Security Confidential S1 E0 Cybersecurity Conferences

Host: Welcome to this week’s episode of the Dark Rhino Security Podcast. Today, a few of the Dark Rhino team members are joining me in the studio to talk about some recent cybersecurity conferences that we have been fortunate enough to participate in.

Mitch: This is the first all in-studio podcast. Nobody’s remote today.

Manoj: Yeah, it’s a Friday afternoon and we’ve got a great team assembled here today. We do. We’ve got Jake here, we’ve got Mitch here, we’ve got Nick here, and we’re going to talk about, as always, cybersecurity, but specifically Nick, Mitch, and Jake actually had a chance to attend a couple of cybersecurity events, and I thought it’d be good to share with the audience what was going on at some of those events to give the listeners a little bit of insight on what’s at the top of mind for people in the world of cybersecurity right now.

Specifically in the last week or so, Nick was just yesterday on a president’s panel in downtown Columbus where he participated with a person from Huntington Bank and the Federal Bureau of Investigation. So, I think that might be a great place to start. Nick, what was this event about that you attended?

Nick: So, to be clear, it wasn’t the President of the United States panel. It was a president’s business forum panel where we sat down and met with local business leaders, small businesses, and medium-sized businesses to talk about cybersecurity risks. Ashley Bronn from Huntington Bank was there and she spoke about some of the gaps in cybersecurity insurance. We had Rob White from the FBI. He was there speaking about what the FBI is seeing in trends in cybersecurity threats that businesses are facing. I had an opportunity to talk with a number of business leaders about how to get started with cybersecurity programs—things like choosing a framework or understanding what some of the local laws are that are new for Ohio, like SB 220, providing some safe harbor for organizations that adhere to a framework. And we had an opportunity to talk about what does it mean to be in the cloud and how does that impact your security.

Manoj: So, there’s a general assumption, Nick, that if I’m buying services from Amazon or from Microsoft with Azure, I am secure and I don’t have to do much there.

Host: Is that true?

Nick: That’s a very common misconception. Just because you are in the cloud does not imply in any way whether or not you are secure. Now, if you have really poor practices for your on-prem infrastructure management, you could be insecure because of those practices. But just by choosing a cloud provider does not guarantee any degree of security.

And at the end of the day, the thing that’s most important for every organization to remember is that your data is your responsibility to protect, regardless if it is in Amazon, Google Cloud Platform, or Azure, or if you choose a SaaS application like Dropbox, Box, G Suite, Office 365, Workday, or Salesforce. All of those SaaS applications take reasonable measures to protect your data, but at the end of the day, there’s still quite a lot that you are responsible for, and configuring those properly is a key first step.

Then looking at other security tools to augment where their built-in or native security options are limited or are not able to be set in alignment with your organization’s policies.

Manoj: There’s a benefit to actually taking the time and the effort, at least in Ohio, to go ahead and secure some of these environments with what you briefly mentioned: SB 220. What is that exactly?

Nick: Well, I mean, it’s a law, so it’s not going to be something simple to cover in just a few minutes of a podcast. But at the high level, organizations that adhere to and attest to an approved information security framework—there are about six of them, I believe—

Host: Okay.

Nick: —are provided a certain degree of safe harbor against litigation in the event of a data breach. The principle behind it really comes from the idea that if you take all reasonable measures to protect your information and some malicious actor comes along with an unknown or zero-day vulnerability or exploit and manages to breach your environment, you can’t really be held accountable for what nobody else in the world knew.

And so the rationale behind it is that if you take all the reasonable precautions and you are adhering to and following a framework like NIST or the ISO 27000 series, or HITRUST, if you follow these cybersecurity frameworks, you can receive a certain degree of protection from litigation.

Manoj: It sounds like something that everybody should be taking note of, and they should do some research on it and see what the implementation implications are within their organizations.

Nick: Yeah. And there are lots of really wonderful resources out there. Dark Rhino is a great resource for organizations that are unsure of what that means, what’s involved with adhering to a framework, or how to go about choosing the correct framework.

Many organizations get stuck in this analysis paralysis: what’s the right framework for me? And the truth of the matter is that about 80% of the content of any one framework is going to map to certain components of any other framework. They are best practices, and by definition, best practices are pretty general and universal.

So, picking a framework is more important than choosing the “correct” framework. If you choose the wrong one and you need to pivot in two years or three years, it’s not going to be a whole reset and start over. It’ll be changing 5, 10, or 15% of the security controls, policies, or procedures that you’ve put in place. A lot of it’s just fine-tuning at that point.

Manoj: So, you mentioned you were on the panel with the FBI. I’m more than curious: what did Robert White—you said was the gentleman’s name—what were some of his insights that you walked away with?

Nick: Well, a lot of it was targeted at business leaders, so there weren’t very technical discussions. But one of the things that I was made more aware of yesterday is something called IC3. It is the Internet Crime—

Host: Internet Crime Complaint Center.

Nick: Thank you. That’s it. Internet Crime Complaint Center. There you go. In any event, IC3 is a website you can actually go to as a private citizen. It is a great opportunity for businesses and individuals that are victims of some form of cybercrime to report it to the authorities.

Because of the sheer volume of cybercrime that’s happening, there’s kind of a minimum threshold before the FBI can reasonably dedicate resources towards investigating and trying to apprehend or prevent these cybercrimes. So, one of the things that IC3 does is it allows them to aggregate your run-of-the-mill $5,000, $25,000, or $50,000 incidents into a larger total sum that may be already in the middle of being investigated, or have the total amount of these crimes compiled up to reach approximately a million-dollar threshold.

So the thing that organizations are able to do is report these here. If it’s an investigation, if it’s already getting ready to go to trial, it may give you an opportunity for restitution. It’s always a great thing if you have a security breach from some kind of cybercrime. It is always important to report it, and IC3 is a great place to start.

Another one that blew my mind was—I hadn’t considered the fact that a lot of times these major ransomware outbreaks will have shared keys to unlock your files. And you can actually call the non-emergency FBI hotlines and speak with somebody who will direct you to the agent that’s running with that specific ransomware, if it is being investigated. And they may have already acquired an unlock token where you can unlock your files without having to pay the ransom, which you should do only on a very, very, very rare occasion. Don’t pay the ransom. You just make yourself a hot target for the next time.

Manoj: See, now that is worth the price of admission for this broadcast right there.

Nick: Yeah, that’s—

Host: I’m not saying that every version of ransomware is going to have a single token that’ll unlock your files, but it certainly is worth a try.

Manoj: This was a bit of information I didn’t know until you just mentioned it: that you can actually go to the FBI and they might actually have the unlock token for a ransomware attack that you may be a victim of.

Nick: Which is why I always preach—or we always preach—that you should also have a great backup strategy which is completely separate from the rest of your environment. And if you do get hit by one, don’t pay it.

Manoj: Right. I always kind of wondered about that, like I don’t understand the rhetoric where people still persuade you by saying that you should pay the ransom. I just don’t quite understand that, really. I mean, for you and me, it’s a little different. We work in an industry where we’re naturally going to be more inclined to take on that challenge and understand the processes that people go through.

But I spoke with a company not long ago and they were telling me that they had been infected with ransomware. They spent a few days trying to resolve the issue—it was encrypting shares and endpoints—and they finally contained it. But to unlock their files was going to be thousands and thousands and thousands of dollars of time and resources, sending drives out, and all of the associated steps that one can take to try to recover their data in the event they don’t have a backup. And it was my understanding they did not.

But the ransom came to be $6,000. And you have to weigh the cost-benefit there, right? So $6,000 for a company that makes a billion dollars a month—that’s nothing. That’s chump change.

Jake: $6,000 for a company that makes $6,000.

Jake: Are these ethical criminals? Do they actually unlock your files?

Nick: It’s crazy. I actually think they do. I think they do a pretty high rate of actually unlocking the files because they want people to pay. If they establish this “pay me and then I’m not sure you’re going to get it,” then they kind of poison their own well.

And then there we had a discussion. One of the other people on the panel, who I don’t believe was me, mentioned Steven from All Covered. They provide some managed services for organizations generally around infrastructure and IT support help desk stuff, but they have gotten a little bit into the security realm.

One of the things he talked about was ransomware as a service that’s now coming out.

Jake: Yeah, I didn’t know about that.

Manoj: Ransomware as a service. Please explain.

Nick: Well, it’s happening in a couple of different ways, but essentially people create ransomware and then allow you to go download it. It’s now your responsibility to disseminate it and infect computers. Any computers that get infected from that, the people who created the ransomware will keep some cut of the ransom and then you get the rest of it.

Manoj: It’s like a ransom consignment type of thing. So, you know what I mean? If you use their ransomware and you get $1,000 out of it, they get 200 of the thousand. And do people realize this is breaking multiple federal laws and it’s a felonious offense?

Nick: I don’t know if they know it’s a felony, but it’s definitely—I mean, it’s obviously wrong. They’re not just thinking they’ve got a new day job going.

Speaker: Yeah.

Nick: It’s pretty well known, but you have different organized crime operations, right? Or lack of organized crime. You have different crime groups or individuals that don’t have the expertise that’s necessary to create a piece of malware or to find zero-day vulnerabilities, because those are hard and they’re very expensive. They’re worth a lot of money on the black market.

So, you have—and I’m just picking something because I heard it on NPR today—you have the New York mafia, right? They might want to get into ransomware as a way to diversify their crime portfolio, but don’t necessarily have IT professionals.

Nick: Another really interesting thing that Robert from the FBI was saying—he said that in Columbus or in Ohio, the average bank robbery in person is about a $3,500 take. He said the average cyber robbery of a bank is about $3 million.

Manoj: Really? Yeah. Wow.

Nick: Yeah. I don’t know if he was using exact numbers, but he was speaking in orders of magnitude, which blew my mind. I can’t imagine—I feel like there’s not that many physical robberies of banks anymore. Every time I hear about one, I’m always like, “Oh my goodness, is that still happening?”

Jake: I feel like you never hear about anybody getting away. Like, you’re going to be the first guy to pull off a bank robbery and not get caught?

Nick: Right.

Jake: But why take that risk when you can get away with three mil?

Nick: Exactly.

Jake: And you don’t have to leave your house.

Speaker: Yeah.

Jake: I would still probably encourage leaving your house if you’re going to rob a bank. Probably don’t do it at a public library. For those who are listening with that intent, I would encourage not doing it at all.

Speaker: Get a library card or a fake name and do it there.

Jake: Do not do it from home.

Manoj: We had a bank on that panel, too. What did those folks have to say? Ashley was from Huntington and she talked about that. It was talked about here in our office a few times that Huntington Bank was there.

And Huntington Bank—I didn’t know this at all—has a very large insurance arm. They do property insurance. Yeah, they do all kinds of insurance for organizations and individuals.

Nick: And she was there representing their cyber insurance arm of the business.

Manoj: Okay.

Nick: Talking about the things that organizations are often making claims for. One thing that she pointed out was really kind of a gray area:

Cybercrime is crime, right? But it might be covered under your cyber insurance policy and it might be covered under your crime insurance policy, or it could be covered under neither of them, depending upon the type of cybercrime that you’re experiencing.

Manoj: Really?

Nick: Yeah. So, she said there have been some rulings in courts and there have been some precedents set where if somebody actually breaches your systems and steals credentials, or fishes and gets real credentials, and does act inside of your own email, for instance, that that would probably be covered under your crime policy because it is considered a crime there.

But sending an email pretending to be your CEO and encouraging you to redirect funds to a different account may not fall under your cyber insurance or it may not fall under your criminal protection insurance.

So, I found that to be pretty interesting—that there are kind of boundaries. We all have experienced that in our life. I’ve had someone knock on the window of my car and steal stuff out, and I was told by my car insurance to talk to my homeowner’s. I talked to my homeowner’s and they said, “No, it wasn’t in the house.”

So, there are those boundaries. You’ve got to be very clear as a business when you’re talking with your insurance agents, brokers, or representatives. Understand what is excluded; that is really important. And then from that, also understand where the boundaries of different coverages cover you.

Manoj: Yeah, that’s very valuable insight. I don’t think most folks, when they’re applying for a cyber insurance policy, actually take any of that into consideration. A lot of small businesses just have a very simple short form that they fill out, and it doesn’t really even ask questions in any depth.

I’m assuming the insurance industry is just saying the likelihood of something happening here is so small—they’re such a low-level target. We don’t know if they have any controls.

Jake: Especially since cybersecurity is so hyper-technical. I feel like that’s totally the type of thing where if you own, let’s say, a pizza shop or something, you don’t know the first thing about cybersecurity.

But you go and get your cyber insurance and in your mind, if something happens to me, I’m going to be covered. But then as soon as it does, they’re going to be like, “Oh, well, this happened due to this type of attack based from this type of execution; it’s not covered.”

Nick: It’s not covered.

Jake: Yeah. So, I mean, for somebody that’s not tech-savvy, I could definitely see getting caught up in that paying-for-insurance-that-never-pays-off scheme.

We’ve heard of cases with franchise owners where they have been shut down by ransomware. They lost all their data, they didn’t have it backed up, and their cyber insurance policy did not cover a lot of things. It didn’t cover the loss of business. There was no way for them to get their data back. That was gone permanently because they didn’t have a good backup policy.

Small businesses, right—you know, small franchises, whether that be a pizza shop or a Subway store or a dry cleaner—who knows? Those folks may have a cyber policy, but their level of coverage could be quite insufficient for what could potentially happen if they got hit by ransomware.

Speaker: Definitely.

Nick: Two things to talk about with that. One is that backups are critical, but backups can be infected. We’re seeing more and more that these pieces of malware are really in the advanced persistent threat realm, and they’re just kind of hanging out silent on your computer for 3, 4, 5, 6, 10, 100, or 150 days.

And then you’re running these backups and then you get encrypted. You go to restore from a backup and you’re restoring from a backup that has the same malware in it. It’s going to re-encrypt your machine right away.

Backups are critically important, but it is important to keep multiple iterations of backups because you may not be able to restore from yesterday’s backup. You may have to go back 5, 10, or 15 days, or two months.

Jake: Which would be really problematic for most organizations. But I imagine that some information is far better than none.

Manoj: Well Nick, even very large companies—I forget who it was, but there was a rideshare provider in the papers that got hit by ransomware and they actually paid it. They paid a very significant number—a high five or low six-digit sum that they ended up paying.

So, you would think that a tech company like that—a rideshare services provider—would have immense backup of all their information and would have invested a lot of resources into securing their environment. Obviously, it was not true.

Nick: Yeah. So, I have a good friend who works with Iron Mountain. He said one of their services is cold storage of your backups. That’s specifically because there has been an increase in malware that’s targeting people’s backups and looking at causing the same kind of ransomware in their backups without their knowledge, doing it quietly and silently.

So, they have cold storage and then they actually will help you do forensics before restoring. It’s a pretty cool feature there.