Speaker 1: In this episode, we're going to cover a topic that
Speaker 1: all too often only gets attention when something goes horribly wrong.
Speaker 1: That is cybersecurity. And before we get into the interview,
Speaker 1: let me hit you with some facts. In the United States,
Speaker 1: the cost a company incurs in the wake of a
Speaker 1: data breach has been on the rise. According to the
Speaker 1: Ponamon Institute, costs have increased by one hundred thirty percent
Speaker 1: since two thousand and six. So a data breach that
Speaker 1: would set a company back three point five to four
Speaker 1: million dollars in two thousand and six would cost eight
Speaker 1: point one nine million dollars in twenty nineteen. A single
Speaker 1: compromised record costs one hundred and fifty dollars on average,
Speaker 1: and that's just the average. For some companies, like those
Speaker 1: in healthcare, the cost can be much higher due to
Speaker 1: the nature of the data. The report found that more
Speaker 1: than half of data breaches come as the result of
Speaker 1: a malicious attack. And one important thing to keep in
Speaker 1: mind about this report is that it was for twenty nineteen.
Speaker 1: We are in a different environment today with more potential
Speaker 1: attack vectors, and while the tricks of the trade haven't
Speaker 1: changed much over the years, the number of opportunities for
Speaker 1: attack are on the rise now. With all that in mind,
Speaker 1: I sat down virtually speaking, we were all remotely isolated,
Speaker 1: with Wendy Whitmore, VP IBM Security X Force Threat Intelligence,
Speaker 1: and Alison Ritter, program leader at IBM Security Command Center.
Speaker 1: We talked about the challenges that companies face today as
Speaker 1: our concept of the workplace is changing, and how companies
Speaker 1: can best prepare themselves for the worst day. Ever, here's
Speaker 1: our conversation. I think we can get the obvious out
Speaker 1: of the way. We can state that a priority for
Speaker 1: any business in the twenty first century needs to be
Speaker 1: on cybersecurity. That is pretty obvious. But what has become
Speaker 1: more complicated, I would think, would be this shift we're
Speaker 1: seeing now that we're in an era of let's say,
Speaker 1: momentous events where we've seen a real move to decentralization.
Speaker 1: A lot of people are working from home and that's
Speaker 1: kind of changed the nature of business. Has that impacted
Speaker 1: sort of the focus of cyber threats as well? Are
Speaker 1: we seeing changes in that realm? Wendy, yes, I would
Speaker 1: say we absolutely are. You know. The good news, though,
Speaker 1: is it hasn't shifted in terms of such new and
Speaker 1: novel types of attack techniques. But I think what's really
Speaker 1: shifted is the volume of attacks as well as the frequency,
Speaker 1: and then the attack surface. So when I say attack surface,
Speaker 1: you know what I mean is there are millions of
Speaker 1: more computers that are now connecting from remote locations into
Speaker 1: devices and applications and systems that previously were within the
Speaker 1: same network. So that gives the attackers a bigger attack
Speaker 1: surface from the external side of that, right, all these
Speaker 1: new systems that were online that are no longer behind
Speaker 1: these firewalls. But then also it opens the corporate entities
Speaker 1: to potentially more of an attack surface because of the
Speaker 1: fact that they might have overnight, you know, enabled the
Speaker 1: ability for their workers to work remotely, and perhaps they
Speaker 1: don't have the right types of authentication or enough authentication
Speaker 1: on their systems where these attackers can take advantage of,
Speaker 1: but ultimately where their users need to connect to do
Speaker 1: business and to do their work on a daily basis.
Speaker 1: And we've definitely seen issues in the past where even
Speaker 1: within these well protected systems, we can see failures. Often
Speaker 1: I argue in tech stuff that the weakest link in
Speaker 1: a company's cybersecurity process often isn't necessarily the technology It
Speaker 1: can be the implementation of that technology, but it often
Speaker 1: falls to a weak link in the the use of
Speaker 1: that technology. So user error, you could argue, I think
Speaker 1: leads to a lot of those I imagine that that
Speaker 1: this decentralized approach has created enormous opportunities to exploit that
Speaker 1: because people are having to navigate a new workspace, they're
Speaker 1: having to access systems in ways that they haven't before. That,
Speaker 1: as you say, are are a little a step outside
Speaker 1: of the immediate control of a lot of these businesses.
Speaker 1: So can you talk a bit about sort of the
Speaker 1: nature of that, Like this attack surface, what are the
Speaker 1: sort of attacks that you typically see, what's kind of
Speaker 1: the nature of it? Well, okay, so let's take that
Speaker 1: question from a couple of different angles, right. So, one
Speaker 1: is just the ability to exploit human error, which we
Speaker 1: are all going to be prone to do. Right, So,
Speaker 1: if you're looking at it from the attacker perspective, they're
Speaker 1: kind of saying, hey, great, look at this. There's all
Speaker 1: this chaos going on in the world right now. There's
Speaker 1: new ways of working. But people who are now working
Speaker 1: remotely that maybe didn't before are also doing things like
Speaker 1: checking their email more regularly and they're checking social media
Speaker 1: sources and news sources because they want to know what
Speaker 1: are the local regulations where I live, what's the current
Speaker 1: counts in terms of how many people are being infected.
