues for 20 years, starting with as a graduate student when I walked in and said, hey, I would like to do my thesis on the implications, the national security implications of our increasing dependence on technology and the vulnerabilities inherent in those technologies. And I basically was kicked out of the political science department who said, go focus on the national security implications of foreign free trade. Eventually won them over and was able to do my thesis. But for 20 years I've watched people argue about the same things and talk about the same exact issues and not do anything with regards to addressing the fundamental risks associated with cybersecurity. So I argue now it's time to actually take the red pill. Let's wake up and kind of see what the risks are and what we can do. This slide was built with two colleagues of mine back in 1995. That's just a real simple way to think about cyber risks in the context of the real world. It was from a paper called Information Terrorism, can you trust your toaster? Sort of a catchy title associated with it as well. But it proposed, it said, we basically have two types of targets. We have physical targets and we have digital targets. And we have two ways to attack those targets, physical means and digital means. And for some of you, you exist purely in that kind of cell D where you're going to be a digital attack against a digital target. But there's some of you that are going to reside, especially in the energy sector in that quadrant that says we're going to use a digital tool against a physical target. We're going to try and hack into your control systems in order to have an impact on your operations or on the infrastructure that you're providing. And we see a lot of those types of attack attempts take place. And of course you can use the physical on physical, which is kind of a pure conventional terrorism and a physical attack on digital resources. If you read any of Richard Clark's books, a former National Security advisor, he focuses in his fiction on if I want to take down the Internet, I don't do it by hacking the DNS system. I do it by taking down the fiber optic connect points. I take down the private peering centers. I engage in all these low tech kind of truck bomb attacks in order to have that impact. So I'm going to talk basically about two different areas. One is the threat environment and then one is the. The second area is the solutions associated with some of those threats. And I'm going to go through some of these rather quickly. I don't take three and a half days to do my presentation, but it typically takes me about two hours. So we're going to rush through a lot of different things. Unstructured hackers are out there. They're a threat that exists. I'm not going to spend a lot of time but just liken it as the kind of if a million monkeys can sit down at a million keyboards and write the great works of Shakespeare, if you have a million hackers out there hacking against millions of systems, eventually somebody's going to get in either through luck or through some combination of techniques that allows them either intentionally or accidentally, to have some sort of devastating impact on some sort of critical infrastructure. So they're out there. There's a lot of noise associated with it. And that's something we're going to focus a lot of time on. Hacktivists and activists. The hacktivist community emerged over a decade ago, attacking targets like the White House, the Department of Defense, some foreign stock exchanges received some press and then kind of died out and has re arisen again with traditional activist organizations targeting entities like the Earth Liberation Front, Animal Liberation Front announcing they're going to use electronic attacks. Then you see the emergence of entities like Anonymous that are going after some of these companies based on ad hoc informal groups that arose out of an Internet chat form that have demonstrated that they're able to actually have an impact on some of those companies that they target insiders. Another issue, especially when it comes to the theft of intellectual property. And there's two kind of components to the insiders. I can recruit insiders. I work a lot with folks from the intel community, and they always tell me, matt, why are you taking four months and your red team to go and steal this intellectual property? I could probably get it with two days if you put me in the right location with the right bar and the right type of operative to go and try and recruit that information or find people's vulnerabilities and get access to some of that insider information. And then the other piece of this is insider placement, which is a technique we first started seeing again over about 10 years ago, where you had companies that had put in a pretty good security posture where their perimeter was fairly secure, wasn't able to be penetrated from the outside. So people were placing folks inside the organization. They were going to monster.com and looking and saying, what types of jobs can I get within the organization? And then they're on the inside of the firewall. And it turns out that once they're on the inside, the network was wide open and they would immediately start stealing intellectual property. So there's that potential risk from insiders being placed intentionally in the organization as well. Single issue or displaced terrorist groups? The best analogy I like to look at in this context is aviation hijackings. Anyone would like to guess how many aviation hijackings we've had over the past 20 years? 