Security Confidential S4 E5 Ross Young

Manoj Tandon:
Hello everyone, welcome to another episode of Dark Rhino Security’s Security Confidential. Today we are honored and privileged to have Ross Young join us. Ross is currently the CISO of Caterpillar Financial Services. He is the co-host of CISO Tradecraft, a lecturer at Johns Hopkins University, and a SANS instructor. He has formerly worked for the CIA, NSA, the Federal Reserve, and Capital One. Ross is the creator of the OWASP Threat and Safeguard Matrix. Welcome to the show, Ross. Thank you so much for joining us.

Ross Young:
Thanks for having me here. I’m excited to be here. I really appreciate it.

Manoj Tandon:
To start this off, we’re all curious. To be the CISO of Caterpillar Financial Services is an enormous responsibility. How did you get there? What was your pathway? Give us a little bit of background here for all the fledgling CISOs.

Ross Young:
Sure. I started off with a computer science degree, and I did a business major on top of that. Through my computer science program, I really figured out that I wanted to do cybersecurity in 2004 or 2005, so I focused on getting an MBA.

The Office of Personnel Management had a program called Scholarship for Service; it’s also called CyberCorps. What they said was, “Hey, we need more good people to work for the U.S. federal government. We don’t normally pay as much as the commercial side, so how about we do something like ROTC? We’ll pay you to go to college for two years, and then afterwards you come to work for the federal government.”

Me, wanting to learn how to hack and do all the cool things in cybersecurity, thought that was a good deal. I got free college, and I wanted to work for NSA and CIA. So that’s what I really focused on. I had a great internship at NSA doing access control solutions. I worked for about a year at the Federal Reserve while I was waiting for my CIA clearance to come through, and then I spent about ten and a half years there and just had a fantastic career. I couldn’t have been luckier.

Manoj Tandon:
So are you from the DC area? Were you in that circle there?

Ross Young:
No, not originally. I was a military brat, so I moved around. I did college in Utah and Idaho, so more out west.

Manoj Tandon:
And you ended up working for all these illustrious agencies. Usually we hear the NSA and CIA recruit a lot locally and get very bright young kids to start internships. Do you know if that Scholarship for Service program is still in existence today?

Ross Young:
It is still in existence. There are, I want to say, about 150 different schools on that. If you go to Scholarship for Service — sfs.opm.gov — you can find the program, and they’re still giving out great scholarships today. So if anybody has kids, or they are in college and want to do that, I highly recommend the program.

Manoj Tandon:
We will put the link in the show notes so everyone can click on it. That’s excellent that it’s available. Tell us a little bit about your time at NSA and CIA — things that you can share, of course. What were your learnings about foreign capabilities as it came to their ability to attack us from a cyber perspective?

Ross Young:
I don’t think there’s anything that different than what you would see in the commercial sector. You have people who have access to data that they want, and so they want to target those individuals. It’s very common when you think about how am I going to target somebody: I need to find them. I need to find a phone number, I need to find an address or a LinkedIn account and target from there.

What are you going to see folks do? They’re going to look on social media sources — Twitter, Facebook, LinkedIn. They’re going to try to find people who have access, and then they’re going to have some type of pitch that gets you to connect to that individual. Then they’re trying to find a way to either recruit that person for nefarious reasons or leverage that access to get into the target.

It’s not really that different from traditional red teaming operations, where you may say, “Okay, I’m worried about people who are database admins in my organization because they have access to a lot of data that would be sensitive.” So let’s take a person like that who has a social media profile on LinkedIn. How can we find that individual? How can we create targeted messages to that individual to get his email address and send him something malicious that’s going to allow us to land on that machine?

As we start to think about that, you think about how many of us fail a phishing exercise in our organization. Is it 10 percent? Is it 20 percent? Is it 2 percent? Then you just play the numbers, right? If it’s 5 percent, that means I’ve got to send 20 emails to find the one right target.