Speaker 1: And so since March we have seen a six thousand
Speaker 1: percent increase in spam related to COVID nineteen. So that's
Speaker 1: coming into users directly, so maybe your personal email accounts,
Speaker 1: but it's also coming into work email accounts unfortunately. And
Speaker 1: each one of those systems that I mentioned that previously
Speaker 1: used to be inside of a network and is now
Speaker 1: not may or may not have the same types of
Speaker 1: personal protections on it, right in forms of firewalls and
Speaker 1: antivirus and endpoint detection that it had when it was
Speaker 1: on the interior of their network. And so from that perspective,
Speaker 1: human error and humans are always going to be a
Speaker 1: huge part of the attack surface, right, So we've all
Speaker 1: got that, you know, as if we don't have enough
Speaker 1: things to be concerned about right now, we're going to
Speaker 1: add that to the list. And then as the pandemic
Speaker 1: has shifted and as it continues to go on, there
Speaker 1: is obviously a huge influence on testing, on vaccine research,
Speaker 1: on the development of a vaccine and processes and procedures
Speaker 1: that are all going to make all of us more secure,
Speaker 1: and so now you not only have those. When we
Speaker 1: talk about spam, we're often talking about cyber criminals, right
Speaker 1: who are financially motivated looking to steal information, maybe looking
Speaker 1: to conduct ransomware attacks. But when we shift over to
Speaker 1: the vaccine research and the testing, we're then really looking
Speaker 1: at nation state actors who are looking to capitalize on
Speaker 1: the theft of intellectual property and make sure that they
Speaker 1: can protect their citizens and potentially turn that research into
Speaker 1: financial gain as well. So it's a pretty tumultuous environment
Speaker 1: right now. I mentioned that the attacks themselves are not
Speaker 1: necessarily all that new and novel or exciting, but the
Speaker 1: volume of them, and combined with the increase of tax
Speaker 1: surface as well as just the general day to day chaos,
Speaker 1: has made it a pretty interesting environment to say the least. Yes,
Speaker 1: I think interesting is a great word for it. It's
Speaker 1: one of those nice catch alls in your work, Wendy,
Speaker 1: have you noticed any particular sectors or industries that are
Speaker 1: particularly being targeted by cyber attacks in this era? Right now,
Speaker 1: we're absolutely concerned about critical infrastructure, and when I say
Speaker 1: that though, that's kind of a big list, right of organizations.
Speaker 1: So that's everything from the obvious like hospitals who are
Speaker 1: providing healthcare to people who are sick. It's the medical insures,
Speaker 1: it's the whole infrastructure and ecosystem on the medical side.
Speaker 1: It's also financial services industry, and they're supporting infrastructure and
Speaker 1: supply chain as well as energy and oil and gas
Speaker 1: and really any of these organizations. It could also be
Speaker 1: food supply chain, right, All of those things that we
Speaker 1: need now to work perfectly more than ever are also
Speaker 1: potentially at risk. And so what we look at and
Speaker 1: what we're concerned about most our ransomware attacks to those
Speaker 1: type of organizations. We know the continual targeting and theft
Speaker 1: of intellectual property will go on as it always has.
Speaker 1: But if we can stop some of these major ransomware
Speaker 1: breaches from being effective and from stopping business for our clients,
Speaker 1: that's really what we're concerned about helping out with. I
Speaker 1: think one of the things we've learned we being sort
Speaker 1: of the layman I include myself in this in the
Speaker 1: wake of this pandemic, is how incredibly interconnected all these
Speaker 1: different pieces are, and if you do put yourself in
Speaker 1: the mind of someone who is attempting to exploit the
Speaker 1: the chaos. Then you can think, well, then you want
Speaker 1: to target whatever links appear to be the most vulnerable
Speaker 1: at any given time. And this kind of brings us
Speaker 1: over into something that I wanted to speak with Alison about. Alison,
Speaker 1: you have a pretty cool job in that you help
Speaker 1: architects scenarios for companies so that they can have a
Speaker 1: simulated cyber threat attack sort of a worse Day ever scenario.
Speaker 1: Can you talk a little bit about what that's all
Speaker 1: about and what goes into planning this sort of thing. Yeah,
Speaker 1: So having a well tested and really thought out plan
Speaker 1: is key to any incident response piece that you'd be
Speaker 1: working on with in a company. So where I work
Speaker 1: is really working on creating custom scenarios for organizations to
Speaker 1: go through and handle. Really a day in the life
Speaker 1: of a cybersecurity attack, something that would go on. It
Speaker 1: is really, like you said, your worst day that could
Speaker 1: possibly happen within an organization. A plan is really only
Speaker 1: part of the solution, So you also need to find
Speaker 1: out if your company is ready and able to execute
Speaker 1: and work through that plan. And that's where my team
Speaker 1: comes in. With helping to test out that plan within
Speaker 1: your organization. We run a fully immersive and gamified cyber
Speaker 1: range as part of IBM Security Command Centers. Within the
Speaker 1: command centers, we test and train companies in order to
Speaker 1: practice their response to a cybersecurity attack. Now, when I
Speaker 1: say test, it's not just reading through your plan and
Speaker 1: answering questions. We put your plan into action by throwing
Speaker 1: your entire response into a full on simulation of a
Speaker 1: cyber attack. The most effective response plans that we found
Speaker 1: are really tested and rehearsed multiple times through different types
Speaker 1: of attack scenarios. So, for example, you could be testing
Speaker 1: a ransomware response, DIDOS attack in threats. All of these
Speaker 1: areas are important to test and train when dealing and
Speaker 1: handling a cyber attack. And you know a lot of
Speaker 1: people think that these are technical responses, that this is
Speaker 1: something that you know, it's really for your security operation centers,
Speaker 1: your IT areas, but actually, as cyber response plans are
Speaker 1: best executed by the whole of business response, So dealing
Speaker 1: with individuals from human resources, communications, finance, legal, all of
Speaker 1: those individuals come into play when handling the cyber attack.
Speaker 1: So we work with all of those within the cyber range.
Speaker 1: That's absolutely fascinating. And as you point out, like I
Speaker 1: think a lot of us think of cyber attacks and
Speaker 1: the response to them in very Hollywood terms, just because
Speaker 1: the way the media tends to portray this sort of stuff,
Speaker 1: where you have the people just furiously typing, maybe two
Speaker 1: people typing on the same keyboard, which we all know
Speaker 1: works incredibly well, that clearly is not an accurate representation
Speaker 1: of what actually happens. And I'm sure there are a
Speaker 1: lot of people out there listening who are working in
Speaker 1: their IT departments, perhaps they are leaders in their IT departments,
Speaker 1: and maybe they're thinking about this for the first time.
Speaker 1: So do you have any thoughts about even just the
Speaker 1: process of getting started and building a response plan? How
Speaker 1: does someone go about doing that? Yeah, that's a great question.
Speaker 1: I think a lot of organizations have, and I think
Speaker 1: at times they can feel overwhelmed on where do I start?
Speaker 1: You know, I don't know how to get started. It's
Speaker 1: this huge thing, and you know, to be honest, what
Speaker 1: we see is there's still three quarters of organizations that
Speaker 1: don't actually have a plan in place, so no incident
Speaker 1: ave response plan, no playbooks on specifically, how do we
Speaker 1: respond to a certain kind of attack. So first and foremost,
Speaker 1: put it on paper, right, start somewhere, Start with names
Speaker 1: of your personnel, their contact information, their email addresses, and
Speaker 1: their roles, and literally start there, and then from there
Speaker 1: start looking to build out different components right of the organization,
Speaker 1: so cross functional departments, who they're, who those leaders are,
Speaker 1: what applications are responsible for, and really getting an understanding
Speaker 1: of what roles and responsibilities different team members are going
Speaker 1: to play. Then, as we look at organizations that are
Speaker 1: more advanced, what we would encourage them to do is
Speaker 1: certainly to have specific playbooks for certain activities, right, so
Speaker 1: a ransomware playbook, a thective intellectual property playbook, any type
Speaker 1: of things along those lines. And then once you have
Speaker 1: those in place, then we look at testing them. So
Speaker 1: increasing the frequency of testing them. If you can be
Speaker 1: testing quarterly at least one of those scenarios, your organization
Speaker 1: is going to then identify where the gaps are. And
Speaker 1: if you can do that in advance of an attack
Speaker 1: or doing it for you, you're going to be much
Speaker 1: better prepared to respond effectively to an attack. I imagine
Speaker 1: part of that also comes into how you communicate this
Speaker 1: Both internally and then externally. We've probably I'm sure we
Speaker 1: could all list off examples in the past of companies
Speaker 1: that have had a data breach, for example, and kept
Speaker 1: that quiet for maybe up to a year before news breaks.
Speaker 1: And honestly, I feel that the longer that goes, the
Speaker 1: deeper the sense of loss of trust tends to follow.
Speaker 1: There's almost a sense of betrayal among the various stakeholders,
Speaker 1: whether it's a customer or a client or whatever. So
Speaker 1: is communication a part of that playbook? Is that something
Speaker 1: that you help develop as well? So communication is absolutely,
Speaker 1: I would argue the most important part of the whole
Speaker 1: thing today, and I'll let Allison definitely talk more about
Speaker 1: how we train that in the range. But what we
Speaker 1: talk to our clients about in these situations is that
Speaker 1: there are components that you can do in advance. So
Speaker 1: things like having what we call a holding statement, which
Speaker 1: is some sort of a statement that if press breaks
Speaker 1: and you're not potentially ready to share information that you've
Speaker 1: got a canned statement prepared and ready to go. That
Speaker 1: is going to put you in position where it appears
Speaker 1: that the organization is on top of things that they're
Speaker 1: communicating with their clients and that they are investigating the situation.
