mWise Conference 2024 | Allison Wikoff | PwC

theCUBE.net

Clips
News
More from mWise Conference 2024

Allison Wikoff

Director, Global Threat Intelligence - Americas Lead

PwC

Mandiant Threat Intelligence tackles rising ransomware threats

Mandiant Threat Intelligence is playing a crucial role in addressing the rising ransomware threats and evolving cybercrime tactics that are reshaping the global cybersecurity landscape.Over the past 18 months, attackers have become more sophisticated, targeting vulnerabilities that were once the domain of state-sponsored actors, while expanding their methods and tools in ways that are fundamentally altering how businesses defend themselves

play_circle_outline Shift in threat landscape due to use of vulnerabilities by threat actors

play_circle_outline Evolution of ransomware tactics, rise of ransomware as a service model

play_circle_outline Focus on threat actor behavior and technology vulnerabilities in defense strategies

play_circle_outline Fusion of traditional threat intelligence with fraud and physical security aspects

play_circle_outline Meeting the Challenges: Defending Against New Threats in the Ever-Changing Cybersecurity Landscape

Info
Transcript

Allison Wikoff | PwC

Allison Wikoff

Director, Global Threat Intelligence - Americas Lead PwC

Allison, an expert in threat intelligence, discusses the changing landscape of cybersecurity in the past 18 months, emphasizing the use of vulnerabilities by threat actors. She also touches on the increase in ransomware attacks, the shift towards ransomware as a service, and the emergence of AI in cyber threats. She highlights the importance of understanding threat actor behavior and the need for collaboration between different teams in cybersecurity. Allison closes by addressing the need for clearer and simpler communication in the cybersecurity field.

explore Keep Exploring

What has been the trend in the use of vulnerabilities by threat actors over the past 18 months, and how has this impacted the conversation among threat intelligence analysts and network defenders? add

What has changed in the market for ransomware over the last two years? add

to change the threat actor's decision calculus." add

What are some examples of convergence between traditional threat intelligence, fraud, and physical security, as well as discussions about risk acceptance and resilience at the board level? add

What are some reasons that make the field of cybersecurity so dynamic and challenging? add

bolt Powered by CUBE AI

Allison Wikoff | PwC

search

>> .

>> Good evening community, and welcome back to mWISE here in Denver, Colorado. We are at the conclusion of day one of our two days of thrilling coverage here on theCUBE. My name is Savannah Peterson, joined by my fantastic and insightful co-host, John Furrier.

>> What a great day, Savannah. Great interviews packed with payload of content.

>> A payload?

>> Payload.

>> We can launch rockets.

>> .

>> We can launch rockets with these . I know. I know.

>> strike of content.

>> And please explain it to me. Most importantly, we have a thrilling guest for you all to close out our day and one of the better dressed guests today. Allison, thank you so much for taking the time.

>> Thanks for having me.

>> It's going to be such an exciting week for you.

>> I never get sick of talking about the work that we do in this space. Threat intelligence is an ever-changing field, and there's always something wild going on. So yes, I have plenty of time to talk about this. I don't know if we're going to be able to get through everything in 20 minutes, to be honest.

>> Well, we're going to do our best just because you mentioned it and I think it's fun to open up. You mentioned how there's always something new going on. This landscape is always learning. What has been the biggest change for you in the last year?

>> Well, I'll even back it up. So I've been in this space over 20 years, and teams like mine, this global threat intelligence function, Mandia and all of us write these annual reports or take a retrospective look at the landscape, and it gets kind of challenging from time to time because there hasn't been a lot of fundamental changes in the space. However, the last 18 months have been really interesting. It's the first time that we took a pause and were like, "Oh, actually things are shifting." And one of the biggest things that we've seen over the last 18 months is the use of vulnerabilities by threat actors. And there's this whole concept of zero-day vulnerabilities, which sounds super scary. It's not, but traditionally this is thought of as something that the espionage or the state-sponsored actors are solely using. But what we've seen in the last 18 months is that the criminally focused adversaries are getting on this bandwagon as well. And so it's created a much different conversation from threat intelligence analysts all the way to network defenders. I'm like, "Well, what are we doing now that the space is shifting around?"

>> I mean, I can imagine. It feels like the last 18 months have kind of turned the cauldron over everything in terms of our exciting what's possible.

>> Everything, everything. The trend of vulnerabilities being used is a new one, but there's some things that have maintained through the landscape or maybe got a little bit more complex. So we look at all the geopolitical conflict that's going on in the world right now. It's an election year, not just in the US, but globally. There's all these elections and this kind of activity does influence what we're seeing in the threat landscape, network defense, and it's getting more complex day by day.

>> I'm curious, just to sit there for a second, and it is so relevant, especially being so close to the election. I could assume, but I'm not going to do that because we've got an expert sitting here. Is there a big increase in attacks or vulnerability for folks around these cycles when they happen, or more interest I guess, from bad actors in meddling with them?

>> I'm going to give you the classic threat intelligence answer, which is, it depends. Depends on what kind of election we're dealing with, what's happening in terms of geopolitics of adversarial places. But generally with any current event, whether it be elections or whatever's flashing by the news, threat actors are always going to jump on that for social engineering reasons. But something compelling that's flashing the pan news-wise, it always makes for a great phishing campaign. So elections on top of that, it could be a free-for-all honestly.

>> Well, and I think we certainly see it in the political landscape more than most things. We all know it's happened over the last couple... I mean, the last 10 years in election cycles, how much manipulation has happened. Let's shift it to ransomware. Let's talk about that landscape, baby

>> Ransomware, right?

>> Yeah.

>> That's another thing that's changed so much since its introduction into the space. And we look at ransomware over the last... Let's go back two years. Look at ransomware over the last two years, it's been rampant. They've never made more money in this space, which has really changed the whole market for ransomware. So several years ago, you had to have a lot of technical capabilities and a lot of infrastructure available to run a ransomware scheme. Now it's all moved to this as a service model. So there's ransomware as a service. And as an affiliate, once you get vetted by some of these groups, you can rent out a ransomware operation soup to nuts and not have-

>> That is wild to think about....

>> to have any kind of technical expertise. So it's crazy. And again, it's such a profitable scheme that we're seeing other as-a-service schemes pop up. So access as a service, phishing as a service, credentials as a service, it's just unbelievable. This is what we were talking about with the economies of nefarious stuff.

>> When she said affiliate, I'm like, "Oh, they have an affiliate program?"

>> They do. They do. They have affiliate-

>> This is the go-to-market-

>> It is. It's exactly what we were talking about earlier.

>> The whole concept of hackers in a hoodie is very inaccurate when we're talking about criminal operators. It's just not the narrative that we should be having anymore. And we don't really as an industry, but these are very well-organized groups that are running these operations. And I think the last six months to year, 2024, there's been a lot of law enforcement focus on ransomware operations, which is always a good thing. Some people argue like, "Well, they're just come right back." Sure. Again, there's a lot of money to be made, but to give them a bad day after all the challenges that we have as network defenders against it.

>> What's been some of the changing tactics on the adversary side at ransomware? Because the old school... Well, old school... The old model , encrypt the data hijack it, you're stuck, hospital who receive healthcare. Are there other tactics that you're seeing besides encrypt the data and hold it hostage?

>> Well, several years ago it became more extortionate. So they would take data from the networks to really push the issue of paying the ransom. And what we're seeing is a lot of threat actors are now not even moving to encrypt the data within the organization. Just to say, "Hey, I've got it. I'm going to release it publicly." Because there's so much regulation now around all the different types of data that organizations hold that it really... In addition to being potential reputational risk, you've got financial risk and other types of risk that can occur if your data gets leaked publicly.

>> Yeah.

>> Oh, I mean, it can be the end of the business and really damage a lot of lives quite literally. It's a lot. We've got some interesting PWC data here that really backs up what you're saying in terms of how things are ramping up and getting pretty wild. 3,735 ransomware leak site victims in 2023. Highest since 2019.

>> We have seen more ransomware victims year over year, and even with the law enforcement activity that we've had this year. So we did actually have a little bit of a dip in terms of the victims that we saw last month, but in... Sorry, not last month. July. So we think that was actually a rebuilding time for a lot of these ransomware operations. So there was some law enforcement activity earlier in the year that took down a ton of infrastructure. It was a really aggressive and awesome move by law enforcement to stop these guys in their tracks, even if it was just for a little bit. But what we saw in August who, that the numbers are back to where they were and even more so than they were in August of 2023.

>> Alison, what are your analysts look for? You guys have a big practice. What do you guys look for the new signals and how are customers reacting? Because they have to be more aware of their environment. Just because they have an active directory doesn't make them for recovery because that can be hacked too. That could be encrypted.

>> Everything can be hacked. I think the big thing that I've seen in terms of how customers are defending against things is 5, 10 years ago, there was a lot of focus on indicators. So these tactical things that we could block and tackle. And our clients are now focusing more on threat actor behavior. So the TTPs behind how do they do it? Do they go after active directory? Do they go after cloud resources? Are they phishing? Are they focusing on vulnerabilities? What types of technology in terms of vulnerabilities are they going after? And that sort of informs not just how organizations defend against it, but how they plan for transformation of their environments in the future.

