mWise Conference 2024 | Charles Carmakal | Google Cloud

theCUBE.net

Clips
News
More from mWise Conference 2024

Charles Carmakal

Chief Technology Officer

Mandiant Consulting

Three insights you might have missed from mWISE 2024

Integrating artificial intelligence into enterprise systems has brought immense opportunities and challenges, making cybersecurity resiliency crucial as organizations harness AI for efficiency and innovation while addressing the rapidly evolving threat environment.This duality requires a proactive approach, blending advanced security strategies with operational resilience to ensure protection across dynamic, diverse infrastructures.John Furrier and Savannah Peterson of theCUBE Research discuss the future of cybersecurity with AI

Healthcare becomes prime target for cyberattacks as security industry defends against AI-generated cybersecurity threats

Cybersecurity threats continue to evolve, and bad actors attacking digital environments operate on the same principles as many of the organizations they target. It’s a risk-and-reward model, where the return on investment can be quite lucrative when a victim pays ransomware to get their data returned.Ransomware attacks remain an ongoing threat, with healthcare becoming a prime target, according to one leading cybersecurity executive.Charles Carmakal, CTO at Mandiant, talks with theCUBE about evolving cybersecurity threats

play_circle_outline Exploring Targeted Attacks on Healthcare Organizations: Unveiling Insights from Security Events through Storytelling

play_circle_outline Advances in AI and its use in cybersecurity

play_circle_outline Attributes of successful cybersecurity leaders

play_circle_outline Prioritizing threats and defenses in the cybersecurity stack

play_circle_outline Importance of realistic pen testing for identifying blind spots and improving security

Info
Transcript

Charles Carmakal | Google Cloud

Charles Carmakal

Chief Technology Officer Mandiant Consulting

Industry experts shared experiences and insights on cybersecurity at a recent event in Denver. Discussions focused on the increasing sophistication of cyber threats, targeting healthcare organizations and using techniques like SIM swapping. The role of law enforcement in deterring criminal activity was highlighted. Artificial intelligence benefits defenders in identifying threats. Data analysis and AI tools help identify trends and vulnerabilities. Lessons from cyber attacks like the SolarWinds breach were shared, emphasizing the need for organizations to pri... Read more

explore Keep Exploring

What is the general overview of the keynote presentation that was given at the show? add

access, how did they move, how did they exfiltrate data, how did they pivot to other systems? We learned a lot about, how do we detect that? How do we prevent that? How do we respond more quickly? How do we recover from that more quickly? And those learnings are things that we've been able to not just take care of our own organization, but we've been able to provide back to the broader community to help them be able to better defend themselves against threat actor TTPs that we learned from the SolarWinds incident. add

What are some attributes that make a successful leader in the field of cybersecurity? add

What are some important considerations for organizations when it comes to preparing and defending against potential threats, especially in terms of focusing on the most relevant and prevalent ones rather than getting too caught up in edge cases and ensuring the effectiveness of technology, processes, and competent people involved in defense strategies? add

What does a CISO want in order to identify blind spots, tighten processes, improve skills, stop attacks, and mitigate threats? add

bolt Powered by CUBE AI

Charles Carmakal | Google Cloud

search

>> Good afternoon cybersecurity community and welcome back to sunny Denver, Colorado. We are here coming to the close of day two of our Powerpact two days of coverage at MYs. My name's Savannah Peterson, joined with John Furrier. It's my first MYs. I can assume I'm a super fan now.

>> Yeah, an easy group to get along with, the way they think, the security mindset. It really is a lot of command and control frontline defense, but also a lot of deep techs involved. So this next guest is going to bring a lot of good insights, so I'm excited.

>> I know. Charles, welcome to the show.

>> Thanks a lot.

>> We really appreciate having you here. You promised us a little bit of story time, which I cannot wait to dig into, but before we get there, all of the keynotes have been incredibly inspiring and insightful this week. Very impressive, honestly, and I frankly don't say that about all the keynotes in every show we go to. Can you give us a little recap of yours?

>> Sure. Yeah. So every year I come here and I bring a number of folks that have lived through major security events, whether it's CEOs, CIOs, general councils, and essentially what I want them to do is share their stories. What do they learn about the security event? What are some of the defenses that they've been able to implement after their security events? What are some of the personal emotional things and challenges that they've had to go through as they dealt with it? And what I think a lot of people don't realize is that these events are so intense in so many different ways. There's just so many opportunities for us to learn if we are comfortable and willing to share information with each other. So I'm always so humbled and so happy that people are willing to go on stage with me, especially when they're in the midst of a major security event and a response to that major security event.

>> I was going to say, has to take a certain level of bravery and humility as well as commitment to the greater good to get out there and do

>> Everybody that's gone on stage with me is so willing to share their story. They realize that we will all get better together if we have the opportunity to share what we've learned. And look, sometimes it could be embarrassing, it could be humbling for us. There's one year where I went on stage in the context of being one of the responders to the security event at my own organization. And look, we all want to get better together. So it is a great opportunity to share what we've learned.

>> On the sophistication side, this is a big topic on this year, the evolution of the actors. How has the sophistication of the tax, because we heard ransomware is evolving, reconstituting, the groups are forming. Other groups on the infiltration side are becoming influencers. We're seeing a lot of those. And the takedowns are higher too. And you see the FBI just had a report on the botnet came out, so some of these actors are actually being acted on by law enforcement. So some good trends there, but talk about the sophistication changes as there new tools, new technologies. What are some of the methodologies?

>> Sure. I mean, look, there's a lot of things that are similar year over year, and there's obviously things that are new. And so let me focus on maybe some of the things that are new and different. So we've seen a lot of targeting of healthcare organizations over the past several months. Threat actors realize that if you target a healthcare organization, if you disrupt their ability to give care to patients, that those organizations feel pretty compelled to potentially pay an extortion demand because being able to take care of human lives is obviously is worth a certain value. And unfortunately-

>> In theory, it's priceless.

>> Of course. Yeah, exactly. It absolutely is. And the point is that threat actors realize that healthcare organizations have paid extortion demands. Unfortunately, they had no other option but to do that. And so unfortunately, they targeted a number of other healthcare organizations. So that's one of the things that we've seen over the years. We've also seen more targeting of individuals directly by way of SIM swapping. So for example, if somebody goes into a store and pretends to be me and shows fake ID saying that they're actually me, there's a decent chance that somebody at that communication telecommunication store may provide them with a new iPhone or Android device and port my telephone number over to them. And so that creates an opportunity for threat actors to get access into organization's environments by taking over somebody's telephone number and then requesting a self-service password reset from an environment and asking for a one-time password. So we've certainly seen that. You mentioned law enforcement actions. I'm always happy when I see law enforcement actions. It's an incredible thing that they're able to do. It creates a certain level of recourse and fear and consequences to threat actors. So when threat actors lose money, when they lose infrastructure, when they get arrested, when they get indicted, these are all great actions that help create more fear and consequences to threat actors. And there's always a question about how effective are these legal actions and law enforcement actions. The fact is, if there are no law enforcement actions whatsoever, crime would be through the roof. And so they're certainly stopping a lot of the illegal activity from occurring. There's always going to continue to be illegal activity, but we want to continue to seek great law enforcement actions to stop it as best as we can.

>> Yeah. One of the things that's come up on this show is that application security is where GenAI's fitting into the paradigm of traditional security. How do you see GenAI evolving in? Is it just the AppSec review, and is there any new details you can share?

>> Sure. So a lot of folks asked, what does AI mean to you? And is it better for the adversaries? Is it better for the defenders? And a lot of times we tend to focus on how it's beneficial for the adversaries. And what I'll tell you is as I think about intrusions as we respond to about 1,300 security events every year, and we look at how is GenAI being used by adversaries. For the most part, it's not really being used by adversaries to break into organizations. We see maybe some research being done, perhaps there's some use of GenAI to help create better phishing emails. But for the most part, we're not really seeing a whole lot of malicious use of generative AI to attack organizations. I'm also not at all concerned about using GenAI to create super malware that destroys the world. Realistically, that's not going to happen because we've had machine learning, we've had AI for a very long time, and any malicious software that AI creates will probably be detected by the AI and the ML that we had for a very long time from a defender's perspective. So where AI could be beneficial from an adversarial perspective, and it absolutely is beneficial from an adversarial perspective, is around creating disinformation. It's creating synthetic voices, emulating real people. It's creating deep fakes that look like they could be real and they could be authentic. And essentially what it's doing is it's making us question pretty much every video that we see on social media now, we don't know if it's real or not. And a lot of times what I see it something seems too good to be true. I don't know that it actually is true. So that's where unfortunately, I think the adversaries had the upper hand. It's with disinformation, synthetic voices, deep fakes. At some point in time, I'll tell you that there will be more adversarial use of AI available. But today, I'll tell you that AI actually benefits defenders more than it benefits the adversary. It'll flip at some point, I think as with pretty much any technology. But right now, AI is better for the defenders.

>> Has there been any advances on the data side with GEN.AI that you've seen defenders leverage? Because there's a lot of opportunities in there to maybe help configurations. What's the outlook on that piece?

>> Yeah. What's cool about GenAI and cool about these models is you could feed it a tremendous amount of data that might've had to been read and processed by a human being before. And how you could get machines to do that and process it, summarize it, help you understand what are the most salient points and data sets, help you identify trends that sometimes are a lot easier for machines to be able to do it than they are for humans. So yeah, I mean, we've been using AI for quite some time to help us find trends, patterns in terms of attacks, and help us find vulnerabilities to help resolve those vulnerabilities.

>> Well, and you're a unique person to be in that position because we've worked on some of the biggest and most high-profile cybersecurity attacks that have happened. What did we learn, say from SolarWinds and Colonial Pipeline that is helping defenders today?

>> Yeah, there are a lot of learnings with respect to SolarWinds.

>> Perhaps.

>> You guys were also part of that too.

>> So we were essentially the first organization to learn about the SolarWinds compromise because, unfortunately, our own organization was compromised. And as we investigated our incident, as we try to trace back, how did the threat actor get into the organization? We really struggled to answer that question. And the earliest evidence of attacker activity that we were able to find was weird activity that originated from a SolarWinds Orion system within our own environments, but we couldn't figure out exactly why were we seeing malicious activity that system. And so we had a whole lot of theories and hypotheses, and some of those hypotheses were was this SolarWinds system sitting out on the internet and we forgot to patch it? And if that was the case, I would've felt really, really embarrassed and really upset it. Another one of the theories or hypotheses was the system on the internal network, but perhaps there is a zero-day vulnerability in it, and another company that might've had internal network access to the FireEye network could have potentially exploited that vulnerability. That was one of the hypotheses. And the final hypothesis, which is probably the most radical and crazy hypothesis, was is it possible that the software itself was actually compromised, had malicious content in it and enabled an adversary to be able to use it to get access to organizations environments? And that ended up being true. And I remember asking the team to reverse engineer a piece of software, which was essentially a legitimate tool. And I know for sure they must must've thought, this guy's crazy. He's sending me off on a wild use chase because that was realistically the least likely of all the hypotheses that we were trying to test, but we had no other leads to go off of. So we had to test it. And it ended up proving to be what was the root cause for us. So we learned a lot. There were questions around supply chain security, how do we trust and verify the software that we use? How do we better compartmentalize our environment? There's just a tremendous amount of awareness to that.

>> Who was here at this event that shared their stories on stage and in sessions that you could talk about?

>> So there were three people that were on the stage with me. One person was Christopher Hoff, who's a Chief Secure Technology Officer at Last Fest. There's Steven Martin, who's the chief Information Security Officer of United Health Group, and there's Kimberly Peretti who's the partner at Alston & Bird that helps a variety of organizations respond to prepare for security events. And what I really appreciated about the three panelists is that they were willing to share their stories, they share their learnings, and it's so beneficial for the audience to hear what they've learned and what they went through because it helps them prepare and perhaps maybe avoid some of the mistakes that maybe I've made in the past. That's the reason why we should-

>> Nice to see Q alumni on that list, Chris Hoff.

>> I know why you're from the table.

>> Yeah, right. He's good. This is instructive, and one of the things that Savannah always talks about is community. So having the sharing, of course, good swag from all the booths behind us, the whole segment on that. Talk about the culture because on the main keynote yesterday with Kevin, he talked about the security mindset, number one, and keep elevating cybersecurity in organizations, but just how the culture's changing from the barrage of governance requests and all the paperwork and bureaucracy that's needed and all that heavy lifting and playbooks and processes, which is needed with the craft of security. This is a situational thing, but it's also discipline. Share the cultural mindsets.

>> So most of the people that come to this event are very security aware. Many of them have dealt with security incidents at their own organizations or other organizations that they work with. So I think there's more empathy for victim organizations today than there has been in the past. Years ago, 10 years ago, I think there was a stigma associated with a cyber security event, and there was... A lot of victims felt like they were penalized not only by the threat actor that compromised their environment, but by media, by external stakeholders, by customers, because there's a certain sense of aggression against victim organizations, and they felt like they were victimized many, many, many times. I think fast-forward to today, I think there's a little bit more understanding. There's a little bit more awareness for security events, maybe not all security events, but just in general there's a little bit more understanding for what happens. And I think one of the things that's important to know is that a lot of the people that are here at the event, they're the folks that are actively trying to defend their organizations. And it is sometimes a very tiring job, constantly trying to defend your organization from a barrage of attacks, from a variety of different countries and a variety of different threat actors. And so I think the community here is one that wants to share and wants to learn from each other.

>> I think you just brought up a really good point that no one else has said on the stage today though, is this increased empathy. I think, well, it's understandable there's a knee-jerk response when personal private data is compromised. Totally understand. But to your point, the conversation can get very weaponized if it makes it look like these top companies are failing to secure or even not thoughtful. And the reality is, to your point, that the landscape's changing all the time. So I think that was just a really good point. Which brings me to a question I'm very curious about. Oh, phrasing. This is kind of funny. I don't want to make this sound weird. In terms of cybersecurity leadership right now, what would you say is the DNA of the best cybersecurity leaders that you're interacting with right now?

>> Yeah, I mean, there's so many attributes that make a successful leader. Number one, you got to have a little bit of technical skill. It's really helpful to have maybe kind of grown up in a little bit of a technical path just so you could understand what your team is up against and what they're dealing with. Number two, you got to show a lot of empathy to your team. You got to advocate for your team. Your team has to follow you. They have to be loyal to you, and that's such an important aspect. Number three, you can't get bogged down in the technical details. You got to be able to articulate highly complex technical matters and topics to a group of people that don't quite understand cybersecurity. And that's okay because they're not expected to understand cybersecurity. You as a cybersecurity leader are expected to translate cybersecurity into a language that the average everyday person or average everyday business leader is able to understand. Number four, you've got to understand to some extent all the disciplines of cybersecurity, at least at a high level. But you have to have a team of deputies that have the deeper subject matter expertise, and those deputies have to have a team of very competent technical or strategic individuals that could help with executing against a vision and helping to defend organization. So there's obviously a number of criteria that's required.

>> Is there a playbook around that? Because that came up with the former Gartner analyst was on with us. He said, you can get a new tech stack, but if you don't get the processes right, then it's a mismatch. Do they think they're happy, IT guys. Oh yeah, I got the new shiny new toy. The refresh, the foundation, whether it's a refactoring or a complete reset, you see a lot of that now in the GenAI movement. Data centers are coming back as big GPU clusters, computer clusters to service. I mean, this is supercomputing that's been democratized. Okay, that's an opportunity. And then you got the threat actors is going at the physical layers. You got supply chain up and down the stack all the way to the application. So is there a mindset where in the stack to prioritize, to counter these sophisticated attacks?

>> Look, there's an infinite amount of threats that you could try to prepare for and you could go crazy try to prepare for everything. So you have to understand, as an organization, what are the most relevant and prevalent threats to an organization like yours, to your sector, and how do you defend against the most likely types of against your organization? And so focus on the common things. Try not to get too obsessed with the edge cases because a lot of times you tend to focus on the edge cases because sexy, it's cool.

>> I'm going to say shiny.

>> And you really got to focus. To your question about technology, look, a lot of companies post-breach end up buying a lot of technology, and they don't quite understand how effective is the technology, how much is it actually helping them? So there's always an aspect of ensuring that you have good processes associated with the technology, that you have competent people that are willing to learn the technology, that are willing to follow their processes associated with the technologies and kind of work all together so that you continue to prove that you're actually helping to better defend your organization. And one of the best ways to actually measure the efficacy of all the spend that you put on technology people and processes is by conducting our right team exercise. So ask the good actors, whether it's internally employed individuals or a third party security consultancy organization, ask them to try to break into the network and allow them to do whatever they need to do that would enable them to get access to the organization. And don't give them all these rules to make the testing unrealistic so that you get positive results and positive results to some CISOs are having a very capable pen testing organization or right team organization, not be able to break in. If I were a CISO, I wouldn't want that result. I want a very rare world adversarial attack against my organization so I could identify the blind spots, so I could figure out what processes need to be tightened. So I could figure out how I need to improve certain skills or playbooks on the security operations team. I want to understand if I were defending an organization, can I identify an attack? Can I stop an attack? Can I mitigate and eradicate a threat actor from an environment before they have the ability to do something that's really meaningful and impactful? I don't want to deal with a business disruption. I'm not going to be able to stop everybody from clicking on a malicious link or an attachment, but can I create layers of defenses to stop an adversary from compromising one computer to compromising the entire environment?

>> Like Swiss cheese, if somebody sneaks through one little part of the Swiss cheese hole, you're not going to actually make it all the way to the bottom.

>> You got to have a lot of different layers of controls in order-

>> Then as Kevin said, pull the red lever. And that's how do I recover? So the resilience is a big topic here.

>> Topic, yeah.

>> How do you define resilience technically? How does that come full circle to the IT department who's got the new stack that they just, hey, a new fresh new stack, but the processes are there? How do you get that going?

>> So I work with a lot of organizations that unfortunately have to pay extortion demands. They feel like they've got no better option. Maybe it's because they have to recover their business operations. Maybe they're concerned about materially sensitive data being published on the internet. There's a variety of reasons why they might do that. But what I find now is that the people that pay extortion demands, it's not because they don't have backups. Nowadays, most enterprises have backups and they're doing some level of testing, but there's a number of gotchas. One of the gotchas is the backup environment available to the threat actor so that they can log in and then destroy the backups? That happens quite often. How often are you actually testing the full restoration of systems? So a lot of times we're not saying proper enough full restoration testing. A lot of times most companies have architected backup environments to deal with natural disasters or data center outages or maybe a single server outage. And so if a data center goes offline, do they switch over to another data center because maybe there's a hurricane that's coming. But what they sometimes struggle to realize is that when a threat actor breaks into an organization, they're disrupting everything. All data centers, all systems, backup systems, primary systems, whatnot. And so you run into a scalability challenge. So you still have backups, but you can only restore so many systems in any given day. And so the recovery process may take several weeks or months, and sometimes it takes many months to recover certain systems just simply because it takes time to get to the last system that you need to restore. And most people never actually fully restore 100% of their environment. They get to 80%, they say the last 20%'s gone.

>> Yeah. And I mean, that's just collateral damage sometimes, at least in these circumstances. So that's all right. Okay. Last question for you because the last 20 minutes have flown by. What excites you the most about the cybersecurity landscape right now? We've been in this for a couple of decades.

>> Yeah. What excites me the most is working with really smart people that are so mission-oriented, that want to learn and will spend dozens of hours or hundreds of hours researching something that's really novel and clever. And in my role, I have the ability to ask a lot of people, can you summarize what you've studied over 200 hours? And can you give me a fifteen-minute update just so it satisfies my curiosity? I'm never going to know it to the depth that they know it, but it's enough for me to just feel like I've learned something. And what I love about where I work is I literally learn something every single day. Whether it's from one of our associates that we hired straight from university to somebody that's been doing this for 25 years. I learn something every day from everybody that's around me.

>> If that wasn't an advertisement to get into the cyber security industry, I don't know what is. Charles, thank you so much taking the time to be here with us today. . John, always a joy. We've only got two left.

>> Yes, I know. Well, I wish we had more.

>> I know. And thank all of you for tuning in to our two full days of coverage here at MYs in Denver, Colorado. My name's Savannah Peterson. You're watching theCUBE, the leading source for cyber security news.