Name: Adam Marre | Artic Wolf
Uploaded: 2024-08-07T22:30:00.000Z
Duration: 20 min 40 s

Clips
More from Black Hat USA 2024

Adam Marrè

CISO

Arctic Wolf

play_circle_outline Resilience in cybersecurity conversations

play_circle_outline Arctic Wolf offering free Cyber Jumpstart Portal

play_circle_outline Teaching cybersecurity to schools and seniors

play_circle_outline Concerns about AI tools in threat landscape

Info
Transcript

Adam Marre | Artic Wolf

Adam Marrè

CISO Arctic Wolf

In a conversation at Black Hat, Adam, the CISO of Arctic Wolf, discusses the importance of resilience in cybersecurity and Arctic Wolf's Cyber Jumpstart Portal, a free tool to help companies improve their cybersecurity posture. The conversation touches on the need for cybersecurity insurance, the challenges posed by AI tools in the threat landscape, and the importance of educating individuals, including students and seniors, about cybersecurity. Adam also expresses concerns about disinformation campaigns and calls for a more substantive discussion about cyber... Read more

explore Keep Exploring

What are cybersecurity professionals focusing on in light of recent events? add

What is the purpose and goal of the Cyber Jumpstart Portal offered by Arctic Wolf, and how does it benefit organizations in terms of improving cybersecurity and incident response? add

What is being done to educate state and local governments, school districts, and individuals about cybersecurity resilience and protection measures? add

What is a growing concern related to AI tools in terms of cybersecurity and attacks? add

bolt Powered by CUBE AI

Adam Marre | Artic Wolf

>> Good afternoon, cybersecurity nerds. And welcome back to Las Vegas, Nevada. We are here coming to the close of day two of our coverage at Black Hat. My name is Savannah Peterson. Very excited for this next segment with our new fantastic guest. Adam, welcome to the show.

>> It's great to be here.

>> It's really exciting to have you. Arctic Wolf having a moment right now. I can imagine it's a busy week.

>> Very busy week, yes. We're talking to a lot of people.

>> What are some of the themes of the conversations you're having this week? The cybersecurity conversation couldn't be hotter than it is right now, front of mind for a lot of people. What have you been talking about?

>> One of the biggest things I've been hearing a lot about is the word resilience, right?

>> Yes.

>> Of course that's top of everyone's mind right now. Of course, those of us who've been working in cybersecurity a long time know that resilience has always been a very, very important topic. But of course, due to recent events, a lot of people are talking about it and thinking about it. And so we're here to help everybody start their resilience journey or improve and just be better at making sure that when bad things do happen, because they're going to happen, that you can get back up and running very quickly.

>> Well, I think that matters to every business on the planet right now, so quite a critical surface. Speaking of getting those companies started, you just released a huge free product offering to help companies on their journey. Can you tell us about that?

>> Yeah, so it's our Cyber Jumpstart Portal, and it's really a place where companies can come to record, write down, be honest about where they are in their cybersecurity journey and their resilience journey, and they have a place to record that measure that score it. And they can really start that process, and we are allowing them to do it for free.

>> What made you feel so generous?

>> Well, it's really important that we make sure that people are really looking at what they're doing in cybersecurity and understanding it to a level that they then know what to do next. So what are the things that they need to improve, where areas maybe that they're weak in, how do they find what the priorities are for them to work on? And that really can help them in a lot of areas. And if Arctic Wolf can step in to help them with that journey, we'd really like to. If they need to go to other solutions, that's good too. We are really here just to help people improve their cybersecurity. I'm the CISO of Arctic Wolf, so I really don't. I'm not on the sales side. That's not really what I do. So this is really exciting for me because I just want to give back to the cybersecurity community and be part of that. My job is to secure Arctic Wolf, and so this is also something that we can use internally.

>> So it's a win-win for everybody. Plus, I would imagine you learn a lot through seeing people engaged with that platform.

>> Yeah, absolutely. And it gives us a huge head start when... We also have a hotline, so if somebody has something wrong, we have an incident response practice. And if they've already filled out anything on the Cyber Jumpstart Portal, it gives us a head start in helping them with that really bad day and getting them back up and running as quickly as possible. So that really helps too.

>> Yeah, I can imagine if, for no other reason, that would be a reason to engage with you, just to have that extra line of defense given the chaos that's going on right now. You've helped over 40,000 organizations with this tool already. It just came out in 2023.

>> Yeah, it's been very popular, so a lot of people want it.

>> I mean, that's adoption and a half. Are there any trends? Are you seeing adoption in certain categories faster? Is it ubiquitous across the market?

>> Much like our MDR service that we offer to people, we have customers from all stripes, all varieties, all verticals. We see everything. It actually gives us a really good view of what's happening in the threat environment today, and that's also in our Cyber Jumpstart Portal. There's all kinds of customers there.

>> Wow, that's really cool.

>> Yeah.

>> How often do customers graduate from these gateway platforms and into much more comprehensive solutions? Not that you have to be in sales, I would just imagine they come to trust you.

>> Yeah, they do. We do have a lot of conversion that comes from that. And it also starts a lot of great conversations. And we get people who might just get our IR on retainer, service as well. And then this can also really help them in their journey toward insurance. That's one of the things that's actually really leveraged against everyone. I was talking about their insurance premiums and how they're going up. Of course now we might see some softening in that market. But this is a really big help to them seeing what they can do to actually get those premiums lowered. So not just starting their journey to actual security and really improving their security stance, but also where can they get insurance, and can they get those premiums lowered, and where are the best things they could do to get those prices down.

>> Yeah. And some of the data and research I was doing when I was stalking y'all, only 26% of businesses have a standalone cybersecurity policy?

>> Yes.

>> That's pretty jarring to me.

>> It is, and it's something a lot of companies come to regret when incidents happen, right? As we say-

>> Sure. Can't back that one up.

>> Yeah. As we say in cybersecurity, it's not if, but when, and when and how bad. And you are going to be really, really happy that you got that insurance policy and have those partners helping you. And Cyber Jumpstart is a great place to start. If you have no idea what to do, you don't know where to look, or you've been out there, you've talked to brokerages, and those premiums seem too high, we're a great place to start to say, "How can I begin to bring those down and look more attractive so that more people will want me to bring those rates down so I can get a good insurance policy?"

>> Well, and it makes sense. It's doubly beneficial. Your system's more secure and you're also not having to pay as much for insurance. Well-

>> And there's a reason they bring the premiums down because if you have these things in place, you're much less likely to be breached.

>> Right.

>> So it's a really good thing for you to do.

>> It reinforces the good behavior and keeps the bad guys out.

>> Absolutely.

>> Speaking of bad guys and threats, you have a fascinating background. You come from video games at Disney all through a almost 12-year stint at the government. Senior SWAT team leader, analyzing cyber security threats. And now you end up the CISO of Arctic Wolf. What led you to work for them next? You're obviously a curious professional.

>> Yeah, so it's been a great journey. I've been very blessed to have the privilege and opportunity to be able to do all the things that I have. And at each step I've learned more. I did not start this journey thinking I would love cyber security. It was something that I had the opportunity to work in the FBI, realized I loved it. They were able to give me a lot of training, a lot of experience in that. And then when it came time to try it out in the private sector, see if I could, instead of showing up when companies are having bad days and helping them out, which was great, I wanted to see if I could protect a company itself. When the opportunity to join Arctic Wolf came up... First of all, these are my people. I'm a security professional, but not only that, I'm a security operator. I come from that operations and incident response background. That's what we do. It's our bread and butter. So I get to work with my people. And then also it's a great opportunity to be a CISO of a security company. That's really fun. One of the great parts about it is I get to have a role in the product. I've worked at other companies where the product is not my specialty, it's not my area. So when you get to work at a security company, you also get to have a hand in the product and how it comes out. They're going to ask you questions like, "What do you think next? What would be good?" And it's really fun to be involved in the product in a way that maybe most CISOs don't get a chance to be.

>> That is fun. I can see the excitement on your face when you say that, so I know that it's genuine. Yeah, I mean, I think that's really interesting. Do you still get to interface with the government in your role with Arctic Wolf? It seems like there's a lot of cross-industry collaboration going on in cybersecurity.

>> Yeah. So we do have a lot of opportunities, whether it's sharing indicators of compromise, IOCs back and forth with various government agencies. I also still have friends there, so we get to talk and have the kind of conversations over choice beverages about what's going on. And of course, if we ever see anything that requires us to report to law enforcement, we do that as well. So I get a number of different ways to-

>> Yeah, kind of across the board....

>> to talk and interact with law enforcement in addition to being parts of programs like InfraGard and things like that where you get to interact with the FBI and other law enforcement agencies. So lots of opportunities. I actually encourage everyone, every security professional as part of an organization, if you haven't made contact with the FBI, if you're in the US and you haven't made contact with the FBI in your area, a lot of people don't know, you can just call them up. You can call up the Cyber squad and say, "Hey, we want to know you. We want to get to know you." And they would be overjoyed to come out talk with you. They could even give presentations to your company. They can do that. It's just a great chance to get to know them. And the reason they want you to do this is so that, one, you'll be more likely to report to them if you do have a breach. And when bad things happen, you're not scrambling to figure out who do we call. You already know. You got the card.

>> Right. No . Yeah.

>> I used to do this as an FBI agent, a lot of outreach with companies, and because they're not that likely to call the FBI, but they're likely to call Adam. And so I did that a lot. I encourage people to go out and do that with the FBI, which is what I do as well.

>> I mean, I was just going to say, I think you're the first person to tell me to call the FBI proactively in a positive fashion versus something else. But I think that's great for people to hear. I've been really impressed this week, in particular, just about the amount of collaboration and the people sharing tips and tricks or free tools or things that are going on, whether it be the FBI or a small startup. Everyone's in this together to make it better. It's clear education and partnership is really high on your list. I love this also when I was doing my research, y'all are doing a presentation in Edinburgh on how to build cyber resilient schools. So I want to ask you in a couple soundbites, how do you build a cyber resilient school? It's obviously got to be a big issue for parents and people around the world.

>> Yeah, we actually have a lot of state and local governments, and that include school districts as our customers. They really need to start thinking about how to build those schools as resilient. They need to look at their systems, partner with organizations like Arctic Wolf and others to make sure that they're resilient. But then also we want to make sure that the individuals in those schools, kids-

>> That's what I'm thinking....

>> are resilient, that they understand cybersecurity, they understand the fundamentals. You know what's amazing? Is the fundamentals of cybersecurity actually don't change for an individual organization. They're the same basic things. You got to protect your identity. So usernames and passwords. Use a password manager. It's a little more complicated in an organization, but it's the same principle. Keep your stuff up to date, make sure that everything is patched. Keep your phone up to date. If you're a kid, you have a phone, make sure that it's on the latest version. And then being aware of social engineering, be that phishing or any other types of scams. You just need to be aware of these things and have ways that you protect yourself. And so we go into organizations like schools to educate people, and it's really the same principles. It's fun to be able to share that with them and share that with others. We actually have a program. So the office I'm in is based out of Utah. So we're in Pleasant Grove, Utah. It's one of our security operations centers are, and we have over 150 operators in that office and that's where I work out of. We actually started a program there where we educate actually seniors in the same way, teaching seniors to be resilient.

>> Cool. So important.

>> So many of them unfortunately fall prey to scams and things like this. So it's a way that we give back to those folks as well. So we want to spread the cybersecurity knowledge, the cybersecurity love, in as many places as we can.

>> I bet that's really heartwarming work.

>> Well, it's one of the reasons I was in the FBI. And it's one of the most rewarding things, is to help people become more secure and hope you don't have to do it after they have a breach or after they get hacked, but you don't want to let that opportunity go to waste either.

>> Yeah. You want to give them that and that trust. I've done some work with ARP. The senior community really hits a chord with me because they're so vulnerable and significantly more vulnerable than most other populations because of that and often ignored when it comes to tech education, unless you're a very large government body. So I think that's really lovely. Thanks for doing that. Is there anything that scares you in particular about our threat landscape right now?

>> I mean, one of the things that I think is of biggest concern is really, I said it earlier, is our resilience. But if I was going to pick something right now, I would talk about these AI tools that are out there. One of the reasons I bring those up is because they were unleashed on the world, ubiquitous to everyone who has an internet connection. Basically for a very small fee, you can have extremely powerful tools at your fingertips. And right now it's accelerating lots of different types of attacks like social engineering and things like that. I think we might be a little bit overconfident in our ability to detect these. It's having all kinds of effects, whether it be direct assistance to hacking and finding vulnerabilities, if it's things like helping people do social engineering. Now, there's not bad grammar and phishing emails, things like that, but all the way up to miss and disinformation, like deepfakes. I don't think we have the cultural machinery, the cultural tools to deal with this yet. We're going to build them, or we'll build them over time. But right now, that's one thing that concerns me. I don't know if we're necessarily taking this serious enough. Obviously in the security community, we're talking all about it here at Black Hat. But in general, I have found either maybe a little bit of nonchalance or a little overconfidence in our ability. I can see those. Well, we got to remember that these tools are as bad as they're going to be right now. They're only going to get better and they're going to get more involved. And yes, as we mature, we're going to use these for good too.

>> Of course.

>> There's talks here at the conference about that, but it's one of the things that concerns me, especially this year as we have elections all over the world happening. This is just a test bed for these adversaries who want to just throw wrenches into the works and try to see what they can do, preparing for the future and being able to use this. So that's one thing I see in the threat landscape of concern to me.

>> Oh yeah. I mean, we have a tendency to overinflate our human potential a lot when it comes to even eyewitness accounts in a courtroom or being able to tell. We had Nicole from Darktrace on earlier today, and she was saying they've done tests with folks with AI-generated content versus not. We can only tell 50% of the time. And that's at its worst to your very point. Just imagine where we're going to be in six months. I mean, even just the way they're using Kamala Harris voice in deepfake ads already, it's haunting to a degree. I think that there are some very clever and creative nefarious folks who have seen how fragile particularly US are in the past. And I think it's a huge vulnerability. I think the next 95 days are going to be kind of wild.

>> They're going to be wild, particularly in this country. But we have to remember also these elections are happening all over the world.

>> Everywhere. Exactly.

>> The thing is, we're putting this tool like, it's not just nation states now that can use this. Individuals. And-

>> Right. Right. Right. It's people creating memes basically.

>> Absolutely. Well, a huge percentage of people get all of their news or the majority of their news from social media, which is a place where these memes can just get-

>> Catch fire....

>> promoted and catch fire. And a lot of people maybe aren't bringing their most awareness to their doom-scrolling.

>> Critical thinking isn't always in the late night headline grab.

>> Their critical thinking and really sort of understanding and maybe it just hits the back of their mind. But that can really move people's opinions, especially those that maybe aren't as tuned in the news junkies. The people who are not like that are going to be going to be swayed. And that's another thing we like to do as humans. We like to think, "I'm not able to be manipulated."

>> Oh, right.

>> "Oh, I'm smart. I know better."

>> Oh, yeah.

>> And we have to understand, all of us have to approach all of cyber security with humility. Any of us can be tricked at any time. Even memes, we've doing this for years and years. But all of us also could be manipulated. And that's what really important for us to understand what these mis and disinformation tools. So it's not just the security aspect, but the true information security like, "Is this information true?" And these AI tools are really adding an additional, as you said, exciting element to what we're dealing with in the next few days or the next a few months.

>> Yeah. Yeah. I mean, whatever happens here and elsewhere, we'll set the precedent for, like you said, elections everywhere else. What's your advice to folks? Even just the average voter during these election cycles, wherever they might be in the world, how can they be most savvy to the potential lies they're being sold?

>> Yeah, I think there's a number of things that are really concerning to me, and one is going to be talking about voter turnout. Imagine somebody is able to post something 24 hours before an election that's a false story about what's happening at a voting place, where's there's a shooting there, some sort of violence or it got moved or the hours are changed. I think people really need to take time to understand where can I get really good, reliable information and make sure they're going to those sources for the information about the candidates and what they say for sure, but also about how to vote and things like that. And make sure they're taking the time and not getting their information from social media sites and places like this. I think we need to start a real good conversation about this nationally about, do we want our news to come from these places? I mean, these social media companies have a huge role to play in this, and largely we've left them unregulated. I mean, they're a huge business per market cap.

>> Yes, almost an understatement.

>> And we don't have an FAA. We don't have an FCC. We don't have-

>> No, no....

>> any of those regulatory bodies over them. And it's almost like something we hold sacrosanct about the internet that we're not going to do that. And I think we really need to take a look at that as a community to decide, is this the way we want to have those regulated. So that's one thing. But also just the aspect of the way these election workers, I mean a lot of them are just kind of normal people and a lot of them are getting death threats and other things.

>> Oh, it's wild.

>> This is a really big concern.

>> I worked at polls in California. And even being in California, my county is a little split, or my town. Actually not so much San Mateo County, but Pacifica. And I have been spit at, I've had things thrown at me. And that's just in non-partisan apparel standing there to collect your ballot. And that's before this era of AI. So I actually have a neighbor who puts fake news in my yard as a result of my yard signs. So it affects us on an individual level, and I think it stirs this cauldron of animosity and spite that really shouldn't exist against our fellow humans because of the fallacies that are spread. So I'm glad we got to talk about it.

>> Yeah. So I just really think we need to get to a place where we're back talking about substantive issues. And I want people to be passionate about their side and talk about it, but it's this fake information and interference from parties that don't have a true interest in the free and fair election. They just want to sew craziness or chaos or whatever it is. Yeah, that's something we need to be concerned about. And it also has a direct effect on cybersecurity as well, because all of those things can be leveraged to breach an organization.

>> Exactly. In the same way, gosh, it's like the fake emails that go by iPhone gift cards and all that stuff just magnified. Kind of haunting to think about. On a more positive note, Adam, since you're a fantastic guest, and I suspect we'll have you on many times again, what do you hope to be able to say, let's call it at Black Hat next year, that you can't yet say today?

>> Let's see. I would like to say that we had a free and fair election besmirched by attacks, be they direct cybersecurity attacks or others, and that we've had a peaceful transition into a new government. We're doing well there. And I would also like to say that we have gone a full 12 months without a major cybersecurity incident outage in the country, and that people's organization's resilience is much stronger than it's today and we learned a lesson from any of these events that have happened recently.

>> Beautifully stated. What a sound bite. Thank you so much, Adam. Really appreciate you taking the time today. And thank all of you for tuning in to our two days of fabulous coverage here at Black Hat. We're in Las Vegas, Nevada. My name's Savannah Peterson. You're watching theCUBE, the leading source for cybersecurity coverage.