mWise Conference 2024 | Nick Richard & Kirstie Failey | Google Cloud

theCUBE.net

Clips
News
More from mWise Conference 2024

Nick Richard

Mandiant Sr. Manager

Google Cloud

Kirstie Failey

Mandiant Principal Threat Analyst

Google Cloud

Unmasking hidden threats: The challenge of long-dwell cyberattacks

As cyberattacks become more sophisticated, advanced threat detection continues to play a critical role in safeguarding enterprise environments, particularly against long-standing threats with extended dwell times.Google Cloud’s Nick Richard and Mandiant’s Kirstie Failey talk with theCUBE about the impact long-dwell cyberattacks can have on organizations.Despite technological advances, some threats manage to evade detection for prolonged periods. Cybersecurity teams face the challenge of not only detecting immediate threats, but also uncovering those that remain hidden, which can cause significant and potentially devastating damage

play_circle_outline Dual time in cyber security

play_circle_outline History of long tailed dwell time

play_circle_outline Vulnerabilities like Log4j

play_circle_outline Decoding Mandiant Intel's Advanced Practices team and the Evolution of Industry Attack Tactics

play_circle_outline Different patterns in cyber attacks

Info
Transcript

Nick Richard & Kirstie Failey | Google Cloud

Nick Richard

Mandiant Sr. Manager Google Cloud

Kirstie Failey

Mandiant Principal Threat Analyst Google Cloud

Nick and Kirstie discuss the concept of dwell time in cyber security, focusing on the period between an initial intrusion and detection. They explore historical examples like Stuxnet and APT29, emphasizing the importance of addressing longstanding issues. They look at vulnerabilities such as Log4j and the impact on dwell time.

Nick and Kirstie work on Mandiant Intel's Advanced Practices team, providing analytical context and attribution to frontline intel. They analyze data, provide indicators to consultants, and collaborate with various teams to mit... Read more

explore Keep Exploring

What was the topic of the speaker's talk at mWISE yesterday and what specific phenomenon were they discussing regarding dual time in the industry's focus on cybersecurity? add

What topics were covered in the talk and what examples were provided to illustrate the concept of long tailed dual time periods in cyber attacks? add

What should organizations consider in terms of dwell time and patching when dealing with vulnerabilities like Log4j in 2024? add

What is the role of the Mandiant Intel's Advanced Practices team and what do they do on a daily basis? add

What are some potential risks associated with drive-by downloads and info stealers in an organization? add

bolt Powered by CUBE AI

Nick Richard & Kirstie Failey | Google Cloud

search

>> Good afternoon, cyber security community, and welcome back to the Mile High City. We are here coming to the conclusion of day two of our two days of coverage here at mWISE, and wow, has it been awake. My name's Savannah Peterson, delighted to be joined by John Furrier all week. We just had Kevin Mandia on. We've got a lot of VIPs.

>> The defense is a key part of it, the threats, the data, understanding-

>> politics....

>> what's going on. This next thing, we're going to get all the data and what's happening.

>> Yes, absolutely. Without further ado, Nick and Kirstie, thank you so much for being here with us.

>> Of course.

>> It's the end of a very busy week for you, I'm sure, so we appreciate you taking the time. One of the topics that I've been bringing up on the show today and we've been discussing is dual time. You presented on this. Kirstie, can you just give us a little highlight? Can you just give me that lovely summary of what you presented on so everyone's on the same page.

>> Yeah, of course. So dual time really is the period between the initial intrusion of an environment to the point when it's detected. So my talk at mWISE yesterday was about... The industry's focus a lot on the it's getting better. Dual time, over the years, has consistently gone down, but like I spoke about in our talk earlier yesterday, there's always this weird spike between six months and five plus years where there's still this weird little uptick of a significant amount of data in our data set to cause a blip. And we really wanted to look at that, what is causing that. Because it's really great to look at the, yeah, it's getting better, but what are we doing to curtail the longstanding stuff as well?

>> So what is causing that?

>> Yeah, so-

>> Tell us.

>> That's really great. So what we covered in the talk was we talked through some history, right? Because we really have to paint the picture of why these long tailed dual time things happen. So we talked about Stuxnet and the whole life cycle of understanding what that looked like. And that was like a three-year timeframe where it was in the wild before it was actually detected and understood. Then we flashed forward to a couple of years ago with APT29 and Sunburst, and that was initially a nine-month, dual time period. But then after further discoveries and investigations, it flipped to 15 months, right? And those two are really kind of targeted and more espionage related. So then we flew it back and took a bigger picture into looking at malware distribution groups and talking through all of these opportunistic attacks also provide attackers with sometimes very long tail access into an environment because, one, they're really hard to get rid of once they get into the environment, and two, they have gotten really savvy and started to evade detections in a lot of ways. And then we kind of rounded it out with talking about vulnerabilities, specifically Log4j. That one, we're still seeing in 2024. And I think everyone across the world is still feeling the ramifications of that one, so it was really interesting. We got a lot of great questions about how do we think about dwell time in the case of vulnerabilities, and to which I answered, we have to look at, is your time to patch for your internal environment the same? And can you match, can you be faster than the time to patch for the vendor that has put out a patch? Right? Because if your time to patch is not in the same window, then perhaps you're going to fall into that long tailed dwell time period. So when you're thinking of vulnerabilities, think about it a little bit that way.

>> So talk about what you guys do on a daily basis, Nick and Kirstie, because you guys are analyzing. When you're rolling up the data, what are you looking at? So explain what you guys do. What's your role?

>> Sure.

>> And what you guys do on a daily basis?

>> We're both on the same team. We're on the Mandiant Intel's Advanced Practices team. And what we do on our team is provide analytical context and attribution to frontline Intel. So we've got our managed defense team and our consulting IR, the guys that go out and do incident response. So we're embedded real time with them for their investigations and just goes through that whole intelligence life cycle. They're doing discovery, finding some IOCs, like an IP, or domain, or maybe a hash. We take that, do some discovery. We go, "Oh, hey, this is FIN7, or this is Russian actor APT28," something like that. Give them indicators, like go take your investigation here. Maybe their staging directory is this file path. And then they go take that information, go find more badness, and then bring it back to us. We enrich and continue that life cycle, feed it out to the rest of the company. So other team, like the espionage team or the thin crime team or any of the other various teams across Mandiant and Google can leverage that information.

>> You go dig a big tunnel, get close to the data. You find out all that detective work, super valuable. We heard from Kevin earlier, response times are critical doing that. But also, we heard from John when he was on about the espionage pattern, which is get in there and hang out. Don't dwell, but don't move.

>> Right.

>> And then move carefully, versus ransomware smash and grab, exfiltrate all that data. In some cases, don't even encrypt it. So kind of two patterns. Is the espionage data look different than, say some of the other criminals or on the dwell time? Can you explain how that's all working?

>> Yeah, so it's actually pretty interesting. So the concept of the talk was really me and one of the other folks that were part of the M-Trends report last year, we were talking about how she thought that it was actually all of the ransomware stuff is at the front end of this, right? And then all of the espionage is at the end. And I was like, "Well, it kind of depends." Sometimes you do have financial actors that are in there for a really long time. So if you think about financial actors like FIN7 or FIN6, historically their whole gig was about going in and staying in the environment to capture all of this data. So they're in there for a really long time. They don't want to be seen. They don't want to be heard. They don't want to be noticed. But then obviously in the ransomware space and cyber crime, underground space with extortion and everything, they want to get paid, and they want to be as loud as possible so that it's impossible to hide from it, right? So the criminal ecosystem is really changing it up, and I think we've gotten pretty good at the espionage stuff too, so that's-

>> How do you flush them out,-

>> Flush out-...

>> the bad guys who are dwelling around in there?

>> So one of the great things about our team... I've been with Mandiant for about 10 years and we've gone through changes and reorients, but that mission of frontline intel has been very consistent in the history of the company. So we've got a huge corpus of data that we can answer all kinds of questions to quickly narrow down like, all right, this is probably maybe this three groups go there. And that's just that data that we've built up over the years, which is super powerful. And we know we've got automated processes to feed that to either the consultants or our SOC analysts to narrow down on the threat actors really quick. It's that data that we felt

>> You guys have done a great job with that. And then ultimately the security posture for the customer becomes the number one thing you guys work on. How are they reacting to this? Are they set up for it? Do you guys have to work with them on their side? How does your team engage the customer to make sure that's a nice, smooth consumption experience?

>> Yeah, so I have to hand it to our customer-facing folks, like the consultants and our managed defense consultants because the ones handling those conversations. We have our strategic team going in and talking through all of that, but our team really does feed a lot of the indicators, a lot of what those threat groups are attacking to those groups so that they understand where we should be focusing a little bit more on or what should be a higher level for risk assessments within the board, within the boardroom and stuff. And I think from us looking at the security posture side of it, we are really in a great position to say this is how attackers are constantly getting in across every type of industry vertical, regardless of what their motivation is, right? So perhaps maybe, I don't know, we should be implementing MFA at the beginning of our setup process, as opposed to it being a secondary action, right? And our team really powers those conversations that the consultants are having with the board.

>> What are some of the attacks that you're seeing by industry? And how do they differ? And two, when the patterns change... Because when they get identified, they're going to want to... It's like football. They change their offense. Now the coach knows what they're going to do, so they kind of change their plays. What are they evolving to? Because there's a lot of that going on. We're here now here to show big time, that hey, people there adapting. What's the adaption look like? And how's that change by industry?

>> Yeah, so I think by industry is a really interesting question. We always get it, but I always avoid that because it's like we're looking at it from our viewpoints, so I can't talk about it from the whole industry. I don't have full picture. But what we're seeing just generally is exploits will continue to be a very big thing, like Jen Easterly was talking about in today's keynote. But also, I think phishing has been moving up and down in the M-Trends initial intrusion vector standings over the years, and I think that that's going to continue.

>> Credential.

>> Credential theft. We have seen this uptick in drive-by downloads for info stealers. So cyber hygiene in an organization is going to be incredibly impactful for a security program in the context of understanding our risk, right? Is a user allowed to browse random sites? Right? Are they looking for things that perhaps maybe should be offered through a self-service portal, like a VPN endpoint, right? We see attackers leverage those types of things all of the time. And those are infected with some info stealer malware that they are now pulling down all of these creds, and then using them either to sell off to a public forum, which then attackers are buying access through that. And we see things like UNC3944 going in and smashing and grabbing, and all of the-

>> What's the update on the multi-factor authentication. Are people trying to bypass that? Is that an aggressive tactic? And what's the status of that? Because I do two-factor authentication all the time and I forget what my password is. And I know people have hacked that. What's the pattern on bypass?

>> We've had some pretty interesting cases over the years. A lot of times, it's either misconfigurations of MFA where users-

>> Or fatigue.

>> Yeah, or fatigue.

>> Push fatigue.

>> So the misconfiguration would be that any user could enroll a device as long as they had the process to do so, or push fatigue, like Nick was mentioning, which is essentially the attackers just spamming at two o'clock in the morning for the owner of the device, and they're just have to shut it off.

>> Or it's like, okay, and that's it.

>> Or they're doing something called SMS phishing. So they will do a fun technical thing where they will steal a SMS device essentially and take over your phone number and use your phone number to get into your account. That's a more sophisticated way to bypass it, but it is-

>> Well, a lot

>> A few of my friends have had this happen recently, and it's been pretty... It's pretty spooky, right? I think it's the beginning of what will happen a lot more in terms of trust, because now... Yeah. I'm curious what other... You see a lot of creative chaos and nefarious behavior, for lack of a better way to put it. And obviously, there's trends, patterns, and some other stuff, but I feel like... And tell me if I'm wrong, tell me your opinion on this, but I feel like not just because of ai, but just in general because there is a lot of attention on cyber security right now, there's a much bigger conversation about the geopolitics. We just saw what happened in Lebanon. Security is top of mind in a way that it's not always right now, and I'm curious to see... Do you think this is stirring more creativity within bad actors to get creative since we're getting smarter and... I mean this global median dwell time of 10 days is less. Like you said, it is getting better from that side of the lens of it. So is it folks now just doing what they've always done in a slightly different way, or are we seeing slightly more sneaky-

>> I've got some property in a very rural part of Virginia, and when I have neighbors... And they know what I do and what I work for, and they're asking me about cyber stuff. So when it gets down to your neighbors asking about that stuff, you know that it's out there. It's not just us talking about it. So yeah, these guys are continually improving and innovating to make that dollar or to get into those Fortune 100 companies. So we see it all, from the espionage stuff to destructive stuff, ransomware, a little bit of insider threat, so constantly trying something new and some new technique.

>> Give is a taste of some of the innovation you've seen on their side. If you had to look at the opposite team, so to speak, what would you see would be an interesting, like wow, actually good? You got to know the enemy. You got to be... I respect that move. We got you though.

>> Yeah. So something that recently happened, and this became public recently, was that there were some secondary factors that were popping up on people's screens, essentially walking them through how to open up a run prompt on a window system to type in specific commands to give an attacker re-access onto their machine, which I thought was pretty clever because my mom is not going to know what that means. She will, however, call me and be like, "Kirstie, something just popped up on my screen. I don't understand what's going on," which thank you mom for listening to me. But I thought that was pretty interesting, right? Because a lot of times, we have already talked about drive-by downloads. We've talked about phishing with malicious links or phishing with malicious attachments, but we haven't really ever seen a attachment in an email that directs the user to do the thing that the threat actor is already trying to do to provide them access, right? And that's a little bit harder to detect with security tools, right? So on the defender side, we have to get a little bit more creative too and understand what we're looking for and how we're looking for it. Because if someone in, let's say marketing is opening up a terminal on a window system, that's probably not their normal day-to-day action. And if there's not a service ticket assigned to that system where an IT person is going to go and run that... If there are marketing people that are running things out of a run terminal, congratulations, that's amazing. But generally speaking, that's not happening.

>> Also maybe something worth looking at, yeah.

>> So that weirdness that's happening, a good stock analyst will say, "Hey, that's weird, and let's go look at it." And that's something that AI will never replace. That's something that you can't really teach. That interest in understanding why is that happening, that's something that we'll never replace, and that's the reason I think we all have job security.

>> Hey, I'm with you on the job security front, but I do think you're right because it's context and nuance. This isn't just the same blatant, I'm going to hack your system and steal your bank password when you log into Bank of America. It's much more sophisticated than that, to your point, which I think is kind of compelling. I really appreciate the enthusiasm that you have, Kirstie. And I'm curious, because there's probably a few things... And Nick, I want to know your answer to this, but I'm just feeding off her energy for a sec. What excites you the most about the cybersecurity landscape right now?

>> Oh gosh. Me and my coworkers to joke about how we run off of spite, right? We are very, very happy when we catch infrastructure before it gets to the point where it gets to the customer or gets to someone in our visibility. And we're like, "Haha, we got you." We kind of thrive off that.

>> Like super heroes in the line of defense. Love it.

>> And when that happens, that's amazing.

>> You have a security mindset, as Kevin Mandia would say.

>> Yeah. Exactly. Exactly. And then also, when we're working with our MD folks, we're seeing things right in the beginning of them trying to get access to a system. And once we are boshing that and we're able to spin up something that we call a campaign or a global event, and we're able to get those TTPs or those IOCs out to everyone across the company in Mandiant and in Google, and we're able to find additional victims, and we can do proactive victim notifications, and to hear about those wins, that's our bread and butter because we're like, let's go. We got to.

>> Yeah.

>> Yeah. So that's what keeps me going. And then also, I have a great team.

>> Well played. Well played. Well played. What about you, Nick? What gets you most excited right now?

>> I just love how we keep stacking up wins. There was just something that happened this last weekend. You may have heard of the IT workers stuff, the DPRK. We had a low profile, or we had a tipper, an alert from our internal fusion cells for our DPRK team. They're always sharing stuff back and forth. Our team took that tipper, fended it off to managed defense and said, "Hey, go look for this." And they swept for that tip and found a report that was low threshold, low priority. We said, "Definitely look over here." They dug into that, and then unraveled the whole thing, started a rapid response, and totally triaged that and mitigated that threat, collected a bunch of cool data. And then we were able to go back to the customer and say, "Hey, this is what we found." And the customer comes back with, "Love it."

>> "Thank you."

>> We just keep racking up those wins, which is-

>> Well, that's the beautiful thing. They're hiding in plain sight. They're in their playbook. They're in motion. They're in their execution. They're going for it.

>> Right.

>> Hiding in low priorities on there.

>> Well, something that was interesting with some other Mandiant guests we had on earlier today, as I said, we see people on their worst day. But what you're talking about right there is actually preventing someone's worst day, which is a really nice and lovely feeling.

>> And it's also really nice too, because from where we're sitting, we're supporting the consultants that are having that direct communication with the people who are experiencing their worst day in their professional career probably. And when we're able to deliver like, "Hey guys, we have all of this information. Go find all of this stuff. Here's four steps ahead of what you probably have already been thinking about," and even walking into what we call an inbound, we have a customer calling in and say, "We have a problem," they come to our team and they say, "Hey-

>> They get the bat phone out.

>> Yeah. They're like,-

>> Awesome....

>> "Hey, do we have any information about any of this?" And we're able to tell them, "Here's XYZ." And sometimes it's part of a global campaign or something, and we're to say, "Hey, here's everything that's going to happen," and we can prep the customer on it, or the potential customer. And even if they don't sign up with us, they get that information off the bat.

>> We've got automation built in. Oh, we think that this might be UNC3944, hit a button, spits out a playbook. The consultants can go into that inbound and be like, "Look in your system there," and it's really a value add.

>> Even if you don't sign with us, here's everything that you have to do. And if the next people that you're talking to don't say that, come back to us. We won't be

>> Yeah. It's also private victory, like you was saying. It's like intrinsically, you guys, the way your culture is, that's like the wins are just beautiful.

>> Yeah, it is beautiful. All right. On the flip side of that, now that I'm curious, because those are two gray answers, what do you think is the most over-hyped thing in cyber security right now? Nick, I'll start with you, since Kirstie, you went first last time.

>> Sure. I think maybe the AI stuff is a bit... It's not there yet. I can definitely see how... Right now, we look to our SOC teams as our farm team a little bit. We get really good people out of there to come to our team at some point. But in five years, are those entry-level sort of SOC things, is that AI delivered? Is that all automated?

>> Oh yeah.

>> How does that affect how we get people under our team? So I think the AI is just a little bit hyped up, but I think there's some potential there. We're working to take a whole corpus of data, so for practical reasons, like a spreadsheet of 10,000 lines and say, "Hey, AI, look at this and tell me what's going on." We're almost there, but just we're still working it.

>> Okay.

>> So I think that's where I would land on it. AI's got some potential, but probably not 100% of the way there yet.

>> I think we still got our training wheels, pun intended.

>> At least on the tactical stuff that we do. Maybe on some of the reporting and tying, looking at large data models and tying things together-

>> Summarizing things, I think is a little bit different. I know exactly what you're talking about, that more on the defensive preventative side versus the observation. What about you, Kirstie?

>> So if any of my co-workers are watching, they already know, but I am so over the hype of threat actors. I will be honest, Jen and I, Jen Easterly and I probably have the same viewpoint, is like we need to stop celebrating these actors, because a lot of times they're doing outlandish things for the notoriety, right?

>> Literally for that attention.

>> Yeah. And I think that in... Just like John said, John Hultquist said in one of his keynotes, he said, "Everyone's trying to be an influencer." And that's what these attackers are doing, they're trying to be influencers. And we just have to stop giving them attention, right? Why are we making animatronic figurines of them and selling them? I don't know. But there's a lot of work that goes into understanding who these threat actors are, and getting all of the information to understand how they're doing the attacks, why they're doing the attacks, and getting that information over to law enforcement to help do some sanctions or takedowns or whatever. And that work should be celebrated. I just don't know that we should be putting the emphasis on the threat actor.

>> I love that. That's-

>> Great answer.

>> That's a great response, and that's exactly the reason journalists cover certain activities and don't around other stuff that is a bit morose, to not elevate and encourage copycat behavior, which I think is such a call out. I want to conclude this interview on a really personal note since he brought it up.

>> Oh no.

>> Would you like to say hi to your mom? You can stare into that camera and say hi to your mom since you brought your mom. Nick, is there anyone you'd like to say hi to?

>> I think my family's watching. So hi, girls. Hi, wife.

>> I love it. What are we doing here in cybersecurity if we're not securing our loved ones'-

>> Right....

>> experiences? So Nick, Kirstie, thank you-

>> Thank you....

>> for being here. Really appreciate it.

>> Thanks.

>> John, always a pleasure.

>> Always a pleasure.

>> Thank all of you for tuning in, especially my mom. Hi, mom. Love you, , and all of our CUBE team. We're here in Denver, Colorado at mWISE. My name's Savannah Peterson. You're watching theCUBE, the leading source for cybersecurity news.