20 to 30 years. Any guesses? The official number is over 1,000. So no one actually agrees with regards to, you know, is it 1100 or 1,050? But all the experts agree that it's over 1000. How many with the intent to use the plane as a weapon of mass destruction prior to September 11th? We have one. There is an Algerian terrorist that hijacked an Air France flight that actually wanted to fly it into the Eiffel Tower. But they didn't know how to pilot the plane. And for some reason, they couldn't convince the pilot to proceed with the mission, which was actually cited as a key lesson learned for Al Qaeda, saying, okay, if we're going to use this as a tactic, we have to have people that know how to fly the planes. Because you can't just point a gun at a pilot's head and tell them to fly it into the Eiffel Tower. It doesn't work. So why did people hijack it fell into three general categories to attract attention to a particular group or cause. They wanted to be on the news channels, they wanted to be on the COVID of Time magazine as a tool for engaging in negotiation, political negotiation. And then the third was kind of a throwaway, was for geographic escape. So I feel like I'm persecuted in country A. I get on a plane, it's going between two cities, I hijack it to country B and I go and ask for asylum and go there. What are these groups able to do in a post September 11th, especially the ones that engage in the hijacking, to attract attention to a group or cause or engage in political negotiation? You can't hijack a plane for those purposes because what's going to happen? You're going to get your ass kicked. Right. The perception of the passengers has changed with regards to the intent of the hijackers. So they're going to be looking for alternative means. And we see some of these groups looking at cyber attack as, hey, this would be great. If I want to attract attention to my group and I can go and hack Twitter or I can hack one of these major companies, I'm going to get the news coverage that I'm looking for. Are there mechanisms that I can use to target critical infrastructure and use that as a political negotiation? I saw one activist group almost 20 years ago looking to go after electric power and telecommunications in Memphis, Tennessee, in order to use it as political negotiation to get somebody released from jail. So there's these displaced and kind of single issue groups that exist out there as well. The international terrorist groups like Al Qaeda don't have a great capability, but it's something that has definitely been on their target screen saying that they want to develop some sort of cyber attack capability. There's a whole field of study associated with what terrorists are doing as it relates to cyberspace. And then the big one, one of the biggest ones that everyone's interested in because of the news headlines is the nation states that are out there engaging in attacks for a whole slew of purposes. The CIA went on the record over 10 years ago saying that there are 100 plus nations developing an information warfare capability. It's not a useful stat other than we know that there's 100 nations that are looking to utilize the capability. We don't know if it's for IP theft, we don't know if it's to engage in future attacks, but they're out there investing resources, developing the capability to attack targets in cyberspace. There's a great document that kind of sets the framework for some of these issues. That was again published over a decade ago. When people come and talk to me about the China threat in cyberspace, I said, well, we can go back a decade and look at this document, Unrestricted warfare that came out of China. That said, in the future you won't have traditional conflict between states unless you can predetermine the outcome. So US vs Coalition of the willing in Iraq. With the coalition of the willing in Iraq, you can Predetermine the outcome. US vs China. I don't care how many smart war gamers you put in a room and admirals and generals and policies and planners, folks, you cannot predetermine what the outcome would be of conventional conflict. So they argued that instead what you're going to move is to these little unrestricted wars that take place for strategic influence. The number one issue they look at was attacks, information warfare attacks in cyberspace. Number two issue is economic destabilization. There's a lot of objectives you can achieve by destabilizing an economy. And they looked at the Barings bank issue as a case study in that as well. And then the third was potentially using the sponsorship of conventional terrorism, if you could do it anonymously. So there's dialogue that's existed out there that kind of acknowledges cyberspace is a new domain of strategic influence. It's a new domain of conflict that existed in some of these other countries like China and Russia, going back 10 years ago, the United States, we declared cyberspace as a new domain of conflict about three months ago. So we're a little behind the curve in acknowledging the significance of that space. Why are these nation states engaging in attacks? It turns out there's several reasons. One is to use it as an extension of state surveillance. So you have regimes that are heavily focused on surveilling the