Just prior to the BlackHat & DEFCON, my colleague Rick Holland and I were fortunate to share some time in the company of Bob Anderson as part of our ShadowTalk podcast. For this two-part episode (see links to the episodes at the end of this post), we’d chosen to discuss the topic of the modern digital breach. Why have breaches topped the news, and how have our responses to them evolved?
We could not have asked for a better guest speaker than Bob for this topic. He built a career in law enforcement over the course of 30 years, serving as a Delaware state trooper for 9 of them, progressing to serve 21 years in the FBI, culminating in his appointment as Executive Assistant Director, 3rd from the top. In that role he ran Criminal, Cyber and Response investigations team under Robert Mueller and James Comey. Upon leaving the service in 2015, Bob has applied his experience in the commercial sector, today leading Cyber Defense Labs, an organization specializing in breach response, training, and cyber managed security services. Since 2015 he’s led and supported responses to thousands of the major breach cases many of which you would recognize in the headlines, effecting hundreds of millions of people all over the world.
“Believe it or not, When I first went into the FBI [in 1995], we did not have one single, solitary computer on any desk in the FBI. The reality was, we literally had teletype machines to communicate around the world, if you compare that to what it was when I left in 2015… it obviously changed a lot.”
It clearly did change a phenomenal amount. I think all our readers would recognize the frequency, scale and impact has made this topic a daily news occurrence that has changed the way we think about our information forever. Bob and his team lead the investigations into the most serious cases that actually made it to law enforcement. One example being the wiper attack on Sony Pictures in 2014, a prelude to WannaCry and the first breach where hard evidence that a nation state could turn upon a commercial organization to destroy its operations for political purposes, made it to the public domain. This is now documented in detail in the 2018 indictment against North Korean, Park Jin Hyok which describes the attack in detail (https://www.justice.gov/usao-cdca/press-release/file/1091951/download ) the same indictment we turned into a blog here: https://www.digitalshadows.com/blog-and-research/indictment-of-north-korean-regime-backed-programmer/
So, what happens when a company incurs some kind of breach?
Bob shared with us that he consistently sees business go into full-on crisis mode. Stockholders immediately launch legal action against boards, Equity holders sue the company. Typically, general counsels are overwhelmed in a matter of hours by all the crossfire, it places them in a weaker position to actually manage the breach itself. In many cases, key, basic questions arise – like, can we make payroll? Can you actually communicate with colleagues? Basic functions suddenly turn into major challenges. This all leaves little time to actually manage, investigate and respond to the breach itself. Given this chaotic situation, it’s unsurprising that organizations can appear less than coherent whilst all this is going on. Bob then adds: “Don’t assume just because you have insurance that you can expect a payout in a meaningfully short amount of time”.” Clearly a great deal of work has to go in to work out what should be paid and legal wrangling can go on for years.
The point here is, as Bob explains, “An ounce of upfront thought, on what could become a train wreck [..] is worth millions upon millions of dollars downrange”. Preparation, planning, and preparedness is the right counterbalance to any organization caught up in such a whirlwind. The problem being that too many organizations discover this after the fact.
Data Breaches – No Longer ‘If’, But ‘When’
How have we come to be in living in a world where news of a new breach is almost becoming routine? We’re all familiar that it’s no longer ‘if’, but ‘when’. There’s certainly more than one factor at work here. Society is busy increasing its reliance on new technology to impact more effective business, and although we are gradually getting better at securing it, there is more of it to secure.
Bob explains “About 90% of what we see is opportunistic and [not particularly exotic], but often enabled by someone purchasing capabilities that significantly lowers the bar for a criminal”. Staying ahead of the latest tactics and behavior is key. “When we talk about the ‘old days’ in cyber, that’s like 2 years ago”, explains Bob. “The degree of technical skill required back then was high, but now criminals can rely on tools and data that significantly lower the bar.” Certainly, there are examples such as the 14.5 billion username and password combo lists that are routinely used to break into systems or the recent elasticsearch breach at Honda, where accident and misadventure led to exposure of data that was subsequently exploited by an opportunistic attacker.
The Dark Web and Data Breaches
It’s not surprising then that incident responders are seeking to get better insights into the threat. This led our discussion onto the role that monitoring the Dark Web can have on incident response and remediation. Whilst it’s possible to get into a semantics discussion about what the Dark Web is, we all saw the value in validating capabilities tools, techniques, but also the market for data. At Digital Shadows we often get asked by customers if data is being offered for sale in the various marketplaces we monitor. This can provide valuable insight at a critical time in a response plan. But almost as valuable, it can offer clues about how an incident came to pass, or weaknesses that could have been exploited or sold online to facilitate a breach. Our own research points to the 2.3 billion files just publicly available on the internet that seem to contain a wide range of sensitive data.
Will we see a drop off in the frequency of these event as we improve security? At the moment there are unfortunately few signs of that being the case. To offer some sense of scale, Bob offers that “at any one time there were two to three thousand investigations into breaches in the FBI Cyber division alone. In my first commercial practice we did 780 investigations into breaches and not one of them resulted in a report to the FBI. This suggests the scale of the problem is immense with much of what is happening going unreported”. By the time we read about it in the news, it’s usually due to the class action lawsuits and on average an investigation has been ongoing for 20-25 months.
Conclusion – Top Advice to Managing the Risk
So in conclusion, what advice did our panel have for companies looking to manage the risk? We already described the need to be prepared, to have the right professionals and counsel on hand ahead of time to help with the response process. Bob gave us his ‘top 3′ areas to focus as:
- Appointing someone at board level to be responsible for risk, not just cyber risk, but the risks that impact business including resilience of critical business operations.
- Actually train, educate and support your people, through concise, targeted education relevant to their role in the organization. Well trained people can be your best way to detect when something isn’t right. It can give a better sense of responsibility and you can instill an innate awareness that significantly strengthens your first line of defense, your people.
- Focused technical controls such as two factor authentication can create significant barriers to many attacks, given the number of opportunistic attackers it can significantly lower exposure.
At Digital Shadows, our focus is on helping our customers be aware of the digital footprint, keeping ahead of the threats through monitoring the dark web, understanding inadvertent data loss that might be exploited, preventing disruption of identity online and managing the attack surface proactively; we see this all playing a critical role to play in lowering the risks and supporting effective response programs.
We’d like to extend our thanks to Bob and his team at CDL for sparing the time to talk to us, and we’d welcome the opportunity to checking in a year from now to see how things are evolving.
To listen to both episodes, follow the links below or find “ShadowTalk” on your favorite podcast player.
Cyber Defense Labs
Cyber Defense Labs specializes in helping clients reduce business risk BEFORE, DURING and AFTER a cyber incident. For more information visit cyberdefenselabs.com.
To stay up to date with our threat intelligence content, make sure to subscribe to ShadowTalk or our email list below: