Rise of Aggressive Nation State Activities

I want to thank you all for joining us today. And today we have a very special guest. I would like to introduce Matthew Rosenquist. Matthew is the Chief Information Security Officer at Mercury Risk. He's also a cybersecurity strategist. He's a board advisor and a keynote speaker. Matthew, thank you so much for joining us, and it is great to meet you.

My absolute pleasure. It's a great topic today. I'm looking forward to it.

Yeah, we got an awesome topic, so I'm very excited today. And we also have, that also joins me and helps me out with these LinkedIn Live events, I want to thank David Cross, who is the SVP and Chief Information Security Officer at Oracle SaaS Cloud. David, thank you so much.

Always glad to be part of the community here and kind of contribute.

Awesome. Thank you, David, so much. And we also have Alex Mavro, who is one of our great technical guys and our security manager at Medtronic. Thank you, David. Thank you, Alex.

Thank you.

So, Matthew, if you could just quickly just give us a high-level background of yourself and kind of what you do, and then we'll start going to the topics, that'd be fantastic.

Yeah, sounds good. So I'm a CISO. I'm a cybersecurity strategist. I've been in the industry 35 years now. I spent 24 of those with Intel building their first security operations center, was the first incident commander for their cyber crisis kind of events. Managed security going into the core chips, M&A security, built and managed that team for all of the mergers, acquisitions, divestitures, site closures, co-locations, managed and built out the security for AI, including hardware, firmware, software applications, you know, working with the industry. But throughout my career, I've worked very, very hard to collaborate with the industry to help and advise businesses, governments, and academia on emerging threats and industry best practices. And that's what I continue to do. I've got a few followers on LinkedIn, do podcasts, and speak all over the world. I'm on 14 different advisory boards, things of that sort. So I love having conversations about cybersecurity.

This is awesome. So this is going to be a great call. So today we are going to be talking about the rise of aggressive nation states. So this is a very, very cool topic. Right. So we got some great experts here. And again, guys, thank you so much for your time. So what I'll do is I'd like to kind of kick it off with the first question for you, Matthew. Right. And one of the first questions I'd like to ask is, you know, who are the most aggressive nation states we kind of need to worry about today?

Yeah, the big four that we need to worry about when we're talking about aggressive nation states, we're talking about countries that are using their funds and resources to basically fund programs either internally or through proxy groups to attack other countries, attack companies, attack even individuals, to distribute disinformation, to do all sorts of nefarious things. And there are 4 big countries out there: Russia, China, North Korea, DPRK, or DPRK, sorry, and Iran. So those are the 4 big ones, and they all have their own kind of separate flavor objectives and methods and nuances about them.

I'm sorry, I was muted there. Alex or David, did you have any specific questions on that topic?

I'll let first David and then I will speak. I know that David is more technical than me. Certainly.

We know certainly of the major government agencies are saying, you know, China, right, and these state attackers are number one that everyone needs to be worried about right now. I'm not getting into politics, but the real question is, you know, what size organizations need to be worried? Is this everybody? Is it home users? Is it small businesses? Is it just infrastructure? Is it everybody? Just love to hear your thoughts on that.

Okay, so the answer is not as simple as you would think. Many of these different countries, so for example, you know, Russia will attack and do everything from ransomware to technical attacks to disinformation campaigns to, you know, attacks, huge attacks against critical infrastructure. Whereas we look at China and they tend to focus on intellectual property theft for the time being. We know they're getting ready to be able to support if there's any kinetic warfare like Russia does. North Korea is just trying to get hard currency. They're trying to get around sanctions and embargoes. So every country has kind of a different objective. And when we talk about China or Russia or anything, a lot of people think, well, if I'm a critical infrastructure, I'm probably at risk. You're absolutely right. If you're a government agency, you're definitely at risk. But a lot of the small and medium businesses or other companies think, ah, you know, they're not going to come after me. And in a sense, the good news is, yes, they're not going to directly come after you, but that doesn't mean you can ignore this. Because here's what happens. These big countries pour billions of dollars into research for new tools, new capabilities, zero-day vulnerabilities, all these kinds of exploitation functions, right, in infrastructure. And the moment they have an exploit or an attack and they use those and it goes out into the wild, everybody can see it. Everybody grabs that hugely expensive and valuable zero-day. They grab the tools, they figure out the exploits, and they break it all apart and look at those individual parts. And then what happens is they go and they use those pieces and those pieces trickle down. They trickle down to cybercriminals. Why would a cybercriminal have to go in and invest all of this? They just have to wait. And once they get that component, now they can put it in their ransomware, in their attack schema, in their fraud tools. And guess who they're going to attack? Everybody. So, yes, no matter who you are, where you're at, if you're on the internet, if you're connected, you do have to worry about this and the fundamental changes that we're seeing in the industry with this massive amount of research and funding an effort that will have a trickle-down effect to everyone.

So, Alex, did you, did you have some questions after that?

Yeah, I have another question. You mentioned all the threat actors, that there are 4. I would like to know which are the most affected continents or countries. Because of these threat actors that we have?

It depends on what they're going after, right? So we have to look at what are their objectives. But when we look now in aggregate, it tends to be Western countries, whether it be in the European Union, whether it be the US allies, Five Eyes, Nine Eyes, things of that sort.

Why?

Because there is a lot of intellectual property. There is a lot of money to be stolen. These types of countries, especially the US, my, my country, right? We can be swayed with disinformation, which helps them. These are also countries that are taking a stance either militarily or economically, putting sanctions in, whatnot. And therefore, there is a great opportunity for these countries to leverage this asymmetric type warfare to help them. Push their foreign policy agendas, help them, you know, get a better reputation or preserve their reputation, help them get money or intellectual property, help them support their in-country economics and companies that they own or run. So for the most part, not all, but it tends to be Western countries. That's where the major targeting is happening right now.