Speaker 1: In so many of these cases today, it's not just
Speaker 1: about what the response was to the event, but it's
Speaker 1: the communication of it and the public's perception of that
Speaker 1: communication as well as your customers and clients' perception of
Speaker 1: that that can cause reputational damage. Or on the plus side,
Speaker 1: even in the wake of some of the worst breaches
Speaker 1: we've seen in history, we've seen leaders who have come
Speaker 1: out and done a fantastic job of communicating about it,
Speaker 1: and they've actually built even more goodwill and trust in
Speaker 1: their client base as a result of one of these breaches.
Speaker 1: That's something that Allison and her team share on a
Speaker 1: daily basis within the range. So Alison, I'd love to
Speaker 1: hear your perspective on it. I'd say a great deal
Speaker 1: about my area is working on how we get the
Speaker 1: attendees to engage within the scenarios, right breaking you away
Speaker 1: from your everyday life and now simulating something a cyber
Speaker 1: attack that could be possibly simulating your worst day in
Speaker 1: that organization. So something that you know we think about
Speaker 1: when creating these we're really testing you and training you
Speaker 1: to emulate these business and security issues that would be
Speaker 1: taking place and all of the stories that we work on,
Speaker 1: and these experiences are based upon real life incidents and
Speaker 1: stories that are from the field and kind of like
Speaker 1: top headlines that we're seeing. So in order to create
Speaker 1: these simulations, we use a method called really experienced design
Speaker 1: that creates real life situations that not only pull from
Speaker 1: real life stories, but also feelings such as like panic
Speaker 1: and uncertainty. And these areas are really kind of this
Speaker 1: experimental learning where in order to fully learn what you
Speaker 1: need to do, you have to experience it firsthand. So
Speaker 1: we want to drop you into a scenario and have
Speaker 1: you go through that so you know, for example, something
Speaker 1: that you might be dealing with, like Wendy said, is
Speaker 1: going through a holding statement, having to actually put that out,
Speaker 1: test you and put you firsthand into what we call
Speaker 1: the hot seat. It's a live broadcast studio where we
Speaker 1: drop you in full green screen lights and we turn
Speaker 1: that camera on and ask you questions from a real reporter.
Speaker 1: It's up to you to answer and how do you
Speaker 1: deal with that? You know, many people find out once
Speaker 1: they go through I need to go back and take
Speaker 1: some time to learn how do you answer some of
Speaker 1: these questions? How are ways that you would go through that,
Speaker 1: because again, the brand and reputation of your company is really,
Speaker 1: you know, a big piece of this, so keeping that
Speaker 1: up is something that we work on. And all of
Speaker 1: this comes through these kind of emulating and you know,
Speaker 1: simulating these scenario pieces. Allison, one of the things that
Speaker 1: you and I share is a background in theater and
Speaker 1: as someone who is in theater and who has participated
Speaker 1: in various theatrical events where you are simulating something. To me,
Speaker 1: one of the magic parts of theater is that people
Speaker 1: actually will experience those reactions even in a simulation. You know,
Speaker 1: you have removed yourself from any real danger, you are
Speaker 1: not in a legit dangerous situation, but your your body
Speaker 1: and your mind still goes through those reactions. Do you
Speaker 1: witness that in these simulations. Do you actually see people
Speaker 1: having those kind of emotional responses and that's a big
Speaker 1: part of learning how to respond appropriately when this happens
Speaker 1: in real life? Yes, exactly, You're spot on having that
Speaker 1: we you know, the whole piece is really creating that
Speaker 1: adrenaline rush, seeing your heart rate go up, you know,
Speaker 1: as soon as you see your headline, you know, splashed
Speaker 1: across you know, front page and in the news. That's
Speaker 1: creating something really for you internally, and so what we're
Speaker 1: doing is creating it in a safe space. Right, this
Speaker 1: is a space where you know, we want you to
Speaker 1: fail in here versus out in the real world. We
Speaker 1: want you to understand what you would need to do
Speaker 1: if you did have something that took place and now
Speaker 1: you need to respond to that. So in order to
Speaker 1: do that, we use lighting, sound design, interactive apps to
Speaker 1: create and evoke this emotion. You know, we have an
Speaker 1: individual come through and they said it almost created like
Speaker 1: a level of PTSD from a previous tyber attack. They
Speaker 1: came through and said like, wow, this is like really,
Speaker 1: I know that I'm in a simulation, but my heart
Speaker 1: and mind sort of take me to this other place
Speaker 1: where now I'm really feeling what it's like. And that's
Speaker 1: the whole thing of practicing and having this muscle memory
Speaker 1: of going through it. Right, you're just rehearsing and rehearsing
Speaker 1: and understanding, and like Wendy said, you know, doing these
Speaker 1: every quarter can really help for you to really understand
Speaker 1: what you would need to do in order to deal
Speaker 1: with that, and that pressure might then go down because
Speaker 1: now you know how you work with you know, the
Speaker 1: attack and the next steps of what you need to
Speaker 1: do to process it. Yes, I think it's much better
Speaker 1: to have that visceral reaction when you're in a practice
Speaker 1: stage than to have it when you're having to deal