population that find that, hey, their population is not communicating via the state of communication, they're using a third party service. And so in order to get access to that surveillance capability, they need to penetrate the third party provider in order to engage in that surveillance. So you see that taking place where you might be a target just because you help facilitate conversation amongst people that they are interested in monitoring steal intellectual property. Another key one. I think one of the key concerns why I'm here today is that the intellectual property in a lot of organizations tends to reside on networks, in computer systems a lot with very inadequate protections. And you see these huge campaigns devoted to just going out and targeting entities to steal intellectual property, whether they're going to bring it to market or not, it becomes this treasure trove that you can filter through and basically decide, okay, we can apply this here, we can apply that there, we can ignore this entirely. But there's this huge kind of gathering of data and IP that takes place every single day by a lot of these actors against a wide variety of organizations. If you have an interesting technology or an interesting approach to anything, it's likely you're going to wind up on the target list just from an intellectual property perspective alone. Intelligence and espionage. So obviously cyberspace as the kind of new domain of warfare, with so much of our personal information being gathered and collected in cyberspace, is being used for those methods as well. Traditional intelligence collecting, things that I would normally have to do with a human being, I don't have to do with a human being. I don't have to go and surveil you and find out who your contacts are. I can go and look and see who your friends are on Facebook. I can do that. Social network exploitation and things to kind of engage in the traditional intelligence gathering and then espionage from a state perspective, targeting the US Government, targeting, as you saw in the media, the political campaigns associated with the last election, with the think tanks that were associated with placing the appointed officials in the incoming Obama administration to get that insight and be able to engage in those intelligence and espionage activities as a launch point to other targets. And I was talking with one of the companies here last night. You might be a target just simply based on the information about your users that you contain. I worked a very interesting case with a small nonprofit that was very high profile, interacted with a lot of celebrities, with a lot of prominent business people, with a lot of prominent politicians, and they were attacked. And they thought, okay, this is somebody who is China. They thought it was China. The IP is related to China. It's very difficult in cyberspace to do absolutely attribution, but they were pretty certain that it was China. The IP addresses pointed to China and they said, well, it's because they don't like us and they don't like our mission. But the reality when we went and looked at the attack was the target was just tangential to the ultimate objective. And that was they wanted the Rolodex of personal email addresses, mobile numbers, and a legitimate method for corresponding with these individuals that would allow them to do a very targeted spear phishing campaign. So if you think about it, and I'm Angelina Jolie and I receive a piece of email in my inbox from Walmart, that spam or has malware, I'm not going to open it. If I'm supporting an organization like Save Dar 4 and I get the quarterly report in PDF format that's coming to me that I'm expecting every month, I'm going to open it. So it resulted in an infection rate that would be less than half of a percent in a typical campaign to an infection rate that was over 70%. So the organization was targeted simply because they were a treasure trove of information that could be used to exploit other people. Strategic penetration for future exploitation we see this a lot in the critical infrastructure space where they're establishing a presence in the critical infrastructure just for the purpose of having the presence in case it might be needed. It's the cyber equivalent of pre planting explosives in the ball bearing plant prior to World War II. If you have that capability to go and just pre position, we might not ever be engaged in conflict, but we just want to have that capability in future. The future. So you engage in that penetration just on the hedge that you might need that access in the future. These, from my perspective, are the scariest types of attacks because they're the most difficult to detect. Once they're in and they've covered their tracks, they're very, very quiet on the network. They're not going out probing other systems, they're not stealing intellectual property and exfiltrating it to a third party server. The axe has been obtained and you have to get very lucky in order to be able to detect if they're actually the still on the network. That raises this distinction of the A team versus the B team. We see that as well out there. There's a former director of darpa, the Defense Advanced Research Projects Agency that I worked with to try and figure out just within one particular country, how many personnel do they have dedicated to targeting folks in cyberspace. And the calculation came out to over 10,000 people whose full time job was focused on targeting entities in cyberspace. But that breaks down into a couple of different levels of capability. You have the B team that's out there constantly looking for vulnerabilities that exist that they can basically put in the queue and go after organizations on kind of a random ad hoc basis. And then you have the A team that's engaged in very strategic targeting. It's the A team that are going after an entity like Google or going after some of these entities that you see in the press. And we see this transition from times from the B team to the A team. If the target is interesting Enough. We saw that with that small nonprofit. When I put my team on site, we started locking them out of the network. We saw very sloppy activity. They didn't cover their tracks well. They used known exploits. Once they realized they were locked out of the network, it was almost like there was a remedy help desk where it was like it bumped up in the queue and said, okay, we need the A team. And we saw an onslaught of attacks for 24 hours using zero day, near zero day attacks, routing through all sorts of different servers all over the world. Just a much higher level of sophistication. So you might be targeted by the B team and there's this low level penetration that takes place. But then if they've identified that you're an interesting target or you have interesting intellectual property, you might have the more sophisticated A team coming after you as well. Organized crime, another threat group that's very, very active in cyberspace. Why are they active in cyberspace? Because that's where the money is, right? I mean, if you want to engage in real large scale financial crime, the best place to go after is electronically. That's where the money is. That's where the transactions are taking place. Just by way of. Over the past year, worked on one fraud scheme that was bringing in $3 million a month and worked on another one we tracked, which was a $40 million scheme that was a huge link to organized crime. Just based on the amount of money that you're bringing in. If you're say sitting in Russia and you have the ability to go and perpetrate a fraud scheme worth $40 million, you're attracting the attention of the legitimate kind of more conventional organized crime as well. So you're seeing that link. You're seeing especially where there might be a market for intellectual property. We work with customers where intellectual property goes missing and then there's no market for it, there's no place to sell it. We work with other customers where intellectual property goes missing and there's a huge active market for people buying and selling that ip. Some of the tactics that are used and we'll speak to just a couple of these from an awareness perspective. Phishing and spear phishing. Probably the number one mechanism that's being used to penetrate organizations right now is selling, sending email to somebody on the inside. Whether that's part of a broad campaign or a very targeted spear phishing campaign. They're going after these organizations, convincing somebody to open a document, click on a link, or do something that infects that machine, that establishes a foothold in that organization that they can later exploit and move out. Here's a great example of one phishing campaign, very targeted, going to a defense contractor, looking like it's coming from an individual associated with the US Government with very specific details about purchasing aircraft and procurement process. Somebody understands that these two individuals would be communicating what they would be communicating about and has written a very detailed spear phishing campaign to increase the likelihood. And the person did click and open this attachment. Because if you're a defense contractor and you see somebody referencing this big, huge order, you can't resist, right? You're going to have to click on it. Here's another one that I got. I'm an adjunct professor at Georgetown. I've been teaching the flagship Information Warfare and Security class there for a decade. And I got an email from my colleague Bruce Hoffman, famous counterterrorism professional, that said, hey, can you please review the attached and give me some advice? Thank you. Well, it seemed kind of fishy. I see Bruce often on campus. In fact, there are years when we teach the courses back to back and we're in the same room and encounter him. And he hadn't mentioned anything to me about this environmental scan. He hadn't called me, hadn't given me any. So I was very suspicious of this email attachment. It turns out that this email attachment was a zero day exploit in Adobe Flash, the same one that was utilized to attack rsa. And this was literally ground zero. I suspected it. We went, we executed it on a safe machine, we watched what happened, saw that it was a zero day, contacted Adobe, and no one had contacted Adobe to date regarding that particular vulnerability. So here you see, they know that I interact with Bruce Hoffman. They know that I might be likely to open an email from him. The one piece I can ever put together is they don't seem to realize that I only use Macs and they keep sending me PC exploits. So it actually wouldn't have worked on my Macs. There was one aspect of their targeting that failed, but still pretty specific campaign. And I consider myself to be pretty low down on the totem pole with regards to the resources you would apply that would include an Adobe zero day that you're also using against an organization like RSA to go after secure ID tokens. What's interesting, my friend Bob Gourley likes to say there's no Moscow rules in cyberspace. If any of you are fans of spy fiction and kind of the unwritten rules that kind of governed espionage relating to the Cold War, particularly in Germany, in Berlin, there's no kind of conventions or norms as it relates to cyberspace. And I think we have a hard time wrapping our head around that, especially from the US Perspective, because we want there to be rules, we want there to be guidelines, we want there to be some sort of norms. They don't exist. That zero day that I wrote or that I mentioned a couple of days before I was targeted with it, the author of the zero day actually posted on Twitter, ready, new Flash zero day is on the way. And he followed it up about a week later with another Flash zero day that was reported in the press that successfully targeted organizations. He was taking requests. Would you like your code put in my exploit so that you kind of live in infamy? And the one he ended up selecting for the second zero day was something that honored the victims of the tsunami in Japan. So he embedded in his code in advance. But can you imagine a US Person saying, okay, I'm getting ready to release a new zero day. It's going into the wild. And that zero day was going to be used to target individuals like my or rsa. There's definitely no norms. This is a great chart from the RSA blog that talks about the attack that took place against them. That kind of focuses on what happens. You get the phishing attack that takes place, the backdoor's put in place, they expand their access to the network, they start gathering data, and then they exfiltrate it. This is the pattern that most of the attacks take place. Malicious websites. Again, if you look at this and this becomes a problem with your customer base, not particularly with your individual servers or technology deployment, but if you look at the URL, what's the problem here? I haven't gone to PayPal, but if I put my credentials in this site, I get an error message and I would bounce to PayPal and then my credentials are going to be used to exfiltrate money from my account. Again, it's a customer issue, but if it's a customer issue, it becomes a PayPal issue. And this is not a real example. I just kind of made this up based on real world issues. Password compromise. Still, the number one way that organizations are compromised once you're on the inside is through the use of poor passwords. This is a public list, but pretty accurate with regards to poor passwords that are used in organizations that include default passwords or ABC or I don't know who baby girl is, but I thought that was an interesting one as well. To be selected by so many people. Social engineering, trying to talk people into giving you secrets. Right? This is how the hacker community views social engineering because there's no patch for human stupidity. So you can always exploit that user base component social media exploitation targeting people based on who they're connected to in social media. This is a comment I made. I was sitting on a plane coming back from the Middle east and I just posted on Facebook. I said, disappointed, I didn't get a chance to friend a Russian spy on Facebook. And a friend said, hey, check on LinkedIn. I'm connected to two of them through you now. To my credit, it wasn't a direct connection. I was one degree of separation. So he was two degrees of separation. But there is that huge aspect of on these social networks. Do you know who your friends are? This is a great example. You can just go look at this. Robin Sage was a campaign against folks that was conducted by a good guy, but that pretended to be a woman that was involved in national security IT security issues that friended a bunch of people and got them to send her proprietary documents. Was able to geotag soldiers that were serving in Afghanistan and Iraq based on photos that they were providing her all in conducting this activity over social media. Turns out that this was actually Robin Sage was actually a male individual that was also a researcher in the national security space that did this as a test. So verify then trust. Because some people are not really your friend. Insider placement. We spoke to mobile device compromise again becoming a huge issue as well. Being able to send the malware via SMS or compromise a mobile device remotely. USB devices, another common mechanism that's used. People pick up USB devices, especially if it's in the workforce or in your parking lot and you say, I just want to please plug it in and see who owns it. Maybe there's important company proprietary information that serves as an infection point. In our testing we get lots of people that way just leaving a USB device, they plug it in and we end up compromising them. Same with wireless access points, supply chain. How many of you, if you received a piece of equipment in the mail that said, hey, we're from hp, congratulations on being a great customer. Here's a printer we'd like you to test out. Do you know who that came from? This is another common way that you can go after organizations. It's network enabled. We can preload malware on there and then we've got that inside box and then direct compromise which is finding that initial domino or that low hanging fruit that we can use to target an organization and then expand the credentials. Lots of technical controls Right. Lots of things that people invest in from an IT security perspective. But there's no silver bullets. Right. I like to align silver bullets with believing in unicorns. Something my 10 year old daughter loves to think about. But not realistic from a security perspective. But there are some silver concepts that I would propose. The first is kind of in the policy and procedure area. Establishing a risk management strategy for the organization. Developing a culture of security. Making sure that your employees know that this is an important issue. Implementing and enforcing policies. Right. Articulating. Here are some of the policies associated with our organization and going out and actually enforcing them in the enterprise. Patch management. If people adequately patch their systems. 95% of the attacks that I've seen out there would never happen. A lot of it is a result of patches that were not deployed in the organization that an attacker was able to take advantage of either once they're on the inside or the outside. Two factor authentication for key systems or ip. Another huge issue associated with people getting their passwords compromised and that being used. Escalate privileges. Identity authentication and authority. Key elements. I think of network security that are often overlooked. Who somebody is. How they are authenticating either to you as an individual or to a server. Then what authority do they have on the network? And then encryption. Right. The no brainer. We see that over and over again. If you look at the Sony attack and the failure to use encryption on the customer data is going to be huge for them. Assessment and audit. Engaging in internal assessments but also third party assessments. And then the last piece is training and awareness. Making sure that your employees know what the risks are. Because the one thing that IT security can never fully control. The individuals in the audience. The individuals in your organizations. You need to make them smart. You need to keep them smart with regards to the current threat. And it's a constant dialogue that needs to take place. And avoid the typical response model which tends to look a lot like the whack a mole game. You're always going to have issues that you need to address. But you want to make your environment look a little bit more like this so that you can manage those risks. You can manage some of those moles that are going to be popping up or at least know where to look and control them. And that's it for my remarks. I think we just have a few minutes for questions. Any questions for Matt?

I'm thinking of the nation state. The hundred nation states that you said were involved in cyber warfare. Is there any such thing as development as the ultimate weapon that would establish a kind of a new balance of terror in that space.

There hasn't been no. I mean there's no. People always like to try and create the analogy to nuclear weapons and nuclear proliferation. There's no kind of equivalent technology in cyberspace right now. Maybe one will emerge, but I'm really doubtful you can acquire a capability so easily. Right. I can go to Best Buy, I can get on a network and I can go and download some tools and I've got a great initial capability that would probably allow me to compromise a majority of the organizations that exist out there. So there's no. We develop a lot of kind of black technologies or approaches to penetrate networks, but there's nothing that's upset the balance of power where we have it and somebody else doesn't. Same on the defensive side. There's no silver bullet that allows us to defend our networks better than an adversary. I think right behind you. I just wondered, if you're a small startup, 10, 20, 30 people and just starting out, what would you recommend in terms of putting sensible procedures in place for security? I think the education and awareness is a key piece making people smart that if they get that type of email from a Bruce Hoffman that they call and verify it and then the encryption depending on what type of data that you're dealing with. So encryption and DRM are critical to make sure people only get access to the data that they should get access to. And then there are real simple things like the two factor authentication. I mean Google. Right now I use Google Apps within my company for the calendaring and for the email and everything. You can enable two factor authentication within Google Apps for free tied to your cell phone. That's a real cheap and easy way, minimally disruptive, where you can achieve a tremendous amount of security associated with just making that switch to the two factor authentication. So we always argue with folks, well, go ahead and turn that on. It doesn't cost you any money. Slightly inconvenient to your user base, but gives you a tremendous amount of security because if they're using the same username and password on your network as they're using on the rockyou.com website and that database gets cracked or the Sony password database gets cracked, crack, it's not going to be used to exploit your organization. Even if they're using the same password, the attacker does not have that second factor authentication component. Great. Well, thanks a lot, Matt. All right, thank you.