Indeed, I have seen it like Spain, Germany, even Belgium as well. And I think even in Denmark or the Netherlands, if I'm not wrong. Absolutely.

Especially as we've got the Ukraine-Russian war there. Yeah. You know, Russia has switched from just kind of ransomware using third parties to internally sourcing their attacks and going after a lot of destructive attacks, a lot of wiper types of attacks. And we're seeing attacks against, you know, NATO. And there was a, you know, a meeting in parliament in Helsinki not too long ago where, you know, the president of Ukraine was speaking. And immediately as he was starting to speak, they had a denial of service attack, right? We're seeing attacks against LNG facilities. Why? Because they're bringing in shipments of LNG to displace what they're not buying from Russia. So it all makes sense when you start putting the dots together. If you just kind of rattle off attacks, it seems almost a little random. But if you put yourself in the shoes of that country and how they want to use it to progress their foreign policy goals, starts to make a whole lot of sense.

Yeah. And I have another question here because you, you told us about Could you please tell us which are the most industries affected by these threat actors?

Yeah, and we're seeing a lot more, and we've been predicting this, critical infrastructure. And when we look at the different sectors of critical infrastructure, and those are the things that basically help us in our everyday life, right? It's not just the electricity that you think of that keeps the lights on. It's also transportation, whether it be planes or automobiles, whatever. It's also shipping and logistics, right? Your whole— and a lot of that is actual physical ships, but rails and things. You've got government, you've got self— or you've got national defense as part of critical infrastructure. You also have food supply. You also have drinkable water, sanitation, all these things. Are necessary for our everyday life. And therefore, impacting them can have an impact and help them on their goal, whether it be disruption, whether it be, you know, forcing those victim organizations to pay like a ransom or extort them out of money. But when you're talking critical infrastructure, everybody expects it to be on working and not being tampered with. You know, take healthcare, for example. We're seeing Tons of different attacks going on in healthcare, forcing hospitals and emergency rooms to close or redirect patients to other locations, impacting care and surgery. I know there's some groups out there trying to actually tabulate how many deaths that they can directly associate to that. And it's greater than zero, unfortunately. And so we see all of these critical infrastructure sectors You know, even water, we've seen attacks against water purification sites and sanitation sites. I'm still waiting to see against food distribution and supply because that's a big one as well. And it's coming. It is. So critical infrastructure, number one of the sectors.

Actually, I was going to ask you, Jonathan and David, is there a kind of like a fine line of where they know they can't go over when you're talking about critical infrastructure, right? Like, so you know, I'm on the product side and we dealt with DCSs, PLCs with Siemens, GE and everything else. And, and when you start talking about attacking them and the damage of taking down, you know, power or a nuclear facility and the death toll it could actually cause, I mean, you look at the power outage that happened in New York City, you know, a while back and the death toll that happened from that. Is there almost like a fine line that these threat actors and these countries look at and go, okay, we know we could go this far, but if we go past this, it's gonna be an armed conflict at this point because we're doing too much damage and it's gonna go over the line.

It's a great question. And a line is pretty specific. This is more of a gray zone where countries are saying, okay, well, if you impact me, that might be considered an act of war, right? And so you have a lot of posturing. Yeah, but in reality, what we've seen is we've seen a shift of that gray zone to go higher and higher and higher. And right now, the country that's really pushing that is Russia. Russia, you know, prior to the, uh, 2022 invasion of Ukraine, you know, there were attacks. Um, some of them were destructive, but for the most part, if they were going to attack the US, it was not super destructive. A lot of it was more telegraphing, saying, "Hey, I can get into these locations. Are you sure you want to kind of, you know, be against me politically?" But since 2022, we saw a huge uptick in wipers, right? And some of them were even masqueraded as ransomware, where it would infect the system and even give you a wonderful little ransomware note. But it was just destroying your files and they were completely unrecoverable. There was no key. There was nothing. And they had prepared these in advance. And we're seeing them again attack more and more with greater velocity and impacts. And as that's happening, we're seeing a chain reaction. We're seeing indicators coming out of China and North Korea and Iran saying, well, if Russia can do this, and there isn't a big response by Europe or the United States, well, maybe we can start exploring and doing that too. So it raises the bar. So there are no hard absolute lines in the sand that people are holding to. So it's still fuzzy. It's a negotiation. And right now it's being bumped up a little more, a little more, a little more. And we're not seeing that trend change. That trend probably won't change at least until we have some of these major potential conflicts behind us.

Wow.

Yeah, it's going to get worse before it gets better. I'm sorry. It is.

Yeah, it's funny. I've been into plants before, to refineries and some of these other places. And it's incredible to me once you actually go in there, the technology they use is very, very old. Systems are not patched. The DCS is some of the big boys. They're very old. And it's just scary. The thought of some of these places can be easily, easily attacked. Right. And they're not very easily protected. And the thought of the damage to that and how they can get through that is actually terrifying.

It is. I mean, we have a massive OT, you know, operational technology environments in all of these critical infrastructures. And on the one hand, right, you've got old software systems, operating systems, hardware, you know, and these are designed to operate for 30 years. It's not like your laptop where you're going to get a new one in 6 or 7 years or 4 or 5 in some. You know, they're meant to last a long, long time. But on the other hand, it's really tough to get an exploit for OS/2, right? Because that's not really where the researchers are looking at. So in a lot of those environments are more isolated, you know, air gaps. But again, once you get past that, potentially it could be catastrophic. I, you know, one of my jobs at Intel is I, for a while there, I was the security strategist for Intel's factories and I had 26 different operating systems dating back to DOS 3.0. Yeah, because that's what you're running. And you've got lots of equipment there that, I mean, it's an appliance and there is no patch right? You can't because the method's up, you know, but you're running, it works, you're not going to turn it off, it works, it works.

Yeah, and you, and you updating it or upgrading it kills it. So it's unbelievable.

Yeah, I can't resist coming. It's like, do OS/2 even have the TCP/IP stack, right?

You know, it's like, I remember an, um, an electron microscope running an OS/2. I remember it. Yeah. Oh yeah.

Going back to the, you know, talk about attacks and also tying back to one of the questions from the users here is, you know, the user kind of said, "Hey, what's the best method of protection against machine data attackers?" Right? And I'll give you my opinion. I'd love to hear yours combined with another piece is that I'm going to say number 1, it's all about patching. Patching, patching, patching. If you're keeping up with your vulnerabilities and patching is number 1. Now, with that said, you know, Matthew, and a slight angle to that is, Are you seeing the nation-state attackers using more of the standard vulnerabilities, maybe that people just don't patch, or are they mostly using zero days? Myself, I say the zero days are only very, very targeted, very, very specific things and not widely used. Love to hear your opinion.

Yeah, I'll take the second part of that first. So I agree with you. The zero days are very coveted. There is a certain timer on them, right? Because they can only use them for a certain window. For that window, they've got time to do research. They've got time to figure out how to apply it to the best, to chain it to other ones, to use it for supply chain attacks where you compromise one company and yet then you go through them and are able to hit all of their customers, right? It's a one-for-many proposition. So using zero days for that is very, very opportune to get really where you want to go. But a lot of these organizations are simply using the path of least resistance. And we see this, for example, in ransomware, right? Why would North Korea invest all the money, right? They want to gain money. They don't want to spend money on zero days. So they're going to use the known vulnerabilities that are already out there. And there's plenty because people aren't patching and/or they get reintroduced or whatnot. And it's the path of least resistance to simply use vulnerabilities that are already known, exploits that are already tried, true, and tested, right? And just spraying it out and getting whatever victims that they can. So I agree with you in what you're saying. You know, they tend to reserve the zero days for where they can have maximum effect. And yet many of the attackers are also very much using known vulnerabilities that should be remediated in our environments, but in many cases aren't. So that's the second question. The first question, how do we protect against this? And there is no easy answer. I agree with you, patching is part of the solution. But again, there's lots of environments you can't patch, right? And patching, unfortunately, 90% of the— if you were to patch everything, every vulnerability in your environment, 90% of it would never get exploited anyway, which means from a resource allocation perspective, 90% of your security efforts is a waste. And, you know, we can't protect everything equally. We have to have priorities. We have to frontload our defenses and our allocations of resources to where the attackers are going to be, how they're going to try and get in, how they're going to try and move around. So, you know, there's a couple of things. Number 1, follow the basics. Everybody should be doing that. And patching is part of the basics, right? And there's tons of resources out there that can tell you what the basics are, right? Whether it's for, you know, authentication or patching or whatnot. If you are part of the critical infrastructure world or a supplier, a critical path to the critical infrastructure world, you should be looking at the documents that like CISA has where, I mean, their goal is to protect critical infrastructure and they've got lots of best practices. They've got lots of punch lists and things of that sort because again, we know these, these attackers are going to be specifically coming after you. So there's a whole bunch of other things that can be done in general for everyone. Follow the basics. Don't be an easy target. Right. Which is part of following the basics. You really have to understand what your valuables are. And if you know these threat agents, right, what they're going after, then you have a better idea of, okay, what do I really need to protect extra, knowing that those risks are going up day after day. The next one is really to have a clear strategy. And this is something I see organizations falter all the time. Again, you just can't haphazardly go, well, I'm going to do a little bit here, a little bit there, and I'm going to start, you know, I'm just going to focus on the fires from yesterday and I'm not going to think about tomorrow. Right. And it's like standing in the middle of the freeway and looking at the cars that are shooting past you. Right. Where you really should be facing is the other direction to see what vehicles are about to hit you. Right? And so you need to have good strategy, which means you need to have good leadership. You need to have good business goals. It needs to be tied to the business, technology, people, processes, and everything in support of that. And I would even say, if you know that you are going to be a direct target from a nation-state, I would then argue and say cybersecurity leadership, who you have in charge of that and maintaining that and looking forward, becomes even more important. So that, that would be my advice. And we can get into specifics if there's something particular that somebody wants to know about. But it's, it's not easy. But don't try and protect everything all at once, right? You really do need to be strategic and put your best defenses to align them with the most likely attacks. That's where you're going to get the very best benefit.

So is that where you see aligning cybersecurity with business leaders is so important to find out really what is the most critical part of your company to protect?

Oh, absolutely. Right. If we're only looking at it from the lens of I'm a security professional, I'm a technical professional or whatnot, I'm just going to look at the vulnerabilities. I'm going to look at my internal weaknesses, so on and so forth. And that provides you one view, it provides you a facet, but you also have to know, well, what's important to the business? How do I protect that and keep that up and running? Because they're paying for the security. And security is traditionally looked at as an overhead, a cost center, right? Not a profit center. Profit centers are what you invest in if you're a company because they're the ones bringing in the money. The cost centers and the overhead groups, right? You actually want to make more efficient and shrink their budget. Okay, well, that's great. But in security, we're constantly dealing with greater and greater threats. So even just to keep parity with the, the risk posture that we're at, we need more resources. For the next 5 years, they're estimating CISOs will be asking for an additional 20% budget increase year over year. So if you're the CEO and your CISO comes to you, who is just an overhead group who should be reducing their budget, and they're asking for 20% budget increase year over year, eventually that will stop. You will hit a brick wall at some point and they will say no more. I'm sorry.

Probably shows how important it is that the CISO is talking to the board.

They need to talk to the board. They need to be able to talk to their peers in the C-suite. They need to be communicating and working with the CEO and they need to be talking their language. CISO should not expect the board to understand cybersecurity or terminology or anything else. Same thing with the head of the profit groups. We as cybersecurity leaders need to be speaking in their language, right? This is about your margins, your market share, your, you know, we have to talk in their language if we want to support them. And that will also give us insights to how we can better support. If I go to a profit center group, I'm going to say, hey, I want security to be a competitive advantage for you. I want you to be able to compete in nontraditional ways, grow your market share, right? Or grow your average selling price or move your freemium users to a paid tier because of security. How can I help you? Right? And their eyes get big. Dollar signs. Yes, I love you. You're now my partner. Of course, instead of an impediment, you are now somebody I want to get closer to. You can help me. You're adding value. Let's rock and roll. We have to move to that position to be able to add business value.

Well, I can't resist, you know, kind of for both Matthew and for my other peers here is an element is, you know, we know that, you know, organizations, you know, they need the cybersecurity expertise, right? We're worried about nation-state attackers and different angles. Yet I'll say small medium businesses, can everyone have a cybersecurity expert or, you know, and even someone that's knowledgeable about all nation-state attacks and things like that? Or, you know, and in my opinion, it's like, hey, move to the cloud for more of your SaaS services and not managing it yourself, you know. Should many small business moving to the cloud, moving to SaaS, moving this managed service providers versus trying to hire and maintain vertical expertise themselves, I think it's a great discussion for all of us.

It is. And we kind of have to break out the problem there. Do small and medium businesses need cybersecurity? Yeah, they do. Right. We're seeing that all across the board. Right. Do they need to hire or even can they hire a world-class CISO for their business? No, they can't afford it and they wouldn't be able to find one anyway. Right. But does that mean that they can't leverage good leadership or good insights? Well, they can, right? We do have fractional CISOs out there. We do have advisors that may not be or should not be— let me be very clear, should not be full-time employees.

Right.

But they can help craft a strategy, devise a plan and a framework So other people in the organizations can go deliver to those. And it should be tailored to that small and medium business, right? To their goals, the limitations of their resources, what are their likely threats and everything else. So they do need security. Everybody does, right? Unless you don't want to have a business. And you need to be able to be creative. And small and medium businesses do this anyway, right? Do they have dedicated internal legal teams? No. They have somebody on retainer, right? Do they do all their books themselves, right, with Excel like the big companies? Because they all use Excel. Don't, don't tell me. No, they're going through a, you know, a third-party service vendor. But you bring up something which is a little worrying, right, of, oh, well, why don't I just go to the cloud? Okay, well, that can be beneficial, but that doesn't— you know, you can't just transfer all your risk to a cloud provider, you need to know that they're trustworthy and they're secure and they've got your back and they're communicating and working with you and they're going to operate within that zone, that optimal zone of risk that you want. If you say, oh, well, I'm just going to go to the cloud and it's secure, you're going to be in for a pretty horrible surprise at some point because even the cloud security providers will tell you, we will give you the tools Sometimes we'll sell them to you, but we have the tools, but you own your security. And if you read the EULAs, it will be very clear in there on about page 47 that they're not going to be held accountable for breaches or issues or anything. And it's up to you and you've been given the tools or access to tools. So again, even if we move to the cloud, we should not just, you know, be giving away or thinking it's going to fix my security problem. We still have to own it. Don't surrender that because they don't have the same buy-in as you do for your company.

So that's actually a good question. So in ELAs, I did not know that there is wording in there. So if you're doing a SOC as a service, that if they do get attacked and there is a breach, they're not responsible. For loss lawsuits and everything else.

Mm-hmm.

Yeah. And they need to protect themselves. I mean, even in your cybersecurity insurance, you're going to see all sorts of disclaimers.

Right.

You know, my favorite one is, you know, if it's an act of war, which is a normal clause in most insurance policies, right, for your house, for your car, whatever. But when it comes to cyber, act of war, does that mean if a nation-state attacks? Well, We've actually had this go to court where a company was attacked and it was attributed to a nation state. And so they went to their insurance company and said, okay, here's our $40 million bill, go ahead and pay us for it. And the insurance company said, nope, nope, this was a nation state. It was an act of war. We don't pay out on act of war. Have a nice day. Right? And we're going to cancel your policy. Right? And so we're seeing, you know, contracts be used to be able to transfer risk. And essentially, that's what cyber insurance is, right? You're just transferring the risk or some amount of risk to another party, in this case, an insurer or sub-insurer. So you, but you have to pay attention to those contracts, read the contracts. And, you know, a lot of work that I did and still do with organizations is take a look at those contracts and go, well, wait, wait a second, this clause is not going to work. Right? There's going to be some nasty surprises. Let's take a look at that. Same thing when it comes to ethics, right? We need to understand that when we're dealing with third parties, what their ethical stance is, what their stance on privacy is, what their stance and where the, you know, your data is going to go and share. And even if they're going to alert you or notify you if they lose your data. Yeah, kind of important. And I would recommend you go back to your contracts and the next time you sign it, make sure there's a clause in there that says there's a certain SLA that they have to notify you if they expose your data. Yeah, fun stuff.

Alex and David, I'll let you— Alex, did you have any more questions?

Yeah, yeah, I have it. I have two questions. In fact, one is related to probably is, so let's say you mentioned about exploits, you mentioned about ransomware, which is fine, but I would like to understand, maybe the public wants to more to understand, based on what's happening, let's say, this year against what was happening in 2020, what is the average of exploit to be spread based on some vulnerability that was publicly disclosed on the internet, how much time it takes? Let's say in the past it was 120 days, 60 days, some years ago in 2022, if I'm not wrong. But if we put with the nowadays and what's happening from the beginning of the year, how much days it takes for that exploit, let's say, to be spread into the critical infrastructure that you mentioned.

Yeah, it's an important topic because if we go back to 2020 or we go back even 10 years, we would see a zero-day come out and then it could be weeks or months before we actually saw even the beginning parts of attacks. Attacks, and in many cases those attacks weren't very mature, but we've seen an evolution where the window of opportunity, right, of being able to patch before attacks, that is beginning to shrink significantly. We also see an increase in the maturity of attacks. So if you go back to 2022, you still probably had a couple of weeks before you started seeing decent attacks come through. We're now seeing that come down to days, and in some cases, I'm seeing some security company measure it in hours. 27 hours since this was released and we have our first attack. And that's only half the story because it's not just the first exploit. Exploits can be very difficult to refine, right? Especially if you want them to be widespread or if they're part of a chained attack. But we're seeing very mature attacks come in in that timeframe. And that leads to certain conclusions, right? One, we are seeing, especially with the nation-states, and we have other information that supports this, we're seeing nation-states spend a tremendous amount of money, not only in the acquisition or discovery of vulnerabilities, but also in the people and talent to be able to create, test, deploy, and sustain the exploits. So now you're talking about hiring groups, right? Having an entire internal chain and basically a flow of people over time that are getting better and better at doing this. And also better tools because they don't want to just start from scratch and They want to build tools so the next time they have to do something similar, it's much, much faster. So we're seeing an efficiency gain. So the investment is not only in people, not only in discovering and acquisition of vulnerabilities, but it's also in infrastructure, whether it's the tools or the networking infrastructure needed to propagate these and support them. We're seeing that. The other thing we're seeing with specifically like Russia, um, we're seeing intelligence agencies starting to work with these attackers and be able to provide their types of intelligence, whether it's human intelligence, whether it's signal intelligence, satellite intel, whatever. They're becoming more and more integrated to support this type of cyber warfare. And that is definitely unique to nation states. But if you can imagine intelligence agencies that have been around for a very long time, right, starting to commingle and directly support nation-state cyber attacks. This is where we're going, and this is why that huge influx of research and development, right, in the billions of dollars makes such a difference.

Indeed, indeed. Another question. You said before about AI, Do you think the AI will be a risk or a friend for, let's say, for our tools in terms of security? Because we are using a lot of tools for the vulnerability. Let's say we have Qualys, we have Nessus, we have Rapid7 and NEXPOSE, or we have other tools in terms of the patching. And I have seen it, Treddix, for example. We have a lot of tools into this. Do you think will be a risk sooner or later, or will be a friend, let's say, that could help us to fix most of the varieties?

Let's say a friend to the defenders and a risk.

I don't know, this is a topic I get asked on in every keynote and speech and podcast that I do. The answer is yes. Yes, it is an aid to the attackers. Yes, it is an aid to the defenders. And what we have to understand is AI, and right now we're looking at generative AI, which is, you know, your LLMs and so forth. But that's a subset of deep learning, which is a piece of machine learning, which is just one piece of the overall AI umbrella, right? Right? So we're at the tip of the iceberg and there's gonna be more AI that comes out and everybody's gonna be using it. It's gonna be synonymous and ubiquitous. What we have to understand is it's a tool. Okay? That's all it is. Think about that. It's just a tool. Now it's an extraordinarily powerful and valuable tool, which means if it's valuable, organizations and software and, companies and everybody, they're gonna invest a lot, they're gonna adopt it, and it's gonna be used in all sorts of different ways. Okay, great. But there is an equation that basically says, right, for any new tool or any new capability, right, the value of it, there will be equitable risk whenever you go to try and seize that value. So the more we start, you know, developing AI and embracing it and using it and relying upon it for everything. And it's not just answering questions and getting a little story. They are embedding AI and doing analysis and everything that are supporting critical infrastructure, supporting government, supporting, you know, national defense, all these different things. The more we embrace and research and integrate and rely on it, the greater the potential risks. And these new capabilities, it's just a tool. Again, it's just a tool. It can be used for malicious purposes or it can be used for security. And we're seeing both. And a lot of people get confused on that. And if we just go back in history just a little bit and go back and look at the first vulnerability scanning tools, The very first vulnerability scanning tools that were widespread, hackers were using them to find vulnerabilities in systems so that they could go attack them, right? That makes sense. Very shortly after that, security grabbed those exact same tools. I'm talking the exact same code and created products to do proactive scanning so you could see your vulnerabilities and go patch them. Same thing. Tool.

Yeah.

AI is going to have the same capability. Give you an example. AI, specifically generative AI, it is a great tool for social engineering organizations, malicious organizations, organized criminals to uplevel their phishing, for example. They can use it in a whole bunch of different ways, but let's just talk phishing, right? It can be more relevant to the target. It can be customized to the target. It can integrate facts and things that it finds on the internet as part of those message to be more convincing. And if it doesn't work, it can learn from it, reiterate so the next time it is more convincing. Right? You're thinking, okay, we're screwed. We are. We are. Okay, great. Now the security companies are also using GenAI to be able to look at and detect phishing attacks, to be able to look how it's written, to be able to look what it's saying, to be able to look and give you ratings so it filters it out. So what we really have is we have an arms race. The attacker is using new and innovative tools, AI, for example, but they tend to be the lead, right? Because they have less to lose. And if it's a new tool, they're going to try it out. They don't have to test it. Let's just go, right? They're going to use it. And then defenders tend afterwards in response, they will use similar tools or the same tools even to try and compensate for the advantage the attackers have. The attackers always maintain the initiative, which means they get to attack who, what, where, when, whatever. Right. They determine that and security tends to respond. So there is a window for all these new use cases for GenAI where it can be abused, it can be vulnerable, it can be misused as well, right, to the benefit of the attacker, detriment of the victim. But again, security companies are trying to race to catch up in this arms race. This is just— and we're going to see this again, right? This isn't the first time we're dealing with AI. Now quantum is going to be another arms race after this. You think this one's fun? Oh, standby, right? So we're going to have lots of different challenges as we embrace those innovative technologies that bring value. Therefore, they will be embraced, research funded, and integrated and relied upon. Yeah, that's my short answer.

Yeah, indeed. Thank you, Hany. Anyhow, uh, will be another question also from my side. Do you think, because, um, let's say the AI will consume a lot of resources and everyone knows about this, With the cloud, do you think the people will afford to take cloud together with AI? I'm sure that in the future, I don't know, not, not now, but in the future, uh, people will— I mean, companies will have to pay more money for their cloud due to the resources that the AI is consuming. And we have seen it very often. I have seen it, uh, I think this week or last week something related to that, the part of the money will increase due to the AI because it's consuming too much resources. And of course they have to, let's say, the data centers or whatever is there, the location has to be more cooler and you have to increase more money for that.

And this is not a new challenge or problem. This is what we expect. In fact, if you go back and look at Moore's Law, which looks at the CPU, right, how much power the CPU is going to have at what price point. And essentially it goes up at a fairly predictive rate. This is the exact same problem. You need computing power and because of that you need energy and you need cooling and everything else. But throughout that, there continues to be innovation. So the dies shrink, the amount of electricity necessary for the number of computation then goes down, which means the cooling, you know, needs to go down. So there are normal financial incentives that drive innovation in this space and cloud, right? It's really just somebody else's network and computers, right? It's still— we still need that computing. That in and of itself is a tool, but that's also evolving. We're seeing attackers, yes, they're using the cloud. We're seeing them use their own systems or generate their own mini data centers. For nation states, their own big data centers, right, that can have these technologies. And again, they're not just going to buy it once and be done. They're going to keep up. They're going to keep up with the updates in hardware and firmware and, you know, the software that runs it. I mean, in my lab downstairs, You know, I've got a rig that's running, it's got 12 different video cards in it, right? And it can hash passwords, it can do AI, it can do all sorts of stuff. And that's just on my local network in my house, right? So you can run it and the software and the optimization of those algorithms will also get better and more efficient. So we're gonna see the natural efficiency progression. Through the hardware and software and everything else help compensate the costs, the environmental impacts, and even the amount of space that you're gonna be able to need to do all these. At the same time, the demand for the computing will go up because we're gonna have richer and more demanding type of AI systems. So this is, I mean, this is a dream come true for companies like NVIDIA. Right? Look how valuable they are because they are in that sweet spot. And that's probably not going to go away, not as long as there continues to be a need.

Thank you, Matthew.

Let's go back for a fun one. And is Nation of Attackers— so what do you think is their number one platform form of choice for targeting, right? Is it always Windows, or are Mac users still vulnerable, or even Linux in Chromebooks, right, getting hit by nation-state attackers, right? Is it just like, hey, if you're using— you only have to worry if you're using Windows and Edge browser, or is, you know, everyone?

So when we talk about nation-states, they have very clear objectives. If China is looking to steal your core intellectual property on the latest, you know, motor design you have or battery design or fighter plane, the data probably isn't on someone's Chromebook, right? And so we first have to look at what are they targeting, okay? And then now that's going to tell you what's susceptible because that's where they're going after. Going after it. That's, you know, famous bank robber, you know, was asked, why do you rob banks? And although he was misquoted, basically it's, you know, it's where the money is, is what he replied. And it makes a lot of sense. So if we understand what their objectives are and what they're going after, then we can start figuring out, okay, what kind of systems? And at the higher end where you've got intellectual property theft, you've got, you know, trying to further political issue or political desires or foreign policy, right? It doesn't matter what the system is on. They will conform to whatever it is because that's what they're trying to go after. When you look at lower-hanging ones like, well, ransomware, something like that, disinformation campaigns, they don't care. It's who's the easy target, right? And it may be technical, maybe the vulnerability. In many cases, it's it's simply behavioral. It's social engineering. So it doesn't matter what platform you are on. So if we're only looking at it from a technical, "I'm just going to focus on my platforms," you're probably going to miss the boat. Instead, start with your threats, what their objectives are, what their typical methods, and the tools that they're going to use. Now you're going to figure out, "OK, what are they going to target? How are they going to get in? How are they going to move? What is the endgame for them?", and I have to interdict them, right? And stop that because there's only a few ways to truly, truly manage risk or threat. Right.

And, you know, I know you talked about this before with the quantum computing. Mm-hmm. Obviously, you know, this is something that only large nation states have the ability, you know, currently, uh, to build out, right? Because it's it's very difficult to build. Where do you see the threat with quantum computing with these large nation states of what they can do once— right now, I think we're at 8 qubits or maybe 10 qubits now is the largest we're kind of getting at, right? But once it starts getting larger and there's more performance from these systems, what kind of threats are we going to be seeing from these systems? Because they are different from the systems we're using today. But obviously the threat there can be, can be very dangerous. So where do you see threats from those, from those large nation states building out systems like that? What can they do with those?

Yeah, and there's lots of threats there. Probably the number one threat we've been talking about for the longest time really comes from China because they're going after intellectual property, which means they need to decrypt a lot of data. And right now they're just, they're like a big vacuum. They're sucking up all the data that they possibly can. If it's encrypted, no problem. They're gonna suck it up and they're gonna store it. Once you get to so many qubits with a low error rate, you can start undermining certain types of encryption. Encryption today that we use very wide, right? To be able to protect that kind of data. And so they're gonna then go apply the, you know, Shor's algorithm and other fun little things using quantum computers to be able to unlock those secrets. First off, that they've already captured because that's easy to do, but also moving forward, be able to, to intercept information in more real time and things of that sort. Right. Especially when you're looking at public-private key pairings and so forth. A lot of the algorithms we use in that space becomes very susceptible to quantum type of attacks. So for China, a lot of it is gathering information, right? When we look at North Korea, they're probably not gonna care for the intellectual property unless they can sell it, right? Because they're interested in money. They're gonna be using that type of technology to go man-in-the-middle and in, you know, in between financial transactions, right? And be able to manipulate those, redirect transfers of money and so forth to their accounts or their holdings, things of that sort. So you're going to see a lot more fraud from them. And when you look at Russia, who is doing a lot in regards to foreign policy, you know, hacking, destructive attacks, attacking critical infrastructure, so forth, they'll be able to use that as part of disrupting the communication protocols and, you know, gaining access to sensitive accounts. Yeah, to be able to go in and further, much quicker and much more effectively be able to do those damaging type of attacks that again contribute to their overall goals of, you know, foreign policy, you know, pushing their foreign policy and things of that sort. Yeah.

So, Alex, you saw— you mind going through some of the questions there? Did we have a chance to go through some of the questions? I know I saw two on there.

Yeah, we have two questions from some people and another question separately in LinkedIn. So yeah, can I go? Yeah, that'd be awesome.

Yeah, let's do it.

Okay, so we have an anonymous person who is asking, hi, I would like to ask about methods of prevention for the nation-state attacks. I know that the threat actors are aware of of geolocation blocking?

I'm sorry, I didn't understand the question. Question around geolocation blocking or— Yeah, yeah, yeah.

This is what I think he's referring to, what we have on the Foul side, because, you know, you can put this, you have that feature for the blocking into that, but also in other tools for monitoring and other things for blocking as well.

Yeah, so masquerading your identity, where you're at, location, you know, this is something that has been going on for a very, very, very long time. And again, it's a cat-and-mouse game. And that's why when we look at attacks, it's really, really difficult to actually attribute it back to a specific country or a specific organization or whatnot because I can spoof somebody else's identity or location. We've got all sorts of networks that are out there, like the Tor network, that bounces you around. Now, are they completely impervious to attack? No. There are potential ways to undermine those given the right circumstances. But we're seeing nation-states actually spin up entire global networks that act similar to Tor, where they can block or masquerade or really kind of manipulate where their packets packets are flowing or who it appears it's flowing from. When we start looking at undermining of security keys and certificates, now I can make my communications look like it's coming from somebody else. And so there's, there's a lot going on that really is— it's just an evolution of what has always been worked on. We're seeing more and more even in the military space. Where you look at, you know, GPS locations and so on and so forth and being able to interfere with those. We see that a lot right now in Ukraine, right? Because there's smart weapons that are using GPS to find targets and know where it's at, right? Relative to the target and reduce that distance to zero. So we see a lot of attacking attacks going on GPS or satellite communications We've had attacks against the low Earth orbit satellite communications that Elon Musk put up, right? Starlink, because that's available, you know. So there's been lots of different types of spoofing and attacks, but this really isn't new. This is why the US created a Space Force, right? And created a separate branch in our military because we know location, geolocation is very, very important. And a lot of those assets, well, are in low Earth orbit and sometimes stationary orbit. But you can also track it through the digital wires, right? The physical wires and glass wires that we use to communicate all over the world. But it's just like many other tools and usage of those tools. It can be used for very good things and it can be used for bad things. And it is simply an escalation on each side. Side, one trying to mask, the other one trying to identify. And it— just because you're trying to mask doesn't mean you're malicious, right? Uh, privacy is a really, really important thing. And so there may be very important reasons why you're trying to mask yourself, so maybe an oppressive government doesn't come after you and take you in the middle of the night, you know, little things like that. So, but it is an escalation between tools and capabilities. And that's not going to go away. That battle will continue.

Yeah. We have another question from Emmanuel. He's asking, what do you think about countries getting more involved in the future of robotics and its security related with possible remote connections to the assets?

Yes. And we're seeing research all over the board, right? And, you know, we see it in drones, we see it in autonomous vehicles and quadrupeds and all sorts of different things right now. We are, you know, and research in robotics has been going on for a very long time, but it's moved kind of slow. With the introduction of AI, specifically machine learning and deep learning, we are seeing an intersection between the two that is becoming very, very powerful, right? If you can make an autonomous or semi-autonomous semi-autonomous device, it can work in a very hostile environment, right? And maybe that environment is, you know, in a hazardous work environment where you've got radiation or chemicals or whatever. It may be in an environment that is hostile electronically, right? We're seeing Battlefield where you've got this electronic countermeasure and jammers and everything else., and if you are just controlling it remotely, you may lose signal and it just doesn't do anything. Whereas you're, you're creating AI systems to be autonomous or semi-autonomous. They can then take over and continue mission. We're seeing the United States is one of the big ones, uh, military, in investing in these kinds of things. Uh, Air Force, Navy, uh, Marines even, and they tend to get the, the the older stuff, they're even investing, Army especially. So we will see more and more robots and machines, autonomous, semi-autonomous, and to a lesser extent manually controlled by an individual, you know, really proliferate because there are tremendous advantages. So there's financial incentives for the research, for the testing, for the deployment, and then actually for the release and control for whatever purposes they're designed for. So it's big business, big business, billion-dollar companies coming.

We have a last question from Rory. Hi, I wanted to ask if there was a commercially available Black Transmission based on Zero Trust plus application product on the market, and it would mitigate 99.99% of threat vectors, what you would recommend?

So I don't call out specific products, but it's— I like the question because I kind of want to attack it a little bit, right? Zero trust is, it's a methodology. It's just a way of thinking. It is not a tool. It is not a product. A tool or product or appliance may adopt that methodology, which is really kind of compartmentalizing, doing segmentation and microsegmentation, doing revalidation, protecting assets a little more. All great things. I'm a huge, huge fan of Zero Trust. And even before Zero Trust, when we just called it microsegmentation. Okay, sure. Right. But a huge fan of it because it can mitigate a lot of attacks attacks, number 1, preventing them. Number 2, as a tripwire to detect them, an alert so that you know somebody's already in, right? It's not just at the perimeter. It can be deep inside your organization now when you're getting an alert versus, oh, they got past the outer wall and now they're free to roam. So there are tremendous benefits. No zero trust out there will get you to 99.999% security. There is a lot that is involved in security, and digital systems by design are made to communicate, to interface with people at some level. And because you have that, that means you need to have behavioral as well as, as a process type of controls in addition to constantly changing technology capabilities that are, one, keeping pace with how the attackers are innovating, because they constantly innovate, right? Remember? And they have that initiative. We talked about that. And the other thing is your environment, it's constantly changing because your organization is adopting new technology, new toys, right? Oh, let's install GenAI. Let's do this and that, right? And so you're not defending a static environment. Your environment itself is changing. So you do need a lot of tools. There is no easy fix. There is no easy button, and there's not a single black box that you can buy that you can say, "I bought it. Security is done. Let's move on." It doesn't work that way. Yeah, we would all be very wealthy if we can do that. Yes, yes. Some vendors try and say it, though. They really do. It's always about— you agree it's always about defense, right? "What box do I need to buy to fix this security issue?" Yeah, it doesn't work that way.

Do you think defense in depth was always, you know, you always hear that phrase, right? Defense in depth. It's got to be the true one, right? There's never a single tool that's going to kind of handle everything. Yeah. That's going to be impossible.

And we have to be just as creative as the attackers. Remember, this is not an IT or engineering problem. An engineer, as brilliant as they are, and I've worked with some of the very best in the world in hardware and firmware and software and OSs, right? An engineer will look at a situation and go, there's a problem. Problem, I will design a fix. They design the fix, test it, deploy it. They're like, okay, move on to the next problem. We are dealing with intelligent attackers who may have more resources than you, may be smarter than you, may know your environment better than you do. It's true, right? And you're going up against them, and, you know, whatever you put in play, they may be able to find a way over it, around it, through it, under it, whatever, um, and then you have to react. So it is— it's more like a sports game where you have an opposing team that may be better than you, and you have to maneuver. You may think, I've got the greatest offensive play in the world, it may work once, but they're going to learn, and it's not going to work a second time. You may have the best defensive play in the world, and it's going to work once, and then they're going to adapt. How are you going to then adapt to that? And then they're going to adapt, and then you're going to adapt. Welcome to the world of cybersecurity, where a single fix does not work. Yeah, it's constantly moving.

So we're at 3:05 right now. And David or Alex, did you have any other questions before we—

No, I think this has been a great conversation and lots of, I think, of opinions and good advice, I think, shared with the community. So I hope this kind of helps to build everyone's interest in, in holding these and, uh, uh, growing it. Great.

Well, gentlemen, you know, I, I want to thank everyone for their time. We're still pretty new at this, so there was hopefully no technical difficulties when we run into this. But thank you so much for your time and doing this. This definitely helps out the, uh, the community, helps out the group, it helps out everyone. So, um, again, thank you everyone for your time. Thank you for joining, uh, and, and I'll see you later.

Actually, I gotta say, there should be one final thing. Matthew, so we know you're under— you're a target. So are you Windows or Mac? Say the word.

Although I'm not particularly thrilled right now with Microsoft, um, I just, uh, published an open letter to their CEO that's available out there if you wanted to search on HelpNet Security. Uh, so they may not be I've always liked Windows because of the interface, because of the usage, and I do have a deep respect for their security engineering and architecture. So it's not perfect, but they are trying to satisfy a massive market, and because of them, they've really kind of pushed computing. So, and I got the opportunity to work with them very closely when I was at Intel. So I am a kind of a Windows guy. No, don't hold it against me. I can play in Linux. I can do all sorts of other things.

I thought you were going to be a Kali guy.

Forensics, yes, but that isn't on the main network, so that isn't my main system.

Yeah, yep, I'm with you. Long time Microsofty, you know. I'm, I say I'm still a Windows guy, always will be, uh, and, uh, I do all the development on Linux, right? The Linux, you know, service, you know, it's great. On that, you know. And I do have my own Start button using Start11. I can't stand the— I can't stand Windows 11 taskbar, so I'll leave it at that.

Yeah, there's, there's been some winners and some losers on the Windows side, right? Windows ME, you know, things of that sort. But yeah, yeah, back in the day I used to love NT and their MAD domains. I used to be an administrator for Intel's MAD add domains, so, you know, PDCs, BDCs for the company and had a lot of fun with that. But, you know, Active Directory, Supplanted, lots of stuff. I don't want to geek out too much. I know we're past time here, but I do want to say one thing, right, to the audience. If you have questions, if you're not sure, reach out, ask somebody, right? We need to be a strong community, and we are stronger when we communicate and collaborate together. So don't be ashamed. Don't be— reach out to security professionals and just get their insights, right? We're all here for each other. And if somebody asks you, just spare a little bit of time and help them out too. That's how we keep pace with the attackers when we work together. They do it all the time. They're great at it. We need to get better.

That's awesome. And you know what, guys? And in the end, I definitely— Matthew, if there's anything you want to plug that you're doing, your business or anything, please, please do it. You know, if there's anything you're trying to do, we go ahead.

That's, that's part of how we make a living here. So, uh, you know, I've, I've put up videos where I rant sometimes or talk about hacks. So if you want to take a look at Cybersecurity Insights, uh, I've got a channel on YouTube. You know, you can find it out there. But, you know, it's, it's really, we just all have help each other. So awesome, awesome.

Well, again, everyone, thank you so much for your time. Gentlemen, have a, have a great evening, okay? Thank you. All right, thank you.