Speaker 1: with a real world intrusion or a data breach or
Speaker 1: something along those lines. You definitely want to be able
Speaker 1: to look back on that training you've had and rely
Speaker 1: upon that muscle memory, as you say, rather than have
Speaker 1: to to soldier on and put that response plan to
Speaker 1: test without ever having actually done it. It's that's I
Speaker 1: would love to actually be a fly on the wall
Speaker 1: on one of these It sounds truly amazing to me,
Speaker 1: and and the sort of stuff that I've seen in
Speaker 1: in like hacker movies, but never thought that anyone actually
Speaker 1: did it, So that's phenomenal. Wendy, can you talk a
Speaker 1: little bit. Are there any common traits that you see
Speaker 1: among companies that are really good at recovering from these
Speaker 1: sort of of threats of these sort of attacks. Are
Speaker 1: there certain things that you can identify and say these
Speaker 1: are our markers sort of best practices that are common
Speaker 1: across different industries. Well, I think, first and foremost it's
Speaker 1: because they have access to an incident response team. Right, So,
Speaker 1: whether that's an internal team or whether they choose to
Speaker 1: use and leverage an external team. The reason that you
Speaker 1: want people there is actually right along the lines of
Speaker 1: what you two are talking about, which is you want
Speaker 1: people who have had a lot of practice in this,
Speaker 1: right who have responded to events. I will say, you know,
Speaker 1: I've been doing this almost twenty years, and I still
Speaker 1: when I get the first phone call from a client
Speaker 1: it's a new client that we know there's a situation
Speaker 1: going on, I get the adrenaline rush, you know, because
Speaker 1: I want to know, Okay, what are the details that
Speaker 1: are going to share with me? Who's the potential attacker?
Speaker 1: What do we need to do? In my mind is
Speaker 1: racing of all of these different things and actions we
Speaker 1: need to take. But because I've been through it so
Speaker 1: many times, I'm able to then really harness that and
Speaker 1: channel it into a productive, credible discussion. Right, here's what
Speaker 1: we need to do, Here's the actions we need to take.
Speaker 1: Here the things not to do right now, here's the
Speaker 1: evidence to preserve. So the more that organizations have access
Speaker 1: to personnel like that and those skills, the more successful
Speaker 1: they're going to be because they're going to reduce time
Speaker 1: that it takes to get answers. And when you talk about,
Speaker 1: you know the age old verbiage that time is money,
Speaker 1: that is extremely true in attacks because the more time
Speaker 1: that you can save, right, or the less time you
Speaker 1: take to get answers, the more money you're ultimately going
Speaker 1: to save because you're exposing your organization to less risk
Speaker 1: throughout that entire time. And so, first and foremost, if
Speaker 1: we want to look at who's successful, it's they have
Speaker 1: a team of people who can respond to the incident.
Speaker 1: That said, then those team of people also have things
Speaker 1: like technology in place that gives them the visibility to
Speaker 1: answer questions. Because if you can answer questions really quickly, again,
Speaker 1: then we can make decisions for the business. Whether that's
Speaker 1: taking a system offline, whether it's taking an entire part
Speaker 1: of the network offline because of the risk that is exposed.
Speaker 1: Those are all decisions we can make. So the quicker
Speaker 1: that we can do that based on visibility, the better
Speaker 1: I like that. That answer goes back to what you
Speaker 1: were saying earlier, Wendy, about that first step of building
Speaker 1: a response at all involves getting that list of names
Speaker 1: and their contact information and the roles that they play
Speaker 1: drives home that when you have something like this happen,
Speaker 1: obviously your first response is oh no, and your second
Speaker 1: response is what do I do? And having that list
Speaker 1: of people who have very specific job roles and ways
Speaker 1: of reacting to this is absolutely of critical importance. You
Speaker 1: reduce the amount of time it takes to even know
Speaker 1: who you're going to turn to. It's one of the
Speaker 1: worst feelings in the world is receiving information and literally
Speaker 1: not knowing where you need to go in order to
Speaker 1: resolve it. So having that in place, I think, as
Speaker 1: you point out, is absolutely critical. Alison, do you have
Speaker 1: any specific sort of lessons that the companies tend to
Speaker 1: learn in this simulation, apart from the fact that a
Speaker 1: simulation can be almost as terrifying as the real thing. Yeah,
Speaker 1: I mean one of them, i'd say, is just a
Speaker 1: lot of organizations realize that they need to test their
Speaker 1: plan and go through it. That's i'd say, like the
Speaker 1: first piece. But one of the things that you were
Speaker 1: just mentioning about, you know, the types of people that
Speaker 1: go through and the response and pieces like that. One
Speaker 1: thing that we've found is those with military or first
Speaker 1: responder training have responded very well within these types of
Speaker 1: response challenges, you know. And a thing I think we
Speaker 1: look at from that is those are the ones that
Speaker 1: are really trained in incidents that have taken place for them,
Speaker 1: and they're not really shying away or pushing it away
Speaker 1: onto someone else's issue. They're taking it on and leaning
Speaker 1: into that situation and really you know, moving forward quickly
Speaker 1: with it. We tend to see those are the ones
Speaker 1: that get up, answer the phone and handle the situation.
