Cybersecurity Meetup Cybersecurity Predictions

Matt, let's talk about 2023 and your published predictions on what's going to happen. Do you already feel like they're going to hold true, or any reason to retract some of them?

No, I, I do. I think they're going to come true. It's going to be interesting how they manifest though, right? Um, again, when I'm doing the predictions, it's strategic, but then I start bringing it down to much, much more specific level. But it's important to know what what's behind it, right? It's not a random let's throw a dart and guess something. For every attack out there, there is an attacker living and breathing, and for every attacker, they have motivation, objectives, resources, limitations, all that. So when you start distilling that picture down, you can start, you know, fine-tuning it. But we're gonna have a very interesting new epoch coming up that we're gonna see in 2023, and it's just gonna, you know, rise, right? It's going to be a new facet that we have to deal with in our industry. So we have to get ready now. We don't want it to be a surprise and look back, you know, as we're in 2024 looking back at the truck that hit us and wondering what the license plate was. It's better to at least see that truck coming and, and trying to maneuver around it.

So give us some examples.

Okay, some examples. Um, number one, nation states all over the world, especially aggressive ones, are consciously deciding, yes, this makes a whole lot of sense for foreign policy, for military, for government, for everything else. I really want to undermine my adversaries around the world. We're making a conscious decision. Offensive cyber operations is where we want to invest. Now, some companies were already— or countries were kind of doing that and maybe going a little bit into it and testing the waters. It's no longer a test. The test is over. We agree we're going at it. And what that then does is that opens the purse strings. So where there was limited investment or, oh, well, let's do it through some, you know, third-party mercenary cybercriminal group. We'll kind of go, you know, one foot in the water, get half pregnant, that kind of thing. Nope. Gloves are off. How can we spend $20 billion in this? Right. Let's formalize a budget. Let's define some very, very clear goals. So once you make the decision, it opens up the budget. Right, so we're gonna see a flood of money come in where buying a $2 million zero-day, that's gonna be nothing. Yeah, how many is gonna be the question. It's not should we spend that money, it's yeah, we wanna have 10 or 15 in the bank, right, ready to go. Okay, it's going to shift the expectations of who's doing the attacking. And there's a trade-off there because a lot of these countries really kind of wanna keep an arm's distance. They wanna be protected from attribution. So they're going to be able to— they're going to be willing to sacrifice a little bit of that simply for the gains in pushing foreign policy, in undermining the technology and positions of their adversaries around the world. So we're going to see that. We're going to see the professionalism go up. We're going to see less dependency on the rogue cyber mercenaries and these hodgepodge of cyber criminal teams. And they're going to get more professional. In fact, I even predicted we are going to see by the end of next year, we're going to see see private military companies like, you know, you see Wagner or Wagner in the, in the news, right? They've got kinetic military. We're going to see that level of organization, commitment, and integration with some of these governments, but on the cyber level. In fact, I would, I would be surprised if Wagner doesn't extend their current misinformation, their online misinformation and disinformation group to start doing this, but again, with much more regimen and much more control and much more integration. And these host countries can provide not only nation-level intelligence, but also assets around the world to complement and assist. And that's something that was a little iffy for most of these. Some countries were able to do it, others weren't. We're gonna see an uptick, huge uptick, that increases the overall risk for everybody. And I know a lot of people think, well, my small business, Russia, China, they're not gonna attack mine, I'm fine. No, actually you're not. Because when all this money gets poured in to discover new vulnerabilities and writing exploits and everything else, the moment they hit the red button and release it to the world, it's available. And every criminal and researcher and whatnot are gonna grab these million or 10 millions of dollars worth of pristine hacking code and vulnerabilities, they're gonna tear it apart and dissect it, and then they're gonna use bits and pieces of it. Why spend the time trying to code and test things yourself when there's a government out there that's gonna spend billions of dollars doing it for you? All you have to do is capture it, tear it apart. Now you put it in your ransomware, you put it in your malware, your phishing. You are gonna go after Grandma. You are gonna go after that small and medium business. You're gonna go after it for money. Right. So yeah, it affects all of us. It's not just the, the national critical infrastructure. It's not just those governments. We all play in this. We all suffer. So strategically, we see a shift. Tactically, it creates a lot of pain.

So brilliant. That's just such a great, great way to look into the future, right? Look at the adversaries and how they're changing over time. And you've identified that it's the state actors who are going to have the budgets and fuel all the rest of the adversaries.

Unfortunately. Now, how do we respond? That becomes the question and a challenge.

The, you know, one adversary, of course, is the SRV. No, I'm thinking of Silicon Valley Bank. SRV. So the spy agency.

SVB. Yeah, the spy agency for Russia.

Again, could be an adversary.

Could be.

Could be. So they infiltrated SolarWinds and they compromised the new software update, which got deployed to 18,000 of their customers. And it just, it was pretty much a devastating attack for which there is no defense. So I've been waiting now close on 2 years for all the vendors to come forward and say, oh, we can stop that. All I hear is vendors who say, oh, we have something to sell to SolarWinds to improve their CI/CD processes. That's old news, right? We, we know We know that, yeah, SolarWinds could have been a little better. SolarWinds is pretty dang good at software development, and they've got good software distribution and signing procedures and all the rest. But what about the poor enterprise? You know, the IT people at a bank who are constantly accepting updates from their software vendors because you and I have told people to patch, patch, patch forever. That's all CISA does right now is tell everybody there's a new vulnerability we should patch. Well, getting people to patch is a great way to get them to update their software and include the malware that you've just sent to them or backdoors. So my prediction is that in 2023, we're gonna start seeing solutions that will tear apart the updates, do the diff on them, do essentially reverse engineering on the code and tell you when backdoors, embedded IP addresses, you know, DNS morphing attacks are present in that code. And I look forward to seeing that? Because whoever does that is going to be a very successful company.

I don't think it's going to happen, honestly. And the reason, at least here in the US, the reason has to do with IP rights. In order to really do that, you have to have the uncompiled code and you can try and break it and get there. It takes some work, but in doing so, you're now violating the intellectual property rights of that company. Yeah, they can turn around and see you. No, unless they agree. And if they're going to agree, well then they should just give you the code anyway. You shouldn't have to break it. Well, okay, if they're going to do that, that's their business, their secret sauce. And so it exposes their secret sauce for their competitors to use it, or some national company in China or Russia to decide, hey, I want to create this business tomorrow. Wow, they just gave me all the IP. So there becomes a problem there. And legally and from a business perspective, I cannot imagine a board going, oh yeah, we've got secret code here. This is our business. This is all our revenue. This is our competitiveness. Yeah, let's go ahead and give them a decrypted copy so they can look at our code and check our code. There's no upside to that.

So two things.

Right.

To your comments on regulations. If, remember the new National Cybersecurity Strategy strategy document that was published. It specifically said that software developers cannot hide behind contractual relationships. And I think this is one of them, because every single contract I've ever seen says you will not reverse engineer a code, right?

That's right. So I don't see that changing.

So unless Congress steps in or regulatory agency says, sorry, for this purpose, you know, you can get them to agree not to use code that they see from you,, you know, in your own stuff, but you have to let them check it because we can't establish trust that, that your code's going to be good all the time because it's impossible.

So I read that and interpreted it completely different. It wasn't mandating, and it doesn't specify at all, that you have to decrypt your code and provide your intellectual property to your competitors. What it does reference is saying that you cannot hide from liability Accountability. And that's really what they're pushing, right? That software, hardware, and firmware vendors need to be able to be held accountable for the damages that they cause. So they can't say, oh, well, we wrote it in our EULA that we're not responsible for any damage our software does, so we're not. Nope. That's what's gonna be removed out of the EULA. It's not, I've gotta lift up my kimono and give you all my IP. That absolutely will never happen. Not, not in a democratic, you know, environment where you have entrepreneurs.

Could happen. But luckily there's a technological solution. So the people who are showing me what they're doing in this realm demonstrate they're not extracting code, right? They don't, you know, maybe you can read comments or something, but they're extracting what the code does. So they can see, they can see backdoors, they can see outside connections, which is all you need. You just want to check it for that for now. You know, the attackers will get much, much better at doing this if that becomes a defensive measure. But there's going to be ways. There has to be ways or nobody will ever accept another software update.

I agree with you. The testing and the sandboxing and the validation, I completely agree with you because again, you don't have to dive into the code. It's very similar to how anti-malware engines will take a file or whatever and they may drop it into a sandbox see what it does, right? See what connections it makes and what processes it uses and see if it tries to be a loader and, you know, bring other software and code in. Okay, great. Yes, absolutely. I 100% agree with you. That's gonna happen more as it should. But this is where the arms race gets in. This is where the attackers, as soon as they realize that's gonna happen, right? They're gonna put in and, Many already are, right? Many already in their malicious code, they look to see if they're dropped in a sandbox, in which case they act perfectly innocent, right? So again, it's an arms race. The defenders start doing this, well then the attackers are gonna evolve. And what we saw in the past is it's a whole lot easier for the attacker to evolve than it is for the defender to take it to the next step. So there is an economic disparity, not only in money, and knowledge, but also in time. So there's gonna be some challenges there. It's not a perfect world, and I'm not sure if it's the battle we necessarily wanna fight. I do like where CISA's going. I do like where the National Cybersecurity Strategy coming outta the White House is going and simply saying, hey, we're gonna hold you accountable. Maybe your stockholders aren't, maybe even your customers aren't, maybe they're, accepting being violated and, and so forth. But we're not, which is going to open the doors to one of this nation's most powerful underutilized tool in cybersecurity lawsuits. Right. Nobody likes a lawsuit. Even the board doesn't like lawsuits. So if you start saying, hey, you have to be accountable, if you knowingly put in code, you're using an open source applet that isn't the latest version and has security vulnerabilities, or you haven't checked your code with the basic tools to make sure your parameters are set right and memory is— if you're not doing that, guess what? Your customers, vendors, and your insurance can turn around and go, insurance is not gonna pay. And your customers and vendors can turn around and sue you and maybe more than just initial damages. Maybe it's for a lot more. That puts the financial incentive, that changes that financial incentive to an equation where now, okay, it makes a whole lot of sense to be doing what we should have been doing to begin with, doing the security thing and making sure our code is resilient, making sure those updates are resilient. And, you know, as for the fact, if you've got a vendor that's pushing out software that its entire system basically is getting corrupted and you've got 1,200, 1,800, 2,000 big customers, including critical infrastructure, The solution is not to use that vendor, right? And it doesn't matter whether it's the social media, it doesn't matter if it's an IT operations vendor, right? But in the supply chain example you were talking about, I would disagree and say their security practices weren't all that good, right? When you installed that particular piece of software, by the way, it told you to turn off, to exclude it from anti-malware searches. Any software that is telling me, hey, just trust me completely and don't run it by your security, that's a red flag. That means they've done something wrong or were just lazy, right? So I mean, my advice when that came out was ditch 'em, ditch all their products because if they had this level of security awareness and commitment to that one product, I guarantee you it flows across the entire organization. And there were interviews from the previous CISO that basically said the same thing. So, you know, walk away, run away from vendors that show themselves to not be trustworthy. Trust is the currency of cybersecurity.