>> I love Kevin Mandia's comment at the keynote, "I want to know all lateral movements." He wants to like... He's such a hawk and he's right. Anything that's moving, you got to watch everything. How acute is that in terms of the focus? Because you really can't miss anything because it can get through.

>> You can't watch everything, and there's edge cases to everything. But the way that we approach helping organizations decide how they do things is by prioritizing the threat for their specific environment. So there's a lot of fancy words around it, PIRs. But basically it's just like, what are your objectives as an organization? If you look at your organization, what do you do? Where do you operate? What is your widget that you don't want to be compromised or unavailable? And what are the threat actors that would be interested in those sorts of things? And you take it a step further and how do those threat actors operate? Because at the end of the day, the type of work that we are doing, it's a people problem. It is. Technology was created to share. Security is people being dishonest and taking advantage of that. And so it's all very behavioral. And if you can look at it from that view, people typically don't change unless they have to. And the same goes for adversaries. So in the ransomware space, we've seen a shift, I think potentially because as a community have gotten so much better at training our users on phishing. That's something we have been browbeating the community with for years. And the use of all these vulnerabilities in the last 18 months could be a good indication that that is working. Now we've got to focus on patching or understanding our network a little bit better to defend.

>> ransomware is a great extortion tactic, whether it's encrypted or infiltrated out with the data. But there's also other mechanisms where you give people wire money with deep fakes. There's other fringe tactics adjacent to the ransomware playbook. What are some of those things that you see besides those obvious ones that in the news all the time?

>> Well, I'm actually glad you brought up AI because we get a lot of questions... Or deep fakes. So we get a lot of questions about AI and GenAI and how is that transforming the landscape. And I would say so far, it's been an evolution of tactics. Not a revolution. So the way that threat actors are using AI and GenAI is very similar to how we are using it to optimize our business. And one of the examples I like to use is one that we're all very familiar with. Phishing emails when they're coming from non-native English speakers might have a lot of grammatical errors in them. Well, with GenAI or AI, all this free stuff that's available, that's a thing of the past. So we expect to see and probably have seen, it's hard to prove at this point, phishing email's getting better. But we've even seen threat actors using AI-generated humans or images in social engineering campaigns. But I don't think we're going to see a massive shift in any of that until the threat actors are pushed in that direction. Because again, people are not going to want to change their tactics unless they have to. If it's been working, why change it?

>> Yeah, it's interesting-

>> The product's getting more lucrative in the case of ransomware.

>> Yeah, it's getting more lucrative. Networks are more complex. It's just-

>> Like you said, the bad actors can be more productive with AI because AI's benefit is productivity. How does that flip around to your analysts and your teams? How are you guys looking at using some of these tools to either think away some of the toils, Google's word. Or how to differentiate heavy lifting. Another cloud's term. And then make them more productive? Are you seeing any bumps in productivity?

>> From our end or from a threat actor end?

>> From your side. We know they're getting productive.

>> Yeah. Yeah. I mean, we're using AI the same way everybody else is. How can we automate lower-level tasks to push out better products to people, whether it be in how we disseminate our information to our clients or how we pull large pieces of information together and make something of it.

>> How was your engagement changed with your customers? Because Kevin Mandia was on stage. Everyone has to accept risk. And that was kind of an open question because what does that even mean? Resilience is a term that's kind of evasive. Well, cyber resilience on restore or resilience on stress... So resilience has become kind of a word. So risk, ownership, accountability. It's not a person. How do you talk about that? Because it's a very nuanced, but complex conversation.

>> It is nuanced and it's a bit like we're seeing a lot of convergence of things that used to be very disparate subjects or practices. So right now, some of the work that my team is doing, which is a traditional threat intelligence team, we're moving into the fraud space because some fraud is being co-opted on the dark web. And then there's physical security aspects of things. So there's a lot of fusion going on on the defensive end, but also we're seeing in terms of risk acceptance and resilience, these conversations are being had at the board level now. And they are prompting to have tabletop exercises so they can understand the risk. And if you had told me that five or six years ago, we'd finally be having these conversations, I'd be doing cartwheels right here on this table. I'm thrilled that we're at that level finally. And it's amazing we're having the resilience and the risk conversations at the high level of the organization. They want to understand, what are our threats, how are we addressing those, so that we don't have... Nobody wants to show up in the news. That is a board and CISO's worst nightmare.

>> Oh gosh, no, a hundred percent. And I'm curious, I mean, how exciting for you on one hand to have the ears of the decision makers and the purses to be able to make the right decisions to make us all more secure, which helps us as a community, but also I can imagine a lot of that interest and thirst comes from how rapidly things are moving around right now, and the increase in data. I can imagine you have a lot of a challenge both to keep your team educated internally as far as what the threats are, and then translate that education out into your customers and into your community. What's that process like for y'all internally? I can imagine you're moving pretty quick.

>> It's tough. So intelligence providers, like my team, we want to be everything to everyone. And so we do have very specific areas of expertise where we have a crime desk, we have people that focus on APAC-centric threats, on EMEA-centric threats and everything in between. And really the ideas for organizations, again, to understand what does my threat profile look like and how do I manage upwards because I've been on the other side of this conversation defending networks. And it is an absolute nightmare to have news flash before your executive's eyes and be asked questions on threats that aren't really applicable to your organization.

>> Right. So you're constantly on your toes.

>> Basically, on your toes, and it's a managing upwards thing. Even though the boards are in the executive suite is very well-versed compared to where we were many years ago, there's still an education factor that comes into play.

>> Yes. Yeah, go ahead.

>> I was going to ask you about the team. You mentioned the people side of it because the people in the loop is huge with AI coming. We see that clearly. Everyone talks about that. But getting teams together because there used to be data scientists and security, threat hunters, and now you've got platform engineering, data engineering because now more data is available. So you have the nexus of teams coming together. Are there gaps between the security team and the hunters and the data teams, we'll call it data teams, meaning data engineering and say, data science?

>> There used to be the gap is really closing, which is awesome. Again, because these are things that used to be very siloed and very pillared, and there's so much of a blend now in terms of the threat, in terms of network defense that everyone really does have to work together. And bringing people in from different backgrounds, it makes for a more well-rounded approach to the problem. And I like to use this example. On my team, we have a lot of people who are coming from computer science backgrounds, but we also have people with liberal arts degrees and they're coming at the threat and the research from a much different angle than our computer science background folks are. And with that, we have a really wide swath of products that we can offer our clients in terms of what the landscape looks like.

>> I can imagine that's got to feel really good and being able to do that. What excites you most about the cybersecurity landscape right now?

>> There's so much going on. For me, one of the reasons why this field is so great, and I know my team feels the same way is it's ever-changing. So there's always a new threat actor, there's a new tactic, there's a new piece of technology that just completely breaks what we've been doing. And it's a huge challenge to defend against that sort of thing, and also very exciting. It's a constant space of learning. It's not for people who aren't really passionate or who want to do a nine to five. It's not a boring job.

>> It's not for the faint of heart. Sure.

>> Definitely not for the faint of heart. I was having a conversation with somebody earlier in the booth and they're like, "How do you sleep at night?" I was like, "Well, I think I'm a little desensitized." But yeah, you look at some of the things that are happening and I can take a step back from my day to day and go, "Wow, this is kind of crazy what we're seeing."

>> Yeah. Well, at least we have people like you fighting the good fight in there.

>> We're trying.

>> I love it. All right. One question I've been asking our guests. We got some interesting responses today that I would love to pose to you. What do you think is most over-hyped in the security landscape right now?

>> I think just the lexicon that we use. It sounds so fancy and scary and sometimes it's way too academic. And I think it's hard for the network defender to consume some of this if it's just overdone. So I could talk really eloquently, a lot more eloquently than I have this evening on what we're seeing on the threat landscape. But I don't find it very consumable in that way. And if we come up with one more acronym... I mean, we all love them, but we have some acronyms in this space that mean 10 different things. It's confusing. Let's just use layman's terms and try to get the job done.

>> I really love that call out actually because I mean, we talk about the complexity of communicating about the threats and all of this stuff, and then we make the lexicon even more complex.

>> I have this conversation all the time. If we can't make the work that we're doing consumable, then nobody's going to be able to defend their network. So this isn't an academic exercise or a how smart we are exercise. It's really like how can we explain this stuff in a way that we can rapidly solve the problem, defend against the threat, block and tackle sort of thing.

>> Oh, yeah. I love that. And well said, Allison. What a great insight to close us out with.

>> Thank you.

>> You have certainly been eloquent for the record, and have you have made this interview extremely digestible. It's actually gone by faster than I expected.

>> .

>> I know, I know. I know. We're already, we're already-

>> Are we at time already?

>> We're already over.

>> Amazing.

>> You're so insightful. We've actually gone over, but we'll always make extra time for you, Allison.

>> Thank you.

>> Thank you so much.

>> Well, I appreciate the time and being able to talk about the work that we're doing.

>> I suspect we'll be able to talk to you more about it-

>> I hope so....

>> in the future. So, wow, this is great. John. What a fantastic day we had.

>> Awesome day.

>> 10 out of 10 day. Quick shout out to the production team over here who has managed the climate, the cameras, and everything else that we have needed. And thank all of you, our fabulous cyber security community for tuning into our two days of coverage here in Denver, Colorado. We're at mWISE. My name's Savannah Peterson. You're watching theCUBE, the leading source for cybersecurity news.