alrighty
then let's get this thing started if
people uh make it they'll they'll make
it throughout the
session hello everyone how's uh how's
def cam been treating you so far any
good sessions
okay uh well hopefully uh I won't
disappoint and uh you'll uh you'll find
some interesting new things uh from from
this session as
well uh once again as I was mentioning
in the morning uh
without all of these guys over there we
wouldn't be here
today uh let's see what we're going to
be talking about for those of you who
don't know me my name is Tudor
Damian I'm doing stuff around security
surprise surprise at this conference um
I act as sort of a virtual ceso um so we
help companies better Define their
security strategy figure out whether
they have any like gaps in their
security posture do GRC things of that
nature so anything that a ciso would do
but externalized so that's my my
day-to-day uh thing um starting this
year I've uh I've taken the reign of
bringing def cam to clug and hopefully
uh this is something that's going to
continue for for a number of years
moving
forward um and you can find all my
contact details over on 2.o if you want
to get in touch with me via any means
I'm assuming you've seen a lot of these
videos already maybe you've even seen
this one uh but it's still to the point
of
some of the sessions that came before
even during the keynote and some of the
sessions that we're going to have uh
tomorrow this one's
very um targeted or niched at what we're
doing here dear Romanians I've heard
that in your country when someone runs
out of money they exchange
00 but why don't they exchange $100 my
fellow Americans did you know that
everyone born in Romania is
automatically granted a PhD in life
are experts in everything and there's
nothing they can't do want to build a
rocket ship no problem the average
Romanian can do it with their eyes
closed need brain surgery just ask the
nearest Romanian and they'll have sorted
out in no time Romanians are never wrong
even when they appear to be wrong
they're actually right they can fix
anything with duct tape and chilling gum
and they can deade any topic with the
confidence of a seasoned politician they
are masters of every CRA from carpentry
to quantum physics finally I would like
to thank Maria IU from such for warning
me about Bill Gates's plans with
vaccines and
microchips I will take actions God bless
Romania all right so once again it's
it's almost incredible the level to
which these things are brought and the
lip sync is just due to the long wires
here it's actually way better if you
look at at the video uh online or
directly on the laptop so they did a
better job doing the lip sync and
everything and generating the voice this
is something that's been around for a
while now uh so it's it's no news I'm
assuming to anyone but there is a
problem that's growing and this is part
of part of all of that and that's also
something that we're going to be
covering during today's talk so
I don't have any uh any demos or
anything it's mainly designed to be sort
of an awareness uh session and I will be
talking about things that you may
already know hopefully not all of them
right I'm just trying to put things in
context I'm just trying to take you a
bit through what's been going on what's
been trending in the world of cyber
security and how attacks are evolving
and some of the solutions for that and
some of the maybe examples of of um
attacks that have happened in in recent
years um and then we'll also be touching
base on how to prevent to respond to to
those attacks as well so let's look at
some numbers and I've I've been trying
to kind of find interesting data and
statistics the problem is I found
numerous studies that had numbers
contradicting themselves
like some study was saying that
ransomware is on the rise another study
saying that ransomware is going down so
where's the truth and the truth is it
depends on how you look at the
data and I think one of the best sources
for showing that fact uh was actually
the the study done by The gazet Hive
systems I don't know if you've heard
about them they're the guys with the
with the password table I'll be touching
on that uh in a bit
but they they did a a study looking at
cyber security incidents and data breach
and their
perception in terms of how they're
reported in the industry what's being
published in scientific journals what's
being covered in the news what are
people searching for on the web right
and it's all
different so the the the the biggest
problem or the biggest trend really
varies based on who we look at who's
writing about it who's looking at it
who's searching for it right the thing
is all of these um types of incidents
are happening and it really depends on
who they impact if your company's been
hit by ransomware ransomware is the
worst thing ever nowadays right if if
however you're seeing a lot of denial of
service
right because if you look at what's
being published in Academia the the
green part is denial of service or what
the industry
reports the moment Twitter or Instagram
or Facebook is down everybody notices
right so it's some form of denal of
service it doesn't mean they've been
breached or compromised but it's
something that a lot more people notice
right as opposed to some ransomware
attack that hasn't even been made public
by the Target company by the victim so
you won't even know that company x that
you deal with had a ransomware you just
know that for a couple of days nobody on
their emails was responding and their
website wasn't working they had just a
maintenance website page put up and
that's it right so it really depends on
where you look at the data in terms of
what the data actually shows you um
personally I've I've been a fan of
Verizon's work over the years um even
though even like the the very latest uh
report has some weird takes on the data
so they present the data but then the
conclusions I don't really agree with
but they do look at a lot of data
breaches so they've been doing this for
a while uh they analyze a whole bunch of
data breaches from all over the world
they do data analysis and statistics on
them and give you some insights and they
publish this every every year so some of
their
findings um we're going to be going
through them uh really quick now um
vulnerabilities so the exploitation of
vulnerabilities as the initial AIS step
so the the way the bad guys get in
first That Grew by
180% almost triple from the year before
right so it's easier and easier for the
bad guys to just take any known
vulnerability and use
it because there's more and more tools
that do that for you
automatically um the the patching side
of things that was mentioned in the
morning is not really happening uh and
I'm even talking about like solar winds
who here hasn't heard of solar winds and
the solar winds High okay so no hands
that was in 2020
the solar winds vulnerability was still
out there in 2023 and there's still
reported cases from last
year with solar winds uh versions of
software that were known to be
compromised still out there in the wild
because nobody bothers to patch uh move
it who he heard of move
it uh so that was last year and it's
also kind of a supply chain attack and
even though the impact wasn't as big as
say log for J or anything of the sort
that gave you like direct terminal
console access is what do you do there
you have to do something else from there
even though that's even worse while move
it that was a software that allowed you
to move data and files around from the
get-go so when a vulnerability presents
itself within that software the very
functionality of the software gives you
the the ability to do the bad thing in
the first place you don't have to take
an extra step right to copy data to
exfill data from from your victim right
um
Defenders have a huge task at hand the
the data from from Verizon's last report
shows that it takes around 55 days so
close to two months for companies to fix
half of the
vulnerabilities after patches are made
available so a patch is made available
today two months from now company you
still have 50% of those things
unpatched which is bad because that's a
dangerous lag that's you just need one
day or less once a a a patch was
published until some form of attack is
out there in the
wild uh training that's what Jason spoke
about in the morning
68% of of uh breaches involved some form
of
malicious human element so it's somebody
that either does a mistake or Falls
victim to a social engineering attack so
it's the people using the systems that
are the Gateway into the systems and to
the data itself and 68% of cases show
that the human element is a factor so
that awareness that that uh not knowled
that you have to help your people get is
what's lacking here uh fishing another
interesting statistics that they show
the median time from when someone gets
an email scans it because they don't
spend a minute looking at the email and
checking if it's legit and everything
scanning it clicking on a link and then
doing something on that link is under a
minute so it usually takes less than a
minute for a fishing email to to succeed
nowadays which again not so great uh
stolen credentials remain massively
popular and I'll touch on that in a bit
but almost a third of the the breaches
over the past 10 years have used stolen
credentials so logins from somewhere
else and the fact that more often than
not people reuse passwords
if that password over there was somehow
compromised it's years later that they
find it's still being used on another
system somewhere else because they just
try uh to to use the stolen credentials
in
attacking uh 15% of breaches involve the
third party this is where the supply
chain uh part of things uh comes into
play and uh when it comes to the average
cost of uh attack um they they figured
it usually uh stabilize around 40
something
thousand uh with anything that's
financially motivated and that includes
ransomware or extortion and we're going
to be talking a bit about how ransomware
has started to shift to extortion it's
like I've encrypted your
data and now you need to pay me if you
want your data back otherwise I'll make
it
public so it's not just pay me to get
your data back and that's it like you
can have your backups and you can refuse
to pay me but then I'll make it
public uh and uh for businesses that's
around 50,000 for 2022 and 2023 uh those
are numbers from uh the FBI's internet
crime complaint
center so it's where companies go to
complain that hey we've been targeted by
ransomware and we had to pay this or
that amount uh some other reports out
there and they're listed at the bottom
uh the average cost of a data breach so
that's companies that go through data
breach and how much it takes them to to
recover from that and that involves um
uh not just the cost of the data breach
itself or the data itself but also
reputation and things of that sort uh is
somewhere north of $4
million uh breaches caused by stolen or
compromised credentials
take the longest to be discovered around
11
months because you don't assume that you
you've been breached because one of one
and it just takes one of your users to
reuse one of his
passwords it takes a long time to
discover this because more often than
not the attackers are using legitimate
accounts with known passwords because
they've been compromised somewhere else
to get in and to stay undetected for
longer um this is where ransomware saw a
decline but there's also a change in how
ransomware works because they switching
to
extortion uh less than half of
organizations have a formal uh um
ransomware response plan so what do you
do if you get hit by ransomware I don't
know we'll just wing it like well that's
what Google is for right when we get to
it we'll figure it out and then you've
seen stuff like
AI um showing uh showing up uh and
finance is becoming the most targeted
industry uh it used to be Healthcare now
another another worrying Trend in the
industry is the lack of Security
Professionals the Demand right now is
projected to reach 3.5 million so
there's a lack of Security Professionals
on the market this was estimated to be
around 1 million back in
2020 now it's estimated to reach 3.5 by
2025 so that's a 350% increase over
eight years since these things have
started to to be um tracked and you can
see where the demand is higher so that's
companies out there looking for someone
to hire for a security position and no
candidates show up so and that's the the
Gap in the
market now I mentioned that yeah we're
going to be talking a bit about
passwords uh and I think here is where
Randall Monroe if you know the guy from
XK CD he makes a good point in one of
his Comics uh which is the one at the
bottom through 20 years of effort we've
successfully trained everyone to use
passwords that are hard for humans to
remember but easy for computers to
guess upper case lower case
symbols numbers whatever you need to use
complex passwords while this over here
is much harder to Brute Force using
traditional methods than the password up
there right I'm not going to read
through the whole comic but it's I think
comic 936 if you search for it uh and
it's it's a really good one because it
kind of captures the thing where you're
forcing humans to use their brain in a
way that's not really natural natural to
remember all these complex passwords but
they're going with passwords that are as
short as poss as short as possible as
short as they're allowed because it's
hard to remember such a password but the
shorter a password is the easier it is
for any Brute Force tool to break it
right so you're going for the short
password but that's to your disadvantage
in today's world and this is where that
table that I mentioned before from hive
systems comes into play so they've been
doing this for years now this year they
changed the the table from showing how
long it takes to break md5 to how long
it takes to break bcrypt and there's a
reason for that um a bit of History here
so they have kind of the same
methodology every year and they just
change how they they compute the data
they take what's reasonably available on
the market for an average consumer or an
average bad guy that wants to crack
passwords right now I know that buying
12 RDX 409s is not average for for for a
lot of people but still that's the
hardware that they use to try to break
stuff and like I said it used to be md5
up to last year and now they switch to
bcrypt the main reason is most sites do
use md5 with or without salt or
bcrypt um in one way or another to store
the hashes of the passwords right so if
there's a data breach somewhere you
usually get a pair of like email and a
hash you don't get the password in clear
text and this shows how long it takes to
break those passwords based on the
length the complexity and so on um and
their assumption is that if there's any
MFA involved it has been bypassed via
other means that passwords are truly
random so it's not a dictionary based
password or anything like that that
would make it easier to crack and that
it's not being a part of a past data
breach because that also makes it easier
to crack uh and they Al They also assume
a finite sample space of characters like
what characters could you use and what
characters are we trying to brute force
with and that also varies from year to
year uh so with this the comparison
between and md5 and bcrypt like the md5
part is scary right now if you are to
follow this is for an eight character
password following the current nist
guidelines so nist tells you use an
eight character password complex as
complex because you you should be
safe
right uh with bcrypt you you can see
that unless you have a Chad GPT level uh
uh infrastructure it takes you a bit to
to crack through through these passwords
but md5 not so much and why bcrypt well
simply because in the past three years I
think and this is data from have ibp.com
in the past three years bcrypt has been
the most common algorithm used in the
breaches that were made public which is
sad it's sad to look at this data like
what's the most common algorithm in all
the data breaches cuz there's a lot of
them right but simply due to the fact
that bcrypt has grown in size and purple
is md5 red is bcrypt uh the the simple
fact that bcrypt has slightly surpassed
md5 doesn't mean that md5 is not there
out there somewhere anymore um and that
still makes
it kind of um worrisome for uh for a
number of reasons the character space
that they use this year here was
uppercase lowercase numbers and the top
row some of the top row symbols that are
commonly used in passwords in past
tables like one two years ago when they
did md5 they used the entire 650
character set with Latin extended and
killic and everything now they just uh
compress the the character space and
that still uh shows that bcrypt is a bit
harder to break than md5
um than md5 is now when it comes to easy
to guess or stolen password or reuse
passwords this is how the table looks
like all right um and that's why reusing
passwords is is a bad idea so going back
this is once again the the table that I
mentioned Now using bcrypt you can check
on the website you can check the past
Year's tables and
everything the thing
is if you go with the xkcd approach with
like complex uppercase lower kease
numbers symbols you'll end up in this
table if however you use past phrases
which some websites don't even allow you
to use because you don't have an
uppercase lowercase symbol blah blah
blah even though your password is 30
characters in length it's not even on
the
table right but it's easier to remember
for you as a human they won't let you
because it's not complex enough well
yeah um other attacks on the rise so
yeah like I mentioned passwords are
still a thing and password based attacks
spiked in 2023 not only are they still a
thing but they're the thing for for some
data breaches and um this includes
credential stuffing password reuse
password spraying so all sorts of
attacks and I've talked about some of
these at past talks past conferences um
I won't go too much into detail but
essentially reusing passwords or just
trying potentially uh common passwords
on multiple accounts instead of trying a
thousand passwords on one account to
trigger any sort of locking mechanism
like a capture or something after three
failed attempts you just take 1 two 3
four 5 six and try that on a thousand
accounts one attempt
each data from data breaches show that
in some cases 1 2 3 4 5 6 is used by up
to
2% of people so that's one in 50 so you
don't have to try really long complex
passwords you just try 1 2 3 4 5 six and
if it's one in
50 you don't have to hack into all the
accounts you just have to hack into one
and if you're trying it on 100 or 200 or
300 accounts you might get lucky that's
password
spring um
then there's nation states there's a
definite change of behavior and I highly
recommend Microsoft puts out uh a report
every year called the Microsoft digital
defense report um and this is some stuff
that's taken out of out of that report
um they're looking at nation state
actors they're looking at Global Trends
they're looking at a lot of data and
looking at nation state actors um what
they saw what they noticed was a pivot
from the high volume destructive attacks
to cyber Espionage and to uh stuff
that's not as visible not as impactful
but more longterm um there's also an
explosion an unchecked explosion of the
Cyber mercenary
Marketplace so guys that are willing to
hack if they get paid well enough for
anybody they don't care which government
it is they sell their services to them
and that's a growing market and there's
also a noticeable Peak especially with
this being a a year where there's a lot
of Elections worldwide not just in the
US um there's a peak in the attempts to
try to influence foreign
elections and these originate
particularly from China but not only but
that's where the the spike comes from
and it's it's got like tens of pages if
you want to read through the report it's
like really interesting like I mentioned
AI manipulated taxs I won't go too deep
into this because there's entire
sessions during the conference that do
that but you've seen Advanced fishing
like right now you are able to get a
fishing email that doesn't have spelling
errors or typos in
it right because the Hackers from
Southeast Asia or Nigeria or wherever
they now know to ask Chad GPT to write a
prettier email for them right and that's
happening like it's it's a trend and
then deep fake attacks and you
there's a number of these headlines out
there with companies falling victims to
such attacks and making payouts of
millions of
dollars uh to who they thought was the
CFO on the phone or even on a video call
because of how good these deep fakes
are and and I think there's an
underlying problem CU we've seen before
even all the the increase in deep
fakes you've heard or seen or talked
about with friends or debated on your
social media bubble about uh fake news
right who here hasn't had one
conversation with a friend of or a
relative about fake news now consider
the naivity of some people when it comes
to fake news and how easy it is for them
to simply not check the source not check
the facts not check whether uh that
might be a false statement in any way
shape or form and translate that to
seeing or hearing a familiar voice
telling you uh that that's a thing right
like you heard Biden or um I for for the
uh guys in here that know about the uh
whole with uh isarescu and Investments
and whatnot i' I have friends whose
family members have been a Target and
Fallen victim to such attacks with
people calling and telling them that the
the governor of the Romanian um National
um um Bank uh recommends you invest in
this thing right and these things work
these things work
unfortunately but again I won't go too
much into that ransomware like I said is
also evolving the Resurgence is all
about that double extortion so
traditional ransomware is going
down but there's a new trend where they
don't just do ransomware but they do
double
extortion and that like exactly what I
told you you might want to pay if you
want to decrypt
stuff but then if you don't want to pay
me I'll release the data I'll make it
public and still affect your
reputation and make you suffer for it
right um the main Avenues of
attack by uh order of magnitude is
exploited vulnerabilities like I
mentioned that's a trend all over and
that's being used for ransomware as well
so known vulnerabilities being exploited
credential compromise and I've touched
on that with the whole password reuse
thing and malicious email and again this
goes back to the fishing and people
clicking on links they shouldn't be
clicking now when it comes to what the
pandemic did um how many of you are
familiar with MX
law not many so this is um a statement
that basically says that technology has
a a tendency to change
exponentially while organizations
companies only change at a logarithmic
pace so the pace of change within a
company usually Falls a lot behind the
pace of change of technology and that's
where a lot of companies lag behind the
technology that's out there and that's
why you have all these digital
transformation initiatives to try to to
narrow the Gap now when the pandemic kid
and you had a lot of companies put in a
position where I either allow my people
to work remotely or we go out of
business and working remotely is not
something that we did before or it was
an exception and we did have a VPN setup
to allow people like the my colleague
that's traveling somewhere to connect
securely through a VPN and connect to
the company data and we had like five
licenses For That
VPN because we never needed more than
five people connecting at the same time
from outside our Network well that
changed
radically and this is MX law adapted for
2020 for when the pandemic hit right
when there's a cataclysmic event you
will see some form of Rapid adaptation
it's do or die kind of a thing you
either do it like and I there's there's
companies out there that had this 2year
digital transformation plan and all of a
sudden that was possible in two
weeks right because it's you either do
that or you can't work so the impact
here the rapid shift to remote work
increased the exposure to all sorts of
attacks and then businesses became more
reliant on public Cloud
applications the main problem here is
your home WiFi became the problem of
your it Department
Department right cuz that's where you
connected to zoom or teams or whatever
Google meet and your connection was at
that point as secure as your home Wi-Fi
was which is basically the cheapest
router you found on the shelf that you
plugged in you realize it works I'm not
touching that it works right uh so it's
all admin admin everywhere right um
yeah that's that's now the the company's
problem as well somehow so this
triggered a spike in RDP attacks in VPN
vulnerabilities and then you have iot
out there all sorts of gadgets and
devices and smart fridges and watches
and whatnot one of these statistics show
that 78% of the devices out there have
known
vulnerabilities and 46 of these
vulnerabilities are on un
patchable so you can be told you can get
that recommendation to to patch right
but if it's
unpatchable there's only so much you can
do um business email compromise has also
seen an increase uh in in recent years
and this is all about hacking and
spoofing emails to try to trick
companies uh into uh paying usually it's
about money so making a payment into an
account wiring some money somewhere
where they shouldn't uh and these end up
being fairly complicated and go over
long periods of time uh but they're uh
when they're successful it's painful and
I've I've investigated u a number of
these cases over the past few years all
with um payments of in the like six
digigit range and not in Romanian
currency um and those are payments that
were done and no trace of the money and
they realized three months later that
that payment wasn't actually made to who
they thought they were paying uh CU they
were still responding and saying yeah
it's all good whatever uh while the
other guys were asking like where's the
money but since the bad guys kind of
interfered with the communication they
were getting communication from both
ends and they were telling each side
whatever they wanted like there's a
problem at the bank but don't worry
we're we're on it and next week we're
going to take care of
this and it was enough in at least in
one of these cases they they managed to
trick the victim enough so that the
default time for stuff to be logged this
was an M365 kind of a thing and they had
the logs there but after 90 days most of
these get raised and they managed to
kind of trick them and keep them talking
and keep them busy for over 3 months so
that when they actually realized the
there was an issue and they came to ask
for help there were no logs like and
that was also mentioned in in this
morning's uh
keynote uh MFA bypass attacks there's a
lot of these so if you think you have
MFA and you're 100% safe you're not
you're almost there but you're not
there's still some other stuff that you
need to to take into consideration and
you can just search any of these if you
want to find out more about how they
work there's also MFA
fatigue um trying to send multiple MFA
requests because if you get a lot of
these requests on a Saturday at 3:00
a.m. and they keep waking you up because
your phone's vibrating your phone's
vibrating you're just like whatever yes
I don't know man just leave me alone I
want to sleep that's usually enough to
get in uh Microsoft on their
infrastructure Microsoft was seeing at
some point tens of thousands of these
kinds of attacks in a
month supply chain attacks mentioned it
before just putting it here to for the
for the structure and the the idea
um these
are an easier way for the bad guys to
get into where they want again they
attack targets that are easier to get to
like software vendors service providers
Hardware suppliers so that they can get
access to the primary target because
going straight for the main target might
be more difficult more often than not if
you target a vendor or a service
provider you get access to multiple
victims right so that's a thing uh QR
code exploits
how many of you have been to a
restaurant in the past month and have
scanned a QR code
menu so you trust the QR code to give
you the menu and just the
menu and I couldn't in any way shape or
form print my own QR code on a sticker
stick it on top of those menus and make
you scan a QR code that downloads a PDF
with a zero date and infects your phone
right no way that's
possible um you don't even know what
you're scanning because you need to go
to the link it's like tricking people to
click on a link in a fishing
email because you will click on whatever
link the QR code because it's usually a
a shortened URL you never see the full
like it doesn't even show you in most UI
interfaces on phones it doesn't show you
the full link until you click on it and
that's a link that I control
by just putting a QR code somewhere and
I've got an example of this so there's
some
examples uh the colonial pipeline attack
anyone heard of
this right two three hands uh this was a
ransomware attack um the colonial attack
was um done in May of
2021 um this this targeted a fuel
pipeline somewhere on the east coast of
the United States and their systems went
down um it was the dark side ransomware
group they encrypted their it systems
and demanded The Ransom now they
consulted with the
FBI and figured
out we we can't do this we don't have
the backups we didn't do a good job blah
blah blah what do we
do we need to pay because we need this
thing back up and running and they paid
and they paid about $4.4 million in
Bitcoin
uh to get the tool to decry their data
they got the tool it was kind of slow so
they were down for about a week even
with the tool to decrypt they were down
for about a week probably if they had
backups that might have taken less than
like three four days
but they were they would have been $4.4
million richer now operations did resume
within a week
the incident did lead to uh new
guidelines and mandates for pipeline
operators uh there's an interesting
tidbit here the law enforcement
eventually recovered part of that
Bitcoin about 60% of it but in the
amount of time it took them to recover
the the money uh the the price of
Bitcoin dropped so they basically got
back about half their
money even though they managed to track
where the Bitcoin went and get it back
and whatever like
crypto um who here heard of the mother
of all
breaches that's from like four months
ago this was discovered in January of
2024 and it's essentially just a
collection of other path breaches it's
nothing new there's been collections
before if you search for collection
number one uh back in 2021 or something
uh it's even got a Wikipedia page but
that was like like three billion records
in size this one has over 26 billion
records there's a lot of duplicates
right but these are all records from
past data breaches of known usernames
and password sometimes in plain text
sometimes just hashes that you need to
break but it's 26 billion records from
Twitter and Adobe and canva Linkedin
Dropbox you name it this this finding
it's a finding and this stuff's been out
there for a while it's only been made
public recently this just goes to show
the extent of the data breaches out
there and the extent of the data that's
been
leaked and the extent of the potential
impact of you reusing the same password
in two places not in a lot in just two
places because if one of those gets
hacked it ends up in such a list the bad
guys just reuse it to Target your
account somewhere
else
right um I was telling you about the QR
code thing this was actually used for a
dissemination tactics in Poland people
started seeing Flyers stuck on on
um electricity poles with um a request
to to do some form of pii to provide
some pii and it was masked to to appear
official and people also started
receiving emails about this so it was
done both via email and physically and
since it has that it had that physical
component to it people actually assumed
that it's legit and it all it took them
all to um forms that asked them to
provide uh the personal identifiable
information of Ukrainian
refugees so QR
codes um there was uh earlier this year
there was a an an interesting attack a
pro Ukrainian hacker group targeted the
Russian Center for space
hydrometeorology so their Center that
tells them kind of what's the weather
going to be like in
Ukraine cuz they need to know that um
now
days what they did was they managed to
delete around two paby of data which
obviously affected all all the um State
entities that were using that
data um and yeah cyber warfare does play
a role in
geopolitics Trello had a data breach
earlier this year that affected over 15
million users who here has a Trello
account or had a Trello account at some
point and never deleted it
because that's more important right it's
not like I have a Trello account because
I know because I have an open tab in my
browser every day now did you have one s
years ago and never stop you stopped
using it but never deleted it never
changed your password or
anything if that company or that service
goes through a data breach your data is
now somewhere in a collection right
um so then what should I do to like
protect myself from these kinds of
things well um there's a number of
things that you could
do this is again uh a list of steps that
Microsoft put in the their digital
defense report they say
that looking at the data that they're
seeing looking at the threats the types
of attacks that they're looking at that
that they're analyzing if you do these
five things you're pretty much okay
when it comes to 99% of
attacks so let's see what these are use
or enable MFA so if you can use
multiactor do use it
everywhere apply zero trust principles
who here doesn't know what zero trust
is okay it's good that I have a slide on
that then uh use xdr extended detection
and response and antimalware so any sort
of tool or solution that will help you
detect that something's odd that
something is happening that shouldn't be
happening take some form of automated
action if possible or at least notifies
you that hey there's some suspicious
behavior on your network or with your
emails or
whatever keeping up to dat and this kind
of goes both ways because it's both
about patching but it's also kind of you
being up to date with the trends and the
solutions and technologies that you
could use and how they can help you it
is mainly about patching though so if
there's a patch that you can install do
install it if there's no patch it
doesn't mean that that piece of software
is not vulnerable it might just
be it that it reached end of life and
there's no more patches for it anyway it
might be that there's a vulnerability
out there that hasn't been made public
someone's exploiting it but it's not
public yet or at least the vendor
doesn't know about it so they haven't
patched it yet so there's a lot of
reasons why even if you're fully up
toate with your OS with your phone it
doesn't mean you are 100% safe you are
safer but you're not 100% safe and then
finding ways to protect the data
itself knowing at all times who's
accessing the data where it's being
processed stored how it's being accessed
uh if it's being exfilled or anything if
once you send your a file to someone do
you still have control over it can you
revoke access to that file there's
Solutions out there that help you do
this
like that that email that random email
with an attachment that was sent to the
wrong George right with the auto
complete and then you send out another
email saying hey George the previous
email wasn't for you please delete it
it's confidential do not open that file
please it's important do not
open you know they won't open it right
they well like one thing that actually
um I have a friend that this happened
to they sent out an email by mistake
they sent out a second email saying hey
please don't touch that because it
wasn't meant for you
and they got a forward back saying it's
okay I haven't touched it I'm sending it
back to
you
right yes so there's that um but there's
ways to protect your data even if you've
sent it to somebody and you want to
revoke access to it without having to
send that pretty please email right zero
trust cuz you uh uh you mentioned you
don't you're not familiar with zero
trust this is an approach where uh
you're trying to ensure that you don't
trust anything or anyone no device no
user on the network you assume the worst
you assume that any user could have been
compromised and there's a way for you to
check that at all times so you're kind
of being overly paranoid when doing zero
trust but it pays off because you're
going with an assumption that if you
should have access you will have access
but then I'm also looking at potential
behavior that shows me that you're not
who you pretend to be because if you
have something in your system in your
network in your application to detect
that um that user is doing something
that they shouldn't be doing right it's
say an accounting app and usually users
log in Monday to Friday 9 to 6 right and
then you've got this new login on a
Saturday at 3:00 a.m. accessing parts of
the software or doing massive exports of
data that that particular user isn't
regularly
doing detecting this kind of
behavior like you're connecting usually
from Clues and all of a sudden you've
logged in from clusion then 5 minutes
later you're logging in from
Singapore impossible travel right so
you're looking at all these things the
zero trust approach looks at both the
identities like whether it's human or
non-human for um uh for applications and
whatnot and the end points the devices
that that user or app is connecting from
and you look at the compliance of the
device at the way the user
authenticates and if you believe there's
something weird you can request some
enhancement like you're logging in from
a place that you don't often log in I
know I told you that you're only
required to put in your MFA token every
30 days or so but please do it again
just this time from this location for me
right so putting in that extra thing
that extra type of validation and then
it goes to some form of policy
evaluation and enforcement where you do
two things uh you try to optimize the
policy by using the data and you do
threat protection like threat
intelligence forensics response
automation by again using all the data
but what you do when when a request
comes in is you try to figure out if
that user should have access to that
application so you do kind of a one on
to one mapping for every user to every
application they should have access to
it's a lot more than VPN or just network
based stuff because with a VPN you're
allowing a user to log in doing all the
MFA and everything but once they're logg
in once they're inside they've got
access to everything usually right
there's no network segmentation there's
no and even with network segmentation
that's not enough this goes even further
and checks for each individual request
to each individual app should this user
have access to this application or this
service or this endpoint at this point
in time from this location from that
device using those credentials and if
the answer is yes you grant them that
permission if not you deny them the
permission so it goes a lot deeper and
on the network you look at uh both uh
the classification and labeling and
encryption for data you look at adaptive
access for applications and runtime
control for everything in the in
infrastructure this is where just enough
enough and just in time approaches come
in like you don't want an admin to be an
admin at all times you can have that
user as a regular user and only when
they request access to say change a DNS
entry are they given enough access to
change that entry based on predefined
rules once they've changed the entry the
access is revoked so that if that
account ever gets compromised they're a
regular user they're not a domain admin
right so it's also just enough just in
time and the third part of of zero trust
is the assume breach approach it's
shifting from a how do I prevent how do
I protect how do I try to make sure that
I don't get hacked to how could I tell
today that I've been hacked
yesterday right because it's different
and the the approach you use is
different the tools you use are
different so it's it's all about that
change in mindset and that's kind of the
gist of zero trust in in five minutes um
I have another so if you search for zero
trust in my name I have a couple of
other sessions that were recorded at
other events you can dig deeper into
that if you want then there's the uh so
are part the security orchestration
Automation and response if you want to
go deeper into the whole approach to
prevent protect detect respond kind of a
thing uh this is all about automated
detection and response because even if
you have a system that detects that hey
there's something wonky going on in the
network if it just sends you an email on
a Saturday at 2 a.m. and your it guys
only coming to work on a Monday morning
if it's not Easter or something and then
they come on Tuesday like what could the
bad guys do in the 24 48 72 hours that
they've been in right uh and this is
also about how budgets can change before
or after a data breach who here has had
this thing or know about a situation
where after a data breach the budget all
of a sudden was a lot more generous
right but it's only
after um and then when it comes to
incident response building an incident
response plan is uh part of your
strategy to to kind of address this and
there's different ways to do it if you
have no clue where to start uh NIS
actually has um a computer security
incident handling guide a special
publication it's
800-61 revision two uh so you can you
can check that out it's a document that
tells you in detail step by step how you
can do incident response and see what
makes sense for you and how you could
like hey this is actually a good thing
let's put two three pages into a
procedure that tells everyone like if we
ever go through an incident this is how
we can respond this is what we should be
looking
at uh and when it comes to looking at
what the future might bring and there's
a uh there's actually some good sessions
on on Quantum crypto um there's one
tomorrow that uh you might want to check
that I that I know of uh that's already
changing the security
landscape both for the better and for
the worse because Quantum will make some
of the existing cryptography Solutions
obsolete because they will be much much
much easier to break but it also brings
different ways to do encryption which
are way way way way stronger and that
that's just uh um the gist of it right
Ai and machine
learning right now they're mostly used
for the bad
stuff because as you've seen even though
they have some safeguards built in as
Jason showed earlier this morning you
can kind of circumvent that and you can
ask chat GPT nicely to give you all the
scripts and the stuff that you need to
hack into other stuff um but now they're
making their way so these things are
making their way into the security tools
designed to defend as well it's a a
slower motion it's slightly lagging
behind with by compared to the
creativity of the bad guys using those
uh tools but it's there and it's
happening um and there's another
discussion with uh deep fakes and the
need to kind of figure out how we can do
any some sort of digital authenticity at
a
station like ensuring that when you go
on a call on teams or Zoom or whatever
with someone you know they're that
someone and that can be tied to some
certificate that you need to find a way
cuz that's going to be wonky to find a
way to to tie a certificate to their
identity and when a certain
communication stream comes from someone
that signed with that certificate you
know it's from them but how you generate
that and how you that could be faked how
you generate that in the first place and
how you validate that in Meet space if
you will before you you do the
certificate thing that's under debate
there's a lot of discussions in in that
area um so I've got like three minutes
for uh questions and more I'll be around
here both today and tomorrow so we can
talk more about if there's anything
right now um feel free to to raise your
hand like it usually takes about 10 15
seconds to for people to put together a
question if we hit the 202 mark it means
that nobody's right now
thinking of doing it in public maybe so
if you might have any questions that you
want to ask in private I'm also
available for that otherwise thank you
very much for your time