Manoj Tandon:
Right. That’s not that hard to do. And I guess if you’re persistent enough at it, you’ll get it. If you’re good enough — I mean, some phishing emails are dead easy to spot, but in our own experience we’ve had some come into our organization where we looked at them and said, “That’s one to hang on the wall and frame up.” It was a great message, and they actually knew a lot about the people and wrote that into their email. We made a whole bunch of changes as a result to make sure that we locked down certain aspects of access in the organization because of that.

Ross Young:
Yeah, and it’s really interesting because there’s not a lot that you do to verify who someone is online. They didn’t put in a driver’s license; they just created a random email or social media account. So it is very easy to create a misattributable source. I think people forget that when I meet somebody face to face, I have a better idea of who that person is. But online, you don’t know if this is a 40-year-old male or a 14-year-old child. It could be anything they signed up for and filled those credentials out as.

Manoj Tandon:
You’re absolutely right. That brings up a question here. When this kind of intelligence gathering is going on, we look at organizations — especially the ones that you’ve worked for — and from a compliance perspective, these guys have probably checked every box in the book. But they still end up getting breached. There doesn’t necessarily seem to be a correlation between being compliant and having a good multilayered cybersecurity program in place. Or am I reading that wrong?

Ross Young:
Let’s think about compliance and what it actually means and where it falls short. At the end of the day, you probably have something that says, “We’re going to map to a cybersecurity framework,” and let’s just say you use NIST CSF or ISO 27000. Then it’s going to say, “Here are the 15 different domains you have to do with the 500 controls that need to be there.”

Then you have auditors and regulators who come knock on your door and say, “Looks like control number 217 you haven’t implemented to the fullest extent as we would see is reasonable.” So you’ll get a finding on that, and then you’ll have work to do.

The problem is there’s no focus that says, “Let’s start with the basics.” We need to learn how to crawl before we can walk and know how to run. You can think about this in the CIS Top 20, where they say the number one basic is you need a software inventory, and after that you need an asset or vulnerability management program.

If you don’t have those two basics, it doesn’t really matter that you have pen tests. But what an audit and compliance program will say is, “Oh, you’re not doing enough pen tests.” But the reality is if I don’t even have a basic inventory and I don’t have basic patching well implemented, it doesn’t really matter what I have for pen testing because I still can’t patch in 90 days. Things like that are where compliance doesn’t understand prioritization.

The other thing is compliance frameworks are written in peacetime, and the threats evolve. So when they wrote the compliance, was it written in 2018 and ransomware hadn’t been as impactful because it just really started in 2019 or 2020? Maybe they focused on the wrong things and now need an update. Maybe it’s new technologies. If you’re using RASP tools or deception technologies and they didn’t exist in 2018 or weren’t mainstream, now you’re doing compliance work instead of what really secures the organization.

Manoj Tandon:
I’m glad you said that because I think a lot of our listeners are going to find that extremely helpful. Especially in our sector, we deal a lot with SMBs. In their minds, there’s this correlation that “We’re compliant, we passed our audits, we’re good, we don’t have to worry about anything.”

Ross Young:
Yeah, there are a lot of compliant companies that get breached every day. You look at some of the top breaches in the last several years — Yahoo, Target, JPMorgan Chase, CNA. These are large, sophisticated organizations. Compliance is not working well with prioritization, and perhaps there needs to be an evolution on that whole topic.

Manoj Tandon:
That brings us to another statement I saw on a slide you had put up at an OWASP presentation: cyber is the business of revenue protection. I’d like to add to it that perhaps cyber should also be considered a means of revenue generation. Have you seen companies leverage cybersecurity or the technologies of cybersecurity to actually generate revenue and create new products and services they couldn’t do before?

Ross Young:
I think there are two pieces here where cyber can really help generate revenue for the business. A lot of times we’re viewed as a loss leader, but we also have to look at how we’re saving money from breaches that would cost even more money.

If we say, “How do we bring new money into the business?” the first thing that comes to mind for me is compliance. Let’s say I want to sell to a large healthcare organization or large bank, and I’m a software manufacturer. I build a website that does some sort of thing. It would not be unheard of for them to say, “Before we approve you, we’re going to ask you to complete a cloud security vendor questionnaire. We’re also going to require you to have a SOC 2 Type II audit or an ISO 27000 report.”

If you’ve not done those things, then you’re not going to be able to sell to certain types of customers. In that way, by having cybersecurity complete those things and show that you have good security practices, you’ve enabled the business to sell to more customers and bring more revenue into the company.

Another piece is brand reputation. Nobody wants to choose a company that is breached all the time. That sounds like a horrible nightmare for me, losing my PII. So if you can show that you’ve built up a robust security program, that can enable partnerships for the organization because they are doing due diligence during mergers and acquisitions and third-party risk assessments to make sure that this company will safeguard their data.

Manoj Tandon:
When you’re doing your own risk scoring, do you put a number against brand reputation?

Ross Young:
I don’t think we have a particular brand reputation number that I’ve seen. What I typically see is organizations will start with something like the Cloud Security Alliance CAIQ vendor assessment questionnaire and say yes or no, do they do these things. Other organizations will also look at their social media scores to see how things are trending positive or negative.

If you’ve had a cybersecurity breach, you might start to see things go very negative on Twitter and other channels when people are talking about your product. You also normally see this from an IT availability perspective. Imagine you’re Capital One or some other large top-ten bank. If people can’t get access to their money on payday Friday, they’re going to be pissed. They’ve got bills to pay. So you’re going to see that negative sentiment in social media. That’s one way you can measure some of the brand reputation.

Manoj Tandon:
That’s a really practical pointer. I want to say Target, about three years ago, published in one of their annual reports that their loss exposure was something like $350 million, and they actually cited a number for the loss in potential sales that would have occurred had the calamity not taken place. That was the first time I saw an official document say that.

Ross Young:
Yeah, and it raises the question: if customers are upset because they now have to change their credit card or worry about their data, are they going to stop coming in? That’s absolutely a real business consideration.

Manoj Tandon:
As we look at all of this, what do you think has changed in terms of the threat landscape with all of us going to remote work and accelerating our adoption of cloud?

Ross Young:
I think a couple of things are changing. The first is training. Where you may have had in-person training, now everything is remote. How interesting is remote online training? It could be really good or really bad depending on the content you’re purchasing. And do people give it the same level of attention? If I’m taking this annual required training, am I really focused on it, or do I just have it running while I’m doing something else?

The other piece is relationships. If I’m in cyber or in an IT organization, I might have gone out to lunch with my colleagues, gotten to know them better, especially if they weren’t in my line of business and I needed to influence them. Nobody really wants to have an online lunch in Zoom. So you’re not building up that same level of trust, and things become more strained.

Another thing is how CISOs and other IT folks learn from vendors. We used to go to large conferences, go through the vendor hall, and see interesting solutions. But now that it’s online, are you really interested in clicking through a lot of vendor pitches online? Probably not in the same way. So you may be missing out on new opportunities and emerging technologies that could really help secure your organization.

Manoj Tandon:
That tracks with our direct experience. We sponsored several virtual conferences this past year, and the results were very disappointing. I don’t think people want to go to a virtual vendor hall and talk to people.

Ross Young:
Exactly. In person, maybe I’m not super interested in one vendor, but I’ll go over there for swag or a conversation, and then surprisingly I may learn something useful. That’s harder to replicate online.

Manoj Tandon:
What about the complexity of cloud? You don’t just have one environment anymore. You have AWS, Azure, maybe still some on-prem. Has that not created a much greater degree of complexity in terms of managing vulnerabilities than what it was in the past?

Ross Young:
The cloud provides a lot of good benefits. I don’t want people to think cloud is a bad thing. However, I also think the cloud invites complexity.

Let’s say your organization was just running VMware and everything was on-prem. It was pretty easy to maintain that. You knew what you had. You knew the patching cadence. Maybe you weren’t perfect, but you understood your environment.

Go to the cloud and say, “Okay, we’re going to adopt Amazon.” Fine. But how many services are you using? Was it 15 two years ago? Is it 100 now? Which services has your security team actually reviewed to make sure they’re not misconfigured? That’s changing all the time.

Now think about a Configuration Management Database. Before, if I wanted to know all my internet-facing websites, I’d just look at the IP addresses and URLs being forwarded by the load balancers. But now I’ve got to look at DNS entries, S3 buckets, and a lot of different places that didn’t exist in the CMDB before. Then I have to ask: how do I know if these things are changing, and are they still active? Manual processes don’t scale.

So there’s a lot of complexity with the cloud, and then you’ve got to buy more technologies to secure what you’re doing. All that functionality is a trade-off with security.

Manoj Tandon:
We’ve also run into the notion that if I’m going to Azure, Microsoft is taking care of my security. But if they read the fine print, that’s not actually the case.

Ross Young:
Definitely. There’s a shared responsibility model. They do certain levels of security based on the service. If you buy something like Lambda, they’re doing the OS and middleware patching, but you still have all the application vulnerabilities and you still have to handle access control and identity management. If you mess those things up, bad things happen.

And it differs by service. If you’re doing an EC2 server, they’re not doing the OS or middleware patching. So if somebody doesn’t understand that, you’ll be just as unpatched as before on-prem.

Manoj Tandon:
How do you build a highly resilient software system, especially when you’re building on open source, borrowing components, and often skipping security-specific QA in the interest of speed?

Ross Young:
To me, we need to think of security vulnerabilities in three major classes.

First, vulnerabilities that come from lack of patching. If you can’t patch well enough, that’s your first issue.

Second, if you’re using any commercial or open-source tool, is it securely configured? That’s where DISA STIGs, CIS benchmarks, and secure configuration guidance come in.

Third is the unique software that you built. No patching or misconfiguration guidance is going to help you if you wrote it all yourself. In that case, your best defense is teaching people secure development principles — things like sanitizing user input, not trusting it, and understanding common attack patterns from the OWASP Top 10.

Then you create basic tests: here is a normal piece of traffic, and here is an anti-pattern. If we can automate those tests, then when we patch or update, we know if we broke something or introduced risk.

I think those key principles, plus threat modeling — what could go wrong, how are we going to know when it happens, and what are we going to do about it — are the ways we build resiliency into products.

Manoj Tandon:
Speed is the enemy of all of that, unfortunately.

Ross Young:
It definitely can be. So it comes back to: what risks am I willing to take as a business? If I can make money quickly and patch a week later, maybe that’s a good business move. But if I believe the vulnerability is likely to be exploited and it could damage my brand, probably a bad idea.

Manoj Tandon:
I want to get to the Threat Matrix that you invented. I watched your presentation and thought it was brilliant. Can you explain what the Threat and Safeguard Matrix is and some of the principles behind it?

Ross Young:
If you think about what we’re trying to do, we’re trying to lower our risk in an organization. Normally organizations start with a risk matrix or a risk register that says, “Here are all my risks; what’s the likelihood and impact?” And then they build out a risk treatment plan.

When I saw that, I saw risk treatment plans that were often very trivial and didn’t really protect the company. They’d say, “Phishing or ransomware is the biggest thing,” and then the one-line treatment plan was: train people and patch systems. That didn’t really feel right to me.

So I asked: how can we take this a level deeper?

On the left side, we list threats, because you don’t really stop the risk; you stop the threat from happening. So there’s phishing, third-party data loss, ransomware, and so on. Then on the top we use the NIST functions: Identify, Protect, Detect, Respond, and Recover.

This gives you a matrix of threats on one axis and safeguards on the other. It builds a defense-in-depth approach.

Take phishing. How would I identify all the people in my company who could be phished? Maybe I make a list of everyone who has an internet-facing account. Then I ask how do I protect against that? Maybe it’s Proofpoint or another email security solution. Maybe it’s user reporting and quarantine. Then if I can’t protect against it and the attack happens, how do I detect it? Maybe EDR or antivirus alerts. Then I move into Respond and Recover.

You continue through those five phases for each threat that is material to the organization. Doing so allows a much more in-depth risk treatment plan against each of your major threats.

Manoj Tandon:
So you would do this with every single threat that’s material to your organization.

Ross Young:
Exactly. Maybe you have 50 threats, but only five of them would cost your organization $3 million or more and materially impact financial statements. Those are the ones you take through the Threat and Safeguard Matrix to build a robust treatment plan.

The others may benefit indirectly, but it comes down to whether it’s a valuable use of your time or whether it’s a hundred-dollar loss you don’t care about.

Manoj Tandon:
And that is the precise point: worry about the major threats. You are not going to build a defense for everything.

Ross Young:
Right. I don’t have to do everything perfectly. It’s this Pareto principle of: can I do the biggest things that cause 80 percent of the damages and stop those really well? If I can, I can live with the small losses because they don’t materially impact my company.

Manoj Tandon:
Let me ask you about the X factor. When the Russians did a cyber engagement against Ukraine, there was a lot of collateral damage with American companies like Merck and FedEx. That may not have been one of their top threats, but it cost them dearly. Is there some way to account for that?

Ross Young:
At the end of the day, I think you need to understand where your adversaries are. The largest national intelligence agencies are like professional football teams, and most companies are not at that level. We’re in the Pop Warner or high school league. My ability to block Warren Sapp from getting to my quarterback is just not there.

That being said, most organizations are not largely targeted by nation-state actors. It’s the criminal groups that are trying to steal money. That’s where you need to have a robust prevention program.

I think we spend too much time trying to block nation-state actors. They’re going to have zero-days you can’t stop. They’re going to have really good tradecraft. They’re going to have a thousand people building custom exploits. And you don’t have that at most companies. So yes, it’s important, but it’s not where I would spend most of my time.

Manoj Tandon:
That is wise advice, and I’m glad someone like you said it. We’re trying to break some paradigms out there, especially in SMBs where people think, “We can defend against everything.”

Last thing, because I know we’re coming up on the hour: tell us about the things you’re involved with — podcasts, appearances, papers, books, anything coming out from you here, Ross.

Ross Young:
G. Mark Hardy and I run a podcast called CISO Tradecraft. It’s a weekly podcast that goes out every Friday, and the focus is: how do we train the next generation of cybersecurity executives?

There’s a lot of training for technical folks, but how do we build those folks who have the soft skills to win the political battles, understand strategy, sell cybersecurity across the organization, and also have enough technical understanding that they know how to defend the cloud, build secure software development programs, implement vulnerability management or AppSec programs, and lead those things?

If anybody wants to learn more, it’s free. We’re on all the major podcast providers — CISO Tradecraft.

Additionally, I’m very public on LinkedIn. It’s Ross Young. I post a lot of links there, and at least every couple of days you’ll see something from me or the CISO Tradecraft brand.

Manoj Tandon:
Ross, do you have a Twitter handle you want to share?

Ross Young:
You’ll see CISO Tradecraft there, but I’m not as active on Twitter. LinkedIn is really the place where I publish my content.

Manoj Tandon:
Fair enough. We’ll put all those links in the show notes so anyone can get to them. We appreciate you taking the time today on a Friday afternoon to join us. It was a really wonderful conversation. Thank you so much, Ross.

Ross Young:
Thank you for having me here. I appreciate it, and I appreciate all the listeners who are willing to improve their understanding of cyber.