Black Hat USA 2024 | Etay Maor | Cato Networks

theCUBE.net

Clips
More from Black Hat USA 2024

Etay Maor

Chief Security Strategist

Cato Networks

play_circle_outline Importance of recognizing attacker's efforts

play_circle_outline Rising importance of understanding AI in cybersecurity

play_circle_outline Use of AI by both cyber criminals and defenders

play_circle_outline Future cybersecurity focus on attackers evading security solutions and leveraging AI-based tools

Info
Transcript

Etay Maor | Cato Networks

Etay Maor

Chief Security Strategist Cato Networks

Etay describes Cato's success and market focus. He emphasizes the importance of giving attackers credit for the effort they put into breaching systems and urges organizations to be vigilant in identifying threats. The conversation shifts to the use of AI in cyber attacks and defense, with Etay highlighting the risks posed by deepfake technology. He discusses the need for collaboration between private companies and government agencies in sharing threat information. Etay also points out the evolving tactics of cyber attackers and emphasizes the importance of us... Read more

explore Keep Exploring

What is the importance of understanding the difference in effort required for attackers versus defenders in cybersecurity breaches? add

What are the benefits of sharing information and collaborating with others in the field of research, particularly when it comes to advancements in AI technology? add

What are the current opinions on whether AI helps the bad guys or the good guys more effectively? add

What type of shifts in attacks are we not likely to see in the future according to the speaker? add

bolt Powered by CUBE AI

Etay Maor | Cato Networks

search

>> Good afternoon, security community, and welcome back to Las Vegas, Nevada. We are coming to the end of our programming here at Black Hat. It has been such a thrilling week covering this massive cybersecurity event. My name is Savannah Peterson joined with John Furrier. John, I feel smarter than I did on Monday.

>> Yeah, I love the security. Every time we have a conversation, we learn more. This next one will be certainly a class from the professor himself.

>> I know. I am super pumped. Etay, thank you so much for taking the time to be here with us today.

>> Thank you for having me. It's good being here.

>> It's got to be a really busy week for you guys.

>> Always is, yeah. Black Hat, DEF CON, one after the other, events, talks.

>> So what's going on with Cato? I can only imagine the conversations you've been having this week. Where are you at? Give us a market landscape.

>> So, yeah, Cato is getting a lot of focus right now. We are crossing some very interesting thresholds, over 200 million in ARR, over 2,500 customers, a Gartner Magic Quadrant leader. So many things that we're very proud of.

>> .

>> Yeah, very happy about it. Yeah, we're getting the attention now from even more organizations understanding what it is that we do.

>> Yeah, absolutely. I loved our conversation earlier when you ... I liked that you have some frustrations with some of the ... You're a little bit of a rebel in what is already a rebellious community, I think, by nature or at least a vigilante in a cool way. You were talking about how people tend to focus on the final point of break or where systems failed, but it's not that. That means there's been security issues all the way through. What are some of the mistakes you see with your customers, or when people focus on that, why does it bother you so much as a leader in this space?

>> So if I have to summarize it in one sentence, I really hate the attacker has to be right just once, defenders have to be right all the time. I think we're downplaying how much goes into an attack. A lot of the breaches get just these headlines of, "Oh, company X was breached because of this vulnerability," or because of a password that was leaked. But what happened after that when the attackers got in? There are so many other security products that's placed. They actually all failed. So if you think about it from the attacker perspective, they have to be right a whole bunch of times, a lot of times, in order to reach their end goal. The attackers need to be right just once in order to detect or mitigate or even prevent the attack. So I think we need to ... I hate giving the attackers credit, give them more credit for how much work they're putting into it, and then we have to put the work in in order to identify those threats.

>> Well, I think it's important because it's not necessarily ... We don't have to give them credit, but we can acknowledge the passion and the patience that go into someone who's going to actually make a breach or penetrate into a system that has a high value for ransomware or whatever it might be. I've been shocked this week by some of the stories, fake businesses, all the different ways people get into the software supply chain. What sorts of things do you see and how do companies pay attention to something that might be very, very, very slowly happening?

>> Yeah. There's a couple of interesting points there. Number one, I think what we've also seen change in the last years, although not just the last year, but over time, is the type of targets that these attackers go after, right?

>> Mm-hmm.

>> It used to be the banks that used to be where the money's at. Now if you have data, and you mentioned it yourself, you could be a victim for ransom. Great. So we're reaching the situation of an asymmetric war between the attackers and the defenders because the same attack groups that will target the really large organizations will target your small mom and pop shops. So those small organizations need a Fortune 500 level of security-

>> That's a really good point....

>> which is very tough both financially and then headcount and maintaining all of it. So there's a lot at stake and there's a lot that needs to be done.

>> Well, and I mean you just brought up a fantastic point, which is security and cybersecurity should be a part of every business model. Every business plan, it doesn't matter if it's your lemonade stand that happens to have loyal customers that come all the time and you don't want their data stolen.

>> Yeah, I saw this nice saying that somebody posted. "This is out of scope," said no hacker ever. The same goes .

>> I need that sticker.

>> So, yeah, it applies. Another interesting point that you made here is around the time, right?

>> Mm-hmm.

>> They take the time. They're in there for a long time. One thing that I also find annoying is a little bit the discussion around how long are they in there? It seems to be like there's a consensus around six to eight months. It used to be 18 months. It looks like it's going down. I want to challenge that for a second.

>> Yeah.

>> I actually think those numbers are incorrect because when you think about a breach, there are three ways to discover a breach. Either you or the organization discover it, somebody tells you, like usually a three-letter acronym agency, or the attackers tell you. Unfortunately, with ransomware, which is the example that you gave, the attackers usually notify you. So they're taking down the overall time that they're in the network. They could have stayed for much longer and you wouldn't know about it. So I think the numbers are a little bit skewed because the detection time is because the bad guys told you they were there, not because you detected it.

>> Right.

>> It's throwing a dart at the board. You also do the cyber threats research lab. That's your team. You guys put out a threat report. What are some of the findings? What are the key highlights right now? What are the major threats? Obviously AI is being used by the bad guys too and good guys. What's the report telling you? You guys just published a new threat report out, came out.

>> Right. So our Cato CTRL SASE Threat Report, I'd say three things that ... Top of mind for me. Number one is actually the growing usage of AI tools within the organization, legitimate tools. So there's a huge growth. But that also can represent a risk, privacy, regulatory, security risks. Number two is the usage of different old vulnerabilities. Log4j, I thought we were done with that one. Three years into it and it's still being heavily used by threat actors, which means they're probably successful. There's stuff to exploit. Number three is the usage now also, we talked about AI, of deepfake technology by threat actors. So they use all kinds of deepfake technology to overcome authentication systems, image recognition, behavioral and bio-identifications. So really interesting tools of the criminal .

>> It takes social engineering to a whole another level, and the GenAI tools internally have holes in them. We hear people turning off Copilots, for instance, in organizations. It seems to be the trend. Are people realizing that? Is this obvious to the CISOs and what are people doing? What's the response to the organizations?

>> Well, there's definitely a growing trend of using AI, and I think CISOs are on top of it. I mean everybody's talking about it. But with any security issue, it's not an IT issue. It's a business-wide issue. So you need other stakeholders to understand that and go with it. That's actually the job of the CISO today is not just I know how to configure a firewall, it's I know how to take different groups within the organization and update them about what is happening and bring them together for a cause. AI is challenging in that aspect because everybody's now using it, and what is leaking out to it? How has it been used in my organization? Number one question, do I even know what is being used on my network? Do we know what AI tools are being used? A lot times the answer is no.

>> You're adjunct professor at Boston College, a college professor. Also, you do a lot of talks. You consult and advise from governments to large corporations. There's a national security discussion around cybersecurity. Scope that for us in terms of how much is the government involved? You mentioned the three-letter acronyms that people would notify you on a breach. What's the role of the government playing of cyber ... I mean I've always said that we need cyber military because people are on our shores digitally, we have to address that. What's the national security posture? Obviously critical infrastructure is still pretty brittle.

>> Definitely.

>> What's your view on how to stop the bad guys from a national security perspective?

>> First of all, the government is involved, and there needs to be, and there is, a recognition that cyber is a major thing both on the offensive and defensive side. While it's not maybe a weapon, and you see in different conflicts around the world now, there's conflicts in different locations, it may not be a tank that you see in the battlefield, but it's definitely a weapon that is wielded by nation states to target other nations. What is very different, though, about cyber is the fact that it'll target civilian industries. If two groups are in conflict, they may not go after directly the military, they'll go after the banking system, hospital system, payments, stuff like that. And so, government is definitely involved. I think they're doing a very good job. I have friends, CISO, in other organizations which are on top of things, and it is top of mind for .

>> What are some of the tactics that we're using that's new? What are some of the trade craft, if you will, for defense, for companies, private companies, and for the government?

>> I think for government, the major thing that I've seen the last couple of years is the close relationships they now have with the private organizations. Not necessarily a specific tool, but just building up those relationships and be able to talk and have an open conversation. It really used to be a one-way street. Like you would tell the government, "I've seen this," and they would be radio silent. -

>> And it just went into a black box.

>> Yeah, you don't know what happened.

>> Yeah.

>> I think they realized this. A lot of our conferences like the one we're in, Black Hat and DEF CON, try to foster these types of relationships. And so, you're starting to have these people that you identify, that you can talk to, build a relationship, and start talking and planning before even threats hit you. But how do we manage this if and when this happens? That has been the major ... I wouldn't be able to say this 10 years ago that I can have an open conversation with the government. It just wouldn't happen.

>> And data sharing too is important, right, in private sector?

>> Yeah.

>> How much sharing is going on, true sharing between companies on the private side and how much sharing with government, even amongst themselves and each other?

>> So I can't speak on how government is sharing, but I can tell that between the organization, security groups, private companies, there's a lot of sharing. There's a lot of groups that are largely ... That are really growing where people share these things. First come to mind are the ISACs of the world, the FS-ISAC, the RH-ISAC. There's a whole bunch of them where you see even researchers, it doesn't have to be the CISO, people who are the hands-on, the keyboard people, will go there and share indicators of threat, will share their experiences. It's all in our very controlled environment and people feel a lot freer to do these things.

>> I think it's nice because it feels like ... And you're affirming this. I feel like the culture ... I mean this is a very passionate community. The cyber community is people who really care about getting up and doing the right thing. You have a counterterrorism, cyber crime background as well, which is probably extremely relevant, particularly as velocity increases. I think it's so ... That what do you think ... Because this has come up a lot, this culture of collaboration, water level rises together, sharing certain best practices, because it is important for the reputation of the industry and innovation that maintain intact. But what do you think it was that changed 10 years ago or, sorry, has changed over the last 10 years rather, that has made that? Is it just a general awareness of the fact that the nefarious folks are also sharing this information, or what do you think it is?

>> I think it's a combination of things. One of them is that the bad guys are doing a pretty good job at sharing information. Again, I don't like to give them credit, but I've seen threat actors from countries which are in active war with each other will collaborate in order to make money. They're pretty open about some of these things. Even if it was within closed forums, they're open when they're doing these discussions. They do training, they help each other. They open forums and answer questions. That was mind-boggling the first time I saw the level of dedication that they have to other people in those communities. I think that's one element. Another is how big the problem became, because we used to be a much smaller community. Again, if we move back in time and came here 10 years ago, you'd see less people, but not because everybody can be a target. Everybody is a target. I think there's also an understanding that you can't beat this alone. We have to share information. So I think that really helped foster these types of discussions and groups. Some of it is very official, like the groups that I mentioned before. Others I can take my phone, I have groups, and I'm directly connected to other researchers, and we'll text each other in the middle of the night. It's like, "This happened. Do you see this? What do you think?" and people are very collaborative.

>> That's refreshing.

>> We did a straw poll, David Vellante put it on Twitter, but we were debating on theCUBE many times, so I'll ask you the question. Does AI help the bad guys or the good guys better? Who wins with AI better?

>> Yet to be seen. I will say that based on some of the discussions, and we actually put a ... Cato CTRL put a blog out about this. We've seen a discussion in Russian forums where they were actually saying it's not useful for us in its current situation. We'll use it for very small tasks. Some of them are saying, "We're looking to it in three to five years. Maybe it'll be this autonomous tool that we can use. Right now we're still on the fence."

>> That's interesting.

>> But one thing that I do say to my students, and I say this during events as well, is while I don't think we're even close to AI replacing people, all these Terminator, self-driving-

>> Yeah, singularity....

>> I don't think we're even close. I am sure that people who know how to use AI are going to replace those who don't know how to use AI. That's why I constantly encourage, for example, my students to, hey, get up to speed about what AI can do, but also what AI can't do and where it fails and some of the risks, because using a tool means ... Well, it can be used by anybody, right?

>> Yeah.

>> By a threat actor-

>> It's like a car or a plane. You've got to know how to fly it or drive it.

>> Yeah. It's just like any other weapon, depending on which hands it's in, it can be used in different ways. Right now-

>> What-

>> Go ahead.

>> What are the best ways people are using it to protect themselves? Scale? Is it going through data? What are some of the use cases? You see low-hanging fruit use cases.

>> Right. I know everybody's talking about LLMs and generative AI. I actually see unsupervised and supervised machine learning models being used exactly for that. We have huge amounts of data, and we need to make sense out of it. In our report, for example, we reviewed 1.36 trillion network flows. Now you can't find patterns in that with a human eyes. So we take models that we have been working on for almost a decade now and we'll just let them sift through the data, and it'll come up and say, "Hey, I've seen these specific indicators," or, "I've seen similarities," or, "I've seen three different events that might be benign on their own, but when you have all three in a specific timeframe, that's beyond suspicious." So we can identify these. So going back to your original question, I would say that right now, actually the security market is using AI more and with more success. That doesn't mean that the attackers are not. I think I've also posted about this. I've seen one very well-known ransomware group already say ... Sorry, not ransomware, but attacker group, looking to recruit data scientists and machine learning experts. They put this in a private telegram channel and said, "We're working on developing our own thing. We're looking for these mines right now."

>> Yeah, the money must be huge for that kind of vault.

>> I mean I can imagine everyone's trying to recruit in those roles, and not shocking that it would be on that side, too.

>> We have to keep in mind, now here's where we take the CISO role and go beyond. We said it's not just an IT issue. Now CISOs need to be aware of geopolitical things because guess what? When you have conflicts, like, for example, Russia and Ukraine right now, people lose jobs and people go and look for other jobs, and all of a sudden you see in these underground forums people pop up and say, "I worked for this company," or, "I am still working for this company. I have this type of knowledge. I need to make some money. Who wants me as their employee?"

>> Yeah, mercenaries. .

>> Yeah. You can't really blame them. They need to put food on the table at the end of the day. So now we're looking at the CISO role as like, hey, you don't just configure a firewall. You need to be aware of geopolitical situations and conflicts. It's much beyond just an IT issue.

>> Yeah, it's a corporate culture, too.

>> It is.

>> Culture and talent.

>> Yeah.

>> Yes. I mean it's a lot of things. What's next? What's next on the product roadmap? Where are you driving?

>> Oh, we're going to definitely expand where we are and what we do. Cato has been ... Is the SASE platform, but SASE is now expanding beyond the classic definition. We talked about we launched Managed SASE and SASE. We're going to look at the endpoint where there are other areas that we're going to be looking at to expand as well.

>> Well, that's very exciting. All right, last question, because you've been a wonderful guest. When we have you on the show again at Black Hat next year, what do you hope to be able to say then that you can't say now?

>> I'll be able to say then that I can't say now. I actually think that we will see ... I think what we won't see is actually ... I don't think we're going to see, because every time I'm being asked about what's the latest and greatest, we're not going to be seeing a whole shift in types of attacks, I think, that we're going to see. I think what we will be looking at is different ways that attackers have been releasing or running those attacks in terms of how they still remain under the radar because there will be breaches. So how are they still evading all those different security point solutions? How are they reaching their end goal? Something that's not happening now that I feel might be happening is with more consumers adopting more AI-based tools and then bringing them onto the corporate environment, I have a feeling we'll start seeing how attackers leverage that just as they leverage working from home during COVID. Once you bring a new attack surface into the company, they're going to be happy to take advantage of it.

>> All right. Well, I hope we're saying that here in the year. Etay, thank you so much for taking the time today. I know it's a busy week for you. We really appreciate having you on the show.

>> Thank you very much for having me, .

>> Yeah, and, John, always a joy with you. More importantly, it's always fantastic to engage with you, our fabulous CUBE community. Tuning into our Black Hat coverage here in Las Vegas, Nevada, my name's Savannah Peterson. You're watching theCUBE, the leading source for cybersecurity news.