Speaker 1: So taking kind of a lesson from that, you know.
Speaker 1: And another piece that we'd say is just that many
Speaker 1: learn to understand that cybersecurity is a whole of business response.
Speaker 1: It's not just that it. We need to see everyone
Speaker 1: within your organization taking part and understanding that there's now
Speaker 1: a cybersecurity culture that needs to go you know, take
Speaker 1: place and go within you know. Another thing is looking
Speaker 1: at it from a you know, a top down approach,
Speaker 1: looking at cybersecurity awareness, this idea of good cybersecurity culture
Speaker 1: that comes from the top of your organization and can
Speaker 1: trickle down within the rest and just making sure that
Speaker 1: your teams have are empowered to take steps to immediately
Speaker 1: react without hesitation right, giving them that power to say,
Speaker 1: you know what you need to do. You've practiced and rehearse,
Speaker 1: and these are your steps that you would need to
Speaker 1: take out of curiosity, Alison, do you have a particular
Speaker 1: type of threat that you've seen where the response has
Speaker 1: been frequently lacking? Is there a place that people really
Speaker 1: need to focus on? I guess is what I'm trying
Speaker 1: to get at. Yeah, I would say a big piece
Speaker 1: that you know where people lack is the response to
Speaker 1: media and communications. That side of it isn't always thought about, right. Yeah,
Speaker 1: you're dealing with the technical you have teams that are
Speaker 1: trained in that, but then when it comes to putting
Speaker 1: out that holding statement, even communicating internally to your teams
Speaker 1: so that they're not sending out messages or putting things
Speaker 1: out you know they're wondering what's going on. You can
Speaker 1: put these sort of hold statements internally within your organization.
Speaker 1: And something that we also practice is called a leader's intent,
Speaker 1: where we have the team write out a leader's intent
Speaker 1: for your entire organization. And this gives you like a
Speaker 1: purpose and an end state of what you would need
Speaker 1: to do. If there was some sort of piece that
Speaker 1: took place, So it gives them everyone in your company
Speaker 1: that right and that kind of goal of what they
Speaker 1: would need to do. As a member of the media,
Speaker 1: I can certainly understand how we can be intimidating. So,
Speaker 1: I mean, our job is to spread information and sometimes
Speaker 1: you really need to contain it for the moment so
Speaker 1: that you can do the right thing. So I certainly
Speaker 1: can appreciate that from my perspective. Oh, yes, we use
Speaker 1: you as the bad guys all the time. I mean,
Speaker 1: it's fine, it's fine, wen They your team recently released
Speaker 1: a threat Landscape report on cloud environments. Now, obviously, over
Speaker 1: the last two decades, we have seen an incredible migration
Speaker 1: to cloud services. There's so many companies out there that
Speaker 1: are dependent upon either a hybrid cloud strategy or a
Speaker 1: lot have even moved almost all of their processes to
Speaker 1: the cloud. What were some of the things that you
Speaker 1: learned in that and that you released in that threat
Speaker 1: landscape report. Yeah, you know, I think they're pretty consistent
Speaker 1: with the things that we've seen in the field with
Speaker 1: our investigations. And you know I mentioned earlier about time
Speaker 1: being money and not being never truer than in the
Speaker 1: case of a data breach and data breaches in the
Speaker 1: cloud are not any different actually, right, They are primarily
Speaker 1: motivated around financial gain. So that's really the most common
Speaker 1: motivation for the threat actors that we see targeting those
Speaker 1: and you know, I think the it relates primarily to
Speaker 1: data theft, right, So data that's hosted in the cloud.
Speaker 1: One of the things we consistently see is that organizations
Speaker 1: who move data to the cloud will kind of have
Speaker 1: this false idea that you know, Okay, well, now it's
Speaker 1: someone else's responsibility and so I'm kind of absolved from
Speaker 1: the responsibility of protecting that data. And unfortunately that's not
Speaker 1: the case, right, And so we see a huge amount
Speaker 1: of misconfigurations. About forty three percent of attacks that we
Speaker 1: see in the clouds in the cloud, excuse me, our
Speaker 1: result of misconfigurations of that And you know, oftentimes, again
Speaker 1: it's kind of unclear as to whether it's the hosting
Speaker 1: provider or the actual data owner who felt like, you know,
Speaker 1: maybe they were pointing fingers about who was actually responsible
Speaker 1: for those attacks. But you know, I think the reality
Speaker 1: is that we are going to continue to see more
Speaker 1: and more of those types of attacks as more organizations
Speaker 1: move to hosting data in the cloud. That to me
Speaker 1: is incredibly interesting Wendy, because I the first thing I
Speaker 1: think of when I think of the possibility of moving
Speaker 1: things to the cloud is a reticence of letting go
Speaker 1: of something in that I think about the old days
Speaker 1: when everything is self contained. But it is interesting to
Speaker 1: think of it from the other perspective of the idea
Speaker 1: that you're absolving yourself of responsibility by putting it onto
Speaker 1: potentially a cloud provider. And in either case it's a
Speaker 1: destructive way of thinking, and I think it does point
Speaker 1: back to your earlier point about this is another example
Speaker 1: of how a response plan is absolutely critical to any
Speaker 1: business that whether you are overseeing your systems internally or
Speaker 1: whether it's on the cloud, you have to have that
Speaker 1: plan in place. It isn't enough to just say, oh,
Speaker 1: well it's in safe hands. I can just brush my
Speaker 1: hands and walk the other way and never have to worry. So, Allison,
Speaker 1: does your team work on creating scenarios that involve things
Speaker 1: like cloud environments. Yes, very much. So. You know that's
Speaker 1: a big area. You know that we're seeing companies go towards,
Speaker 1: and that's something that we're highlighting and working on within
Speaker 1: the range. Yes, we have organizations that test and train
Speaker 1: within the space. And something that we look at is
Speaker 1: we put you in this a fictitious company right that
Speaker 1: you're going through, and we put it now as a
Speaker 1: cloud first environment, and we give participants best practices on
Speaker 1: manning managing those cloud attacks and the response to them. So,
Speaker 1: you know, we look at the you know, migrating to
Speaker 1: the cloud, which introduces new security risks and different challenges,
Speaker 1: and we take participants through really a fictitious multi cloud
Speaker 1: organization that is about to experience a cyber attack and
Speaker 1: what you would need to do in order to support that,
Speaker 1: What do you need to do in order to kind
Speaker 1: of stop and you know, what are those responses to
Speaker 1: dealing with it now that it's in the cloud, and
Speaker 1: this gives you still a chance to deal with it
Speaker 1: protecting your customers, your employees, your brand, but all of
Speaker 1: that within the cloud, and how your organization would be
Speaker 1: handling it with these cloud environments. Out of curiosity, do
Speaker 1: you have members of your team who are essentially filling
Speaker 1: in the role of people who are working for this
Speaker 1: fictional cloud service provider and do they have to interact
Speaker 1: with the people going through the simulation. Yeah, so we
Speaker 1: have they're kind of like our actors in a way,
Speaker 1: but they're trained experts in cloud, cloud resources, open shift,
Speaker 1: all of this sort of area, you know, when you're
Speaker 1: dealing with it. So we definitely are you know, have
Speaker 1: these experts that are there and they're interacting and putting
Speaker 1: in those pieces. So when you know a client or
Speaker 1: an attendee in that is asking questions and going through it,
Speaker 1: there are sort of these real life in a way
Speaker 1: actors that come in and ask these questions and have
Speaker 1: these real life scenarios that would come out and play through.
Speaker 1: That's fascinating. So but it is it's incredibly valuable, right
Speaker 1: because other than that, you would just have people talking
Speaker 1: through their response plan and if there's no one that
Speaker 1: they can bounce off of, and if the control is
Speaker 1: outside of the company, it really would be a frustrating experience.
Speaker 1: So having that where you have that extra piece in
Speaker 1: there and you can figure out what the resolution is
Speaker 1: to one stop the attack and then to move on
Speaker 1: to your next phase, that's absolutely important and critical. Obviously,
Speaker 1: I have another question for for really for both of you,
Speaker 1: but Wendy, maybe you can take first crack at this.
Speaker 1: This is where we put on prognosticator hats. It's where
Speaker 1: we look into the future, which we all know is dangerous.
Speaker 1: And yes, and often we have to we have to
Speaker 1: couch things, which is perfectly fine. But how do you
Speaker 1: see the cyber landscape evolving now, especially given this decentralized approach,
Speaker 1: which I imagine for a lot of companies is going
Speaker 1: to become the normal mode of operations, even once we
Speaker 1: emerge from the pandemic. Right, you know, I think we're
Speaker 1: going to see write a prolonged period of a little
Speaker 1: bit of instability. Right, how do people work from home?
Speaker 1: Does part of the workforce work from home? Park go
Speaker 1: back to the office. There's going to be just a
Speaker 1: continued kind of dynamic shift, and I think that's going
Speaker 1: to make a lot of people uneasy. Right, So from
Speaker 1: that perspective, I think we're going to continue to see
Speaker 1: attackers take advantage of that. I think are some things
Speaker 1: that organizations can do to be much more successful at that,
Speaker 1: things like implementing multi factor authentication for remotely accessible devices
Speaker 1: and systems and applications. That's going to be critical. Right,
Speaker 1: regardless of whom you have working in an office or not,
Speaker 1: you'll be able to then secure that data a little
Speaker 1: bit more because attackers will continue to take advantage of that,
Speaker 1: I think will continue to see more online scams. As
Speaker 1: the election season within the US is coming up, you're
Speaker 1: going to continue to see more related to that. And
Speaker 1: then once vaccines are available and once more testing is
Speaker 1: readily available, we're going to continue to see a lot
Speaker 1: more scams related to that. So individual users will need
Speaker 1: to really, I think, learn to protect themselves a little
Speaker 1: bit more effectively. And that multi factor authentication I mentioned
Speaker 1: for example, is also great for you to implement personally,
Speaker 1: So things like on your online banking accounts, on your
Speaker 1: personal email accounts, your social media accounts, having multi factor
Speaker 1: authentication most of those now most applications have that built
Speaker 1: in that people can take advantage of. And then also
Speaker 1: doing things like having a password manager, so using that
Speaker 1: there's lots of free ones you can use, so that
Speaker 1: one you don't have to memorize your passwords and that
Speaker 1: you're not using the same ones over and over again.
Speaker 1: We know that the number of breaches is going to
Speaker 1: continue to increase, the number of compromise networks and systems
Speaker 1: and accounts will continue to increase, and at this point,
Speaker 1: over sixty percent of the breaches that we see are
Speaker 1: leveraging data that's already been stolen somewhere else or a
Speaker 1: vulnerability that's already been exploited and is out there and
Speaker 1: known to the public. So if we can all do
Speaker 1: our best to kind of take our part and our
Speaker 1: actions that are going to help secure our own environments,
Speaker 1: then the better off that that's going to translate to
Speaker 1: our corporate environments and just to overall security. Yeah, I
Speaker 1: can't tell you how many times I've rolled my eyes
Speaker 1: at reports of a data breach where passwords were shared,
Speaker 1: and you see that the most common passwords are things
Speaker 1: like password or one, two, three, four, five six or whatever,
Speaker 1: or password one so that you have the one numeral
Speaker 1: in there. And I think a big part of cybersecurity
Speaker 1: from an individual standpoint, and please correct me if I
Speaker 1: am off base, because you're the experts, but I think
Speaker 1: a large part of it is the idea of you're
Speaker 1: trying to just reduce the number of opportunities an attacker
Speaker 1: has to take advantage of you, and the more opportunities
Speaker 1: you eliminate, the less valuable you are to the typical attacker. Because,
Speaker 1: as you had mentioned, earlier. Time is money, even on
Speaker 1: the attack side, and an attacker is far more likely
Speaker 1: to go after a target that they view as being
Speaker 1: vulnerable than to waste time on targets are that appear
Speaker 1: to be more savvy from a security perspective? Am I
Speaker 1: more or less on track there? I think you're ready
Speaker 1: to be an incident response consultant because that's one of
Speaker 1: the things that we say. Basically taking the language you
Speaker 1: just use, shifting that to a corporate environment. The fundamentals are,
Speaker 1: we want to increase the amount of time it takes
Speaker 1: for the attacker to meet their objective right to accomplish
Speaker 1: their goal, whatever that may be, to steal information, to
Speaker 1: break in, etc. So we increase the time it takes
Speaker 1: them to do it, and we decrease the time it
Speaker 1: takes your organization or the good guys right to be
Speaker 1: able to identify it. So if we can marry those
Speaker 1: two together, then we tend to make your organization less
Speaker 1: of a target than other locations because the attackers are
Speaker 1: going to have to work harder, they're going to use
Speaker 1: more resources, they're going to have to spend more money
Speaker 1: to get the job done, and more than likely they're
Speaker 1: going to move to somewhere else where they can accomplish
Speaker 1: that much faster. I'm glad I got something right. Well,
Speaker 1: let me ask this also, Are there are there tips
Speaker 1: or strategies that you think companies and individuals should be
Speaker 1: following beyond making a response plan. I think one of
Speaker 1: the big ones is finding a way to unicate policies
Speaker 1: and processes and good security behaviors to people in a
Speaker 1: way that is really instructive. I know that almost every
Speaker 1: company out there now has the mandatory video or presentation
Speaker 1: on security. What do you think are things that really
Speaker 1: people need to focus on, our companies need to focus
Speaker 1: on in general to help improve security overall. Well, something
Speaker 1: Allison I'm sure is going to talk further about is
Speaker 1: about building a security culture right and building that into
Speaker 1: really the fabric of your operations. I think and tell
Speaker 1: people at all levels of an organization feel like security
Speaker 1: is their responsibility and they're empowered to make decisions on it.
Speaker 1: Until they do that, an organization is always going to
Speaker 1: struggle right to make decisions effectively. So that's a huge
Speaker 1: part of it. The communications, having them planned and prepared
Speaker 1: in advance so that you're ready to go once an
Speaker 1: attack actually occurs is also critical, and then shifting to
Speaker 1: some of the more technical components, things like I mentioned
Speaker 1: multi factor authentication on remote devices. That's absolutely critical, but
Speaker 1: also making sure that you have backups of your most
Speaker 1: sensitive data and that you've tested those backups. We have
Speaker 1: an organization we're working with right now, major ransomware outbreak.
Speaker 1: They had all the best technology in place and all
Speaker 1: of the best procedures for having backups, making sure they
Speaker 1: were offline and not connected to the network at all times,
Speaker 1: but they had never tested them. And whence they did,
Speaker 1: they realized they couldn't actually restore them because the data
Speaker 1: wasn't replicating correctly. So, you know, we talk about testing
Speaker 1: our incident response plan, also test your most sensitive data
Speaker 1: in those backups, because if you have access to that
Speaker 1: and you are attacked and you are the victim of
Speaker 1: a ransomware attack, you don't even have to engage in
Speaker 1: any of those discussions. You can say, Okay, it's going
Speaker 1: