mWise Conference 2024 | John Hultquist | Google Cloud

theCUBE.net

Clips
News
More from mWise Conference 2024

John Hultquist

Chief Analyst, Mandiant Intelligence

Google Cloud

Navigating cyber warfare: How nation-state threats are shaping global cybersecurity

The landscape of today’s cyber threats means that the lines between nation-state espionage, cyber warfare and private-sector attacks are increasingly blurred. How can companies navigate those intricate lines to overcome threats, such as Volt Typhoon, and achieve robust resilience in the long term?Google’s John Hultquist discusses the impact of threats, such as Volt Typhoon.“Most people would agree that the Volt Typhoon activity is probably the biggest threat right now,” said John Hultquist (pictured), chief analyst at Mandiant Intelligence. “That is Chinese espionage or cyber espionage that’s coming out of China where they’re digging into our critical infrastructure

play_circle_outline Volt Typhoon cyber espionage threat from China targeting critical infrastructure.

play_circle_outline Impact and likelihood assessment to assign risk in cybersecurity.

play_circle_outline Geopolitical factors influence targeting by threat actors like North Korea, Russia, Iran.

play_circle_outline Psychological impact and trust manipulation in cyber disruptions.

Info
Transcript

John Hultquist | Google Cloud

John Hultquist

Chief Analyst, Mandiant Intelligence Google Cloud

In Denver, Colorado, John discusses cybersecurity threats with an expert. Volt Typhoon activity poses a major threat from Chinese cyber espionage targeting critical infrastructure. Russia is also a concern, targeting technology firms. Companies need to prioritize threats and build a strong security program. The conversation covers geopolitical trends, such as Iran targeting Israeli companies. The discussion shifts to cyber warfare, emphasizing psychological impact over practical effects. AI is used by both attackers and defenders, with defenders having an adv... Read more

explore Keep Exploring

What is the biggest threat posed by the Volt Typhoon activity, involving Chinese cyber espionage targeting critical infrastructure? add

What factors should be considered when assessing the impact and likelihood of a supply chain threat for a technology company? add

What are some trends in cybersecurity targeting that are seen in countries like North Korea, Russia, and Iran? add

What are the potential impacts of cyber war on the private sector and public trust, and how is the government working with public-private partnerships to address these challenges? add

bolt Powered by CUBE AI

John Hultquist | Google Cloud

search

>> Good morning, cybersecurity community, and welcome back to Denver, Colorado. We are midway through day two of our two days of coverage here on theCUBE. My name is Savannah Peterson, in another John sandwich for this segment. But I'm initially joined by John Furrier. John, this morning has been so fun. .

>> Great. This next guest is going to have all the data on the global landscape. Love this segment.

>> Geopolitics Pro Alliance, John, thank you so much for joining us. Welcome to the show.

>> Thanks for having me. Thanks for having me.

>> We really appreciate it. I got so excited when we sat down and immediately started talking about different nation states and threats. I'm just going to go big picture here. What's the biggest threat to our domestic cybersecurity today?

>> Well, I think that most people would agree that the Volt Typhoon activity is probably the biggest threat right now. So what that is basically Chinese espionage or cyber espionage that's coming out of China that where they're digging into our critical infrastructure. They're essentially gaining access to water, power, rail, all these really critical spaces. And the job there is like they're waiting, they're basically digging in so that if they get the order, they can disrupt. And so there's a scenario where a military operation kicks off and they go in and start disrupting our critical infrastructure. The really, really disconcerting thing that's been going on lately with it though is that they're moving away from to sort of military focused critical infrastructure or critical infrastructure that's highly related to let's say the ability of a military to mobilize and they're hitting a lot of random things, so the more random things. And that means just about anybody could be kind of a victim or a lot of different industries could be a victim, and that's a major concern of ours.

>> Definitely.

>> Is disruption the tactic, just overall chaos?

>> Yeah. So getting your industrial control systems or your OT systems and start breaking things. And it's really chaos, I think that's a really good way to think about it. We're going to get all of that stuff working again. I doubt that people are going to get... It's not really a violence thing, it's more of a disruption thing.

>> What's changed on the leaderboard? Last year you guys had stack ranked some names. Can you give us, China's still number one? Give us the ranking.

>> The breadth of activity that we see, they have so many different players or operations going on at all times. And then the really, really aggressive nature of the Volt Typhoon activity, I think that makes it, puts them probably up pretty high on our list. They're not the only player that we're really worried about. Russia's done a lot of interesting things in the last year. They're targeting technology firms, for instance, really all the way from the top biggest to the smallest. I'm talking hypervisors down to resellers, to get down basically to leverage their access to their customers. And so we're seeing a lot of that that we're really concerned about too.

>> When you say that, let's just dig in there a little bit with that Russian example, is that so that they CAN pose as those businesses to everyday customers like us on the other side?

>> It is basically leveraging your access to those customers. So if you're a reseller and you have credentials to, let's say, the systems that you set up or sold, they're going to leverage those credentials to get downstream to your customers. The whole game is basically moving upstream. And so the really good players, that's what their game is. They want to constantly sort of move to these positions where they can pick and choose the victims that they want.

>> I mean, every entry point, there's no downside to any of these guys. It's get in, it goes to a dead end, okay, try another one.

>> Try another one, find another opportunity. And there's plenty that .

>> So companies can't make a mistake once, but the hackers can make a mistake all the time. Who cares? They're just getting in.

>> I think it's a really important thing to think about it. Sometimes we... There's a concept of the offensive advantage. And I think it's very real because they can get caught and they'll just retool and go right back at it. It's a tough problem.

>> What do companies do? Because obviously there's a lot of re-movement, reconstitute the teams, certainly the bad guys are doing that. Companies don't want to make a mistake. What can they do to prepare with all this upstream activity? What's your advice to the companies to protect themselves with all these threat actors?

>> Well, I think the most important thing to do is you have to build a security program that's designed to respond to a changing actor. And I absolutely believe in best practices and we absolutely have to do best practices. But you cannot build a security program, you can't manage risk without having any idea who the bad guy is. And you need to really start thinking about what are the threats to your organization, because everybody has a different threat picture, and work your way backwards and prioritize the things that matter most to you. And I think that's really the best way to go about all of this.

>> Kevin said on his keynote yesterday, "Accept risk." And I think I won't say tongue in cheek, he's not a tongue in cheek kind of guy. He said it directly. And then it's about accountability. How do you assign risk when you have changing landscape, changing tactics? I can sign up and say, hey, I'll take the risk as long as I don't get breached. But who owns it? So how do you do that? How does a company say, how do you assign the risk, or is a team's... .

>> Well, I think you have to look the matter of impact and likelihood. If you are running, let's say we're just talking about say the supply chain threat, moving through it. Well, if you're a technology company, somebody targeting you to get to your customers is actually a really bad, almost existential scenario. And that's a high major impact scenario. So what's the likelihood of it? Well, it depends on who's coming after you and why they would come after you. It might even depend on who your customers are. If your job is to sell flour to bakers or something like that, you may not be a high priority. If you're selling to the defense industrial base, you're on somebody's list.

>> Absolutely. And people are curious. Actually, let's dig in there. So we're talking about on somebody's list. Do you find that the lists or the approach tends to follow geopolitical lines, for example, North Korea?

>> Oh, absolutely.

>> Yeah. So can we talk about that? Can you talk a little bit about the trends you might see in say a North Korea versus a Russia versus an Iran?

>> So Iran for instance, Iran's been incredibly busy in Israel since the beginning of the conflict there. Companies that are headquartered there, that are doing business there. We've even seen companies that are building industrial control system components being targeted on a global level just by the fact that they're Israeli associated. So the geopolitics absolutely factors in to the targeting that goes on there. When it comes to Russia, we're obviously concerned about what's going on in Ukraine, but the cyber element doesn't really end at that border. Particularly in Eastern Europe, there's a lot of strong focus there. You may not be an Eastern European company, but you may have a lot of assets or business there or interests there. One of the first things when the war began, I got a call from a customer who told me that they'd been affected by an attack that was really focused on Ukraine, but it just sort of escaped the boundaries of Ukraine. One of the most expensive incidents in history was the NotPetya incident, and it was actually focused on Ukraine, but it still managed to break global shipping, productions of vaccines. Oreos weren't getting to shelves. It was a major incident.

>> My gosh. It's a calamity.

>> It's a cyber war right there for you.

>> I mean, what is the prognosis? What's the... The cyber war thing is real. I've been a big hawk on theCUBE, you know that. There's physical war and then there's digital war. We got to protect ourselves here in the US. Companies, they got to build their own militia basically to protect themselves. How is the government aligning on this? And has the public-private partnerships figured out how to fill the void? And so what's your take on this? And people want to know. People are starting to figure out, okay, I see that all this cyber disruption, that affects my airline, my Oreos. You're like, what the hell? How did we get here?

>> Well, I'll tell you, there's really two sides to the coin. The first side is that, I mean, the bad news is that unfortunately when it comes to cyber war, a lot of it, it takes place in the private sector. At least in the United States, the private sector controls most of the critical infrastructure. So if we get into a military engagement anywhere, the response could be in cyber and that response can very well be against the private sector. That's the bad news. The good news is that a lot of the cyber sort of disruptive, destructive cyber activity is not actually about practical effects. The good news is a lot of these things can get repaired and brought back online ultimately. What they're really often trying to do is scare us.

>> I was going to say optics, yeah.

>> They're trying to break things. They're trying to break things for a short period of time to make us think that we can't trust the things that we rely on. It's actually the same threat for the elections. My concern is not that somebody's going to break the election or change the outcome of the election. My concern is somebody's going to change our trust in the election or affect our trust, and that's where a lot of this activity is really bad.

>> So it's a cultural impact instead.

>> Yeah, it's a psychological impact.

>> I mean, we see it right now. We see it already.

>> Psych ops all the way.

>> Yeah. I mean the era of fake news has been quite an example of that, and that's not even a cyber attack. That's outright lies on blog posts. But it's to same system.

>> Well, I think it's a good example. It's a good example of how serious this can be. They recognize there's opportunity we're demonstrating on a regular basis, and they're going to try to take advantage of that.

>> Deepthink is great, and having your boss think you're supposed to send a wire of $10 million to .

>> Well, yeah, the other interesting thing that we have to deal with now is unfortunately the idea of adversaries using AI. Yeah. We're seeing more and more pickup of that in the criminal space and the espionage space.

>> Has the global stage in terms of politics started to recognize the state movement? Because remember the early Mandiant conversation we had a couple of years ago where they were using open source tools to kind of off-book run stuff. But now you're starting to identify, you guys are doing a great job doing that. Has that elevated up the conversation on the global stage?

>> Oh, absolutely. Absolutely. I think one of the important things I think that we do is try to get this information out into the global space. When I first started doing this a long time ago, one of the issues that was going on is that Chinese cyber espionage particularly was targeting the commercial sector, the private sector. The government, we knew about it, but the government had never publicly talked about espionage. That was not a thing the government felt comfortable doing. And so you ended up in a situation, the government knew a lot about what was going on, they didn't want to talk about it, but they weren't the ones being affected, and so nobody was having this conversation in the private sector. And we've shifted a lot out of that. This conversation's happening in public now. And it needs to stay that way.

>> What do you think was that shift? We were talking about the quiet secret, cyber security didn't want you to know about cyber security for a minute and nobody wants to know there's potential threats or risk or whatever. What do you think has brought the community together this much? Because it's very much been the same in the whole week and the last couple of years.

>> I think the APT1 report was groundbreaking. It was essentially a public statement that this stuff is going on, it's comprehensive, it's getting a lot of the private sector, and that it's time to essentially start organizing and fighting back.

>> As a veteran in the industry, you guys do great work. Props to you guys. But as an individual, you put your citizen hat on, what's changed the most from last year to this year? And what do you expect this year coming up going forward?

>> I think the biggest thing that's changed, I think, has just been those adversaries continuing to adapt to our efforts. I talked about the APT1 report. The adversary that we were talking about then is unfortunately maybe a bit better than they were then. It was unusual for them to come right out of a Shanghai net block or something like that. It wasn't unusual for them to use sort of bottom dollar tactics. The stuff that they're doing now is far better. I talked to you guys I think last year about the zero-day tactics. They're continuing to get good at that.

>> They're air-raiding.

>> Yeah. And we've seen so many more since last time I talked to you. I think we've seen six this year, and I think we're going to see another six before the year is out.

>> So they're upping their game.

>> Yeah, they're absolutely. You mentioned the incident that the FBI had been involved in. That's one of the major evolutions we're seeing. They're essentially creating these ephemeral botnets out of people's, it was compromising people's home routers. And so literally APT is coming from somebody's house into a target and they're changing it up constantly. And that means that-

>> ....

>> the network indicators are disappearing, they're harder and harder to detect them. It's definitely a bigger challenge than it's ever been.

>> A lot of game theory involved, a lot of hunting.

>> Absolutely.

>> Automated hunting, automated red teams.

>> Yeah.

>> I'm curious specifically because you mentioned AI and espionage, how is AI enabling either both the nefarious side of that and then our defense against it?

>> So I personally believe it will be a bigger boon for us as defenders than offense.

>> We love to hear that.

>> But offense is definitely taking advantage of it. The biggest place that they're taking advantage of it is the ability to fabricate content, video, audio, text, you name it. They can create these fake people on social media and they use that for social engineering. It's a huge boon for social engineers. If you think of like a North Korean or an Iranian social engineering attack, it used to be a lot of the activity was a one-day attack, they'd send you one message and then hopefully you click on something. We're seeing them take like a month now to work somebody over. It takes a lot more fake content, and AI is enabling them. The good news though on the opposite side though is it's an incredible tool for cybersecurity. It's really good at finding anomalies. It's really good at breaking down code. I ran a cyber espionage intelligence team. A big thing that we did was reverse engineering malware, and we've been able to use AI to do some incredible stuff in the reverse engineering space. And we're talking about it's taking days off of the time to respond to something. It's really incredible.

>> So it's a double-edged sword but it's good news for us.

>> I think that's a good way to think about it. Yeah.

>> All right.

>> Yeah, I absolutely love it. You brought up something that I think is really important. I think folks maybe not as deep in cyber security as we all are, they think a hack or something happens I think much quicker. You're talking about people embedding in systems for a very long time, some of these bad actors hanging out, posing, maybe a month is one example, but even years.

>> Oh, yeah.

>> How long do you think bad actors are acting on average before we end up seeing some of these bigger incidences?

>> Well, it's interesting. We track dwell time and this sort of a piece there. There's really two types or two sides of the coin. Espionage actors want to stay there, they want to hang in there. They want to gather as much intelligence as quietly as possible. But on the other side, ransomware actors have kind of broken that theory because they want to be in and they want to be ransoming you as soon as possible.

>> Smash and grab.

>> In, get rich, and out.

>> Exactly. And so what's really interesting is we know now that on average, it takes about 48 hours for them to get into place to disrupt the network. But because the new piece of this game is the extortion element and the leaking element, we now know that they'll spend actually three times as long on a target just to get that data because that data is so valuable when it comes to negotiating a ransom. People will pay to protect their by personal privacy .

>> Right, engineer that.

>> Oh, absolutely.

>> And they know the alternative to negotiating the payments, so they do the math in saying this is the number.

>> This is the number. And then I can tell you, we know that there are the higher MBA types in the criminal side to figure those numbers out. Their targeting is very smart.

>> Cost to defend versus payout.

>> Insurance, they're thinking about all those things on their side.

>> Defend, cover.

>> It is sophisticated.

>> That's extortion.

>> Absolutely.

>> John, thanks so much.

>> Wow. Yeah. Extortion, espionage, we've covered it all. I wish we had more time. John, thank you for giving us the time that you could.

>> Thank you.

>> Always a pleasure to talk about this kind of cool cyber warfare stuff with you, John.

>> It's going to be in our movie.

>> I know it is. .

>> The script's writing itself.

>> And I hope that all of you tuning in wherever you might be are enjoying this as much as we are. Day two of coverage here at mWISE in Denver, Colorado. My name's Savannah Peterson. You're watching theCUBE, the leading source for enterprise tech news.