CrowdStrike Fal.Con 2024 | Adam Meyers | Crowdstrike

theCUBE.net

Clips
News
More from CrowdStrike Fal.Con 2024

Adam Meyers

Senior VP, Counter Adversary Operations

CrowdStrike

Identity-based attacks fuel rise in cyber threats across public and private sectors

Whether it’s the Volt Typhoon hack or one of several other attacks targeting the healthcare sector, something has become clear: speed is the name of the game. In addition, there’s been a rise in identity-based attacks aimed at crippling or, at the very least, disrupting public and private-sector operations.CrowdStrike’s Adam Meyers talks about identity-based attacks with theCUBE.“We had a customer that on a Monday, hired one of these North Korean remote IT workers,” said Adam Meyers (pictured), senior vice president of Counter Adversary Operations at CrowdStrike Holdings Inc

play_circle_outline Safeguarding Customer Data: Overwatch Team Halts Threats Quickly, Tracks 248 Global Adversaries

play_circle_outline Increase in identity-based attacks, targeting credentials to avoid detection.

play_circle_outline Emphasis on cross-domain threat hunting for comprehensive protection.

play_circle_outline Adversaries utilizing Gen AI, including large language models and deepfakes.

Info
Transcript

Adam Meyers | Crowdstrike

Adam Meyers

Senior VP, Counter Adversary Operations CrowdStrike

Adam Meyers, the SVP Counter Adversary Operations at CrowdStrike, discusses the importance of threat intelligence and threat hunting in protecting against cyber threats. He highlights the increase in identity-based attacks and the need for cross-domain threat hunting. Meyers also touches on the use of Gen AI by adversaries and the potential risks associated with AI models. Reflecting on the evolving cyber landscape, Meyers emphasizes the need for speed and agility in outpacing adversaries. As the industry continues to evolve, organizations must stay ahead of ... Read more

explore Keep Exploring

What is Adam Meyers' role at CrowdStrike and what does his day-to-day work involve? add

What is the significance of the MITRE ATT&CK matrix in relation to cyber security threats over the past year? add

What has been identified as the biggest issue in the recent threat hunting report and why is cross-domain threat hunting considered essential in cybersecurity? add

What are some novel ways adversaries are using Gen AI, particularly LLMs? add

bolt Powered by CUBE AI

Adam Meyers | Crowdstrike

search

Rebecca Knight

>> Good afternoon, everyone. And welcome back to theCUBE's live coverage of Fal.Con 2024 here in Las Vegas. I'm your host, Rebecca Knight, alongside my co-host, co-analyst, co-founder of theCUBE, Dave Vellante. Dave, we're sort of a post-lunch lull, but not here.

Dave Vellante

>> Oh, no. We're going to start rocking.

Rebecca Knight

>> We are indeed. We've got a really cool guest next. We have Adam Meyers. He is the SVP Counter Adversary Operations here at CrowdStrike. Thank you so much for coming on theCUBE, Adam.

Adam Meyers

>> Of course. Thanks for having me. Thanks for being here.

Dave Vellante

>> Good to see you again, man.

Adam Meyers

>> Yeah, you too.

Rebecca Knight

>> It is a really cool job title. Tell our viewers a little bit about what you do, what your day-to-day is like at CrowdStrike.

Adam Meyers

>> So it's a combination of two missions. So we combined our intelligence, our threat intelligence mission where we track today, 248 adversaries across the globe and catalog everything that they do, the tools they use, how they operate, and really try to bring awareness for our customers to better defend themselves against those threats. And last year we added the threat hunting mission, which is our Overwatch product team. And that's really about going out into customer data and finding bad stuff. And we've been finding some really interesting bad stuff that we're going to be talking about here at Fal.Con.

Rebecca Knight

>> Indeed, we are.

Dave Vellante

>> Well, I remember last year you basically told me that dwell time is irrelevant now, right? Because I think it was 79 minutes was the breakout time. And breakout time, meaning the time it takes to start traversing horizontally -

Adam Meyers

>> Move laterally, yeah.

Dave Vellante

>> Yeah, move laterally. And that was at Fal.Con last year in September. By the end of the year, I think that was down-

Adam Meyers

>> 62 minutes....

Dave Vellante

>> 62. And then the record, if I can use that terminology, at the time last year was seven minutes, but that went down to two minutes. So you're just seeing, again, as George always says, speed matters.

Adam Meyers

>> It absolutely matters. And what's really interesting about those numbers too, and I love when I talk to customers and talked to so many customers here at Fal.Con already that say the adversary got 22 minutes faster. Did you? Can you detect it 22 minutes faster? And that usually is when they start to say, "Oh boy, I need to start thinking about this. How do I even quantify that?"

Dave Vellante

>> So can you detect it 22 minutes faster?

Adam Meyers

>> We have gotten very fast. One of the things that we are covering here at Fal.Con is famous , which is, you may have read about this. This is what they call Remote IT Workers. Department of Justice has been talking about this. And I won't let too many cats out of the bag here, but I could tell you we had a customer that on a Monday, hired one of these North Korean remote IT workers. By Saturday, the laptop that they were being issued was shipped to a laptop farm where it was going to be plugged in. It was plugged in on Saturday. Within an hour, the Overwatch team notified the customer and they were able to terminate the employee, if you'll call it an employee. They were able to terminate the insider before they even got onboarded. So we actually stopped a malicious insider from being onboarded in that case. So we have gotten pretty fast at stopping the threats.

Dave Vellante

>> Yeah, stop the breach. Nice. Good job. That's real world proof.

Adam Meyers

>> And with groups like Scattered Spider, minutes count. And we're able to get well under ... Within I think it was 45 minutes of them registering a domain to target one of our customers, we had a notification to that customer.

Rebecca Knight

>> So let's induce some more anxiety in our viewers and talk a little bit about this threat hunting report and some of your biggest findings and give us an overview of what you found.

Adam Meyers

>> Sure. I think probably the one that sticks out for me as most interesting is that we took the MITRE ATT&CK matrix and we looked at the most common techniques that were used over the last year. And out of the top 10, five of them were identity-based, which is threat actors have moved away from using malicious documents that drop some sort of malware, and now they're going after credentials. Because they know if they come in with a compromised but legitimate credential, they've moved off the X, and now they can continue to operate without being detected, back to a dwell time comment. So they're able to operate as a legitimate user who's just logged in maybe from a different location. And that has really been a problem for organizations to start to get in front of. So identity attacks have been probably the biggest issue I think we've covered in that last threat hunting report. And we continue to see that cross-domain threat hunting is absolutely essential, because when the threat actor wants to stay off the EDR, they don't want to get caught by the security camera, so they come in with a legitimate credential and then they go around it. They go into the cloud control plane, or they go someplace to a hypervisor that's unmanaged so that they can avoid detection for longer and inflict more damage or steal more data. And that has been ... One of the big functions of that report was to kind of showcase the fact that cross-domain threat hunting is not a nice to have. It's a need to have.

Dave Vellante

>> And those credentials are still predominantly stolen through phishing, Adam, or other ways?

Adam Meyers

>> Phishing, social engineering. We've gotten with ... Help desks get metriced on how quickly they can turn around an incident and is there a second callback or a third callback. So they're almost incentivized to help the threat actor gain access to the system because they don't want to have that second callback or they don't want to have a long time for that call. And so, social engineering has been on the rise. And also a big thing is infostealers. So a lot of folks are working from home and they're working on the same computer that maybe they've got a teenager or a small child on. And if anybody has kids that are into Minecraft or something like that, they know these kids will download whatever plugin they want or add-on they want. And oftentimes that comes with the type of malware called an infostealer, and then they log into their work account and that username and password gets siphoned off and it goes into the underground. So there's another mechanism there.

Dave Vellante

>> And one of the things in the report was hands-on keyboard breaches. That was kind of ... To me, it was a relatively new thing, up 55% year-over-year. Explain that a little bit, if you would.

Adam Meyers

>> Yeah, so we've traditionally called this ... It's been malware-free intrusions or interactive intrusions. But what we wanted to do is showcase that we're tracking human threat actors. And if you want to track a human threat actor and stop a human threat actor, you need human threat hunters behind the keyboard to do that. And that interactive intrusion really speaks to there's a human on the other side that's typing in commands or doing something interactive with that system, and that's what you need to be looking for.

Rebecca Knight

>> So in terms of what you were just describing with the identity and the cross-domain, these threats that businesses need to be aware of, particularly at a time where we are seeing more remote workers, distributed teams. How do you recommend and how do you work with customers in terms of making sure these are visible, these are top of mind?

Adam Meyers

>> Well, this is where products like NextGen Sim become really important, because the Falcon data, the endpoint data is a critical component to protecting your enterprise. But as you start to bring in the identity protection data and you start to bring in your crowd data from your control plane, and you start to bring in VPN concentrator logs, that's where NextGen Sim infused with intelligence and powered by threat hunting becomes a really critical capability.

Dave Vellante

>> So NextGen Sim means more data sources and machine intelligence interacting, embedded ground up, not bolted on. Can you explain more what's the difference between ... Because a lot of people tell me, "I would love to get rid of my Sim, but I have to keep it for compliance reasons. But NextGen Sim sounds like something I want to keep." Can you explain the difference?

Adam Meyers

>> Well, they probably want to get rid of that Sim because it's slow and it's a beast to manage. So NextGen Sim, you see a lot of things moving into the cloud from a Sim perspective, because you can do things faster. You don't have to deal with replacing hard drives and incrementing hard drives. All of that kind of comes from the elasticity inside the cloud. So NextGen Sim is really about having that SaaS power and also the ability to index that data and get it much faster. Because if you've ever gone into a Sim and had to find something and you're waiting three, 15, 30 minutes for that query to return, it can be frustrating. You're doing contact switches. You get pulled to a different direction and you forget you even ran that query and where you were. So the faster that you can go find that data, go hunt for that data, the better off you're going to be.

Dave Vellante

>> Give the mouse a cookie for those with kids.

Rebecca Knight

>> I remember that storybook well. So who are the most active e-crime adversaries and what are their motivations?

Adam Meyers

>> Scattered Spider's still has been very effective.

Rebecca Knight

>> Who names these too, by the way?

Adam Meyers

>> The team names them. It depends. Sometimes there's an existing name that we'll use. Sometimes they come up with something completely new, and that's kind of where they get to have a little bit of fun as they're reverse engineering and-

Rebecca Knight

>> Yeah, -...

Adam Meyers

>> they're going through mounds and reams of data. Now they get to actually have their creative part of their brains -

Dave Vellante

>> Choosing animal personas.

Adam Meyers

>> Exactly.

Dave Vellante

>> Very cool.

Adam Meyers

>> But yeah, so Scattered Spider has been extremely effective. They have been targeting every type of industry vertical they can. We're seeing threat actors constantly change and get replaced. So as one malware gets disrupted by law enforcement or the government, another one will pop up. So Punk Spider is one that we're talking about quite a bit here, and it was featured in the report just for the speed at which they're able to operate. And then, we're also still seeing data extortion attacks where ransomware isn't always the goal. If they could steal sensitive data from an exposed cloud bucket or they could get in and steal something of value and get out, then they could just extort their victim using that information as well. So there's a lot of evolution that occurs from that.

Dave Vellante

>> How are adversaries using Gen AI? We talk a lot about they're phishing emails. We see those better texts, so that's clear. How else are they using it in novel ways?

Adam Meyers

>> That's a great question. We've seen some adversaries starting to experiment with Gen AI, particularly LLMs, where they'll use that to ... For example, Scattered Spider, we've seen use LLMs to write scripts to get access to Entra ID and things like that. We've seen Indrik Spider, which is another threat actor that does ransomware, using it to facilitate research. Use things like perplexity or ChatGPT or something like that. And they're using these things as well to facilitate faster research. What we're not seeing is adversaries building their own AI and LLMs. That's something a lot of people have raised awareness or concerns about. And when you think about the financial aspect of how much resources a ChatGPT or OpenAI has to put into training a model and ChatGPT 4 was $100 million dollars or something like that. No threat actor's going to invest in that. What they're going to do is they're going to try to gain access to a legitimate commercial model and use that. Where I think we might see a little bit more of it is in the disinformation, misinformation. We're heading into an election cycle. This year has already seen a lot of Gen AI being used in elections across the globe. Something like 55% of the Earth was electing new leadership this year. And so, as they've leveraged that to create deepfakes ... And Gen AI isn't just large language models, it's also being able to have voices. From this discussion we've had here for a few minutes, you can model all three of our voices and make us say anything you want. That's also Gen AI. Deepfake-

Rebecca Knight

>> Taylor Swift endorsing Donald Trump. I mean, right? It was the fake Taylor Swift.

Adam Meyers

>> Did she not do that?

Rebecca Knight

>> No. He hates Taylor Swift. No, but that was one of the things. There was a fake Taylor Swift doing just that.

Adam Meyers

>> Joe Biden as well. There was robocalls that were-

Rebecca Knight

>> Right, exactly....

Adam Meyers

>> trying to use Joe Biden's voice. And so, these things are the reality that we live in and disinformation, misinformation is being augmented with these technologies. But they could also be used for good. And that's where things like Charlotte AI, which is something that CrowdStrike has where we produce on the Intel team 3,000 pages of finished intelligence per month on average. And that's a lot of data. If you try to read all 3,000 pages, that's pretty much your entire day. So having an LLM that could enable ... Like Charlotte, that can enable you to ask questions of that data without having to read all of that information lets you kind of focus on fixing that one problem. But you have to be careful because LLMs do hallucinate, and that's another area of concern where you need to make sure that you have humans that are in the loop still that understand what questions they're asking and can kind of see when the answer doesn't make sense.

Dave Vellante

>> Well, the good generally outweighs the bad. You see that with big tech. What Google has done is a lot more good on the positive side of the legend, but the bad gets amplified and the politicians like to point that out. And of course with the elections, we've seen just 2012 was a little fun with social media. 2016, you started to see weaponization. 2020, it was like nothing we'd ever seen. And now with deepfakes ... And there are technologies to be able to combat that. I don't know how widespread they are. Maybe they're in startup mode, but you would know.

Adam Meyers

>> Well, if you talk to any teacher in K through 12 and college, they'll probably tell you that that type of technology to find when students are using these things to generate their own content is really important. But I think the other thing that's really worth noting is that as you look forward, a couple of years down the road, or maybe even faster, organizations are going to have their own models. They're going to have their own Gen AI. And that's where some of the things that we're talking about here, we talked about a partnership with Nvidia, being able to secure your AI workload. Just a few years ago, we just introduced the concept of cloud workloads, and now we're talking about AI workloads where organizations are going to have their own AI model running in some sort of a container environment. And if somebody tries to escape that and get access to the container or to the base OS, you're going to have a real problem. So you need to be thinking about those AI workloads. And then also data poisoning attacks and what goes into training those models. How do you keep the cheese from falling off your pizza? And the answer comes back, put Elmer's glue in it. And then you have to go and figure out where that came from, and it was some Reddit post from 2014 or something. So that's a whole other angle of attack that didn't exist before two years ago, really.

Rebecca Knight

>> So as we wrap up, you're a cyber security veteran. You've been in this industry a long time. I want to put you in a reflective mood to talk a little bit about this moment in time where the world is so much more exceedingly complex and there's so much more uncertainty. You really need to embrace ambiguity. And it's just hard. I'm sure your job is a lot harder than it's ever been. But sometimes when your job is harder, it's actually more fun. So just talk a little bit about this moment in time and what it means to be the SVP of Counter Adversary Operations.

Adam Meyers

>> It's a really good question. I think we're at a point in time where I see the evolution of everything hockey-sticking. It's getting faster by the day. And speed, as you said earlier, is what matters in this game. And you have to outpace the adversary and you have to do so in a way that allows you to think about where they're going next, but also be in front of where they are today. I always like the old hockey analogy of don't skate to where the puck is, skate to where it's going. And that's what we're doing across the industry and certainly here at CrowdStrike and why it is such an exciting time to be doing this. Because we added something like 30 new threat actors in the last 18 months, and they're not just new criminal actors, but entire new nations that we've added that we're tracking. So as the adversaries evolve and find new creative ways to get in, we find new creative ways to stop them, and that's the fun.

Rebecca Knight

>> Excellent. Well, great note to end on. Adam, always a pleasure having you on theCUBE.

Adam Meyers

>> Thanks for having me.

Rebecca Knight

>> Thank you so much.

Dave Vellante

>> Good to see you again.

Rebecca Knight

>> I'm Rebecca Knight for Dave Vellante. Stay tuned for more of theCUBE's live coverage of Fal.Con 2024. You're watching theCUBE, the leader in enterprise tech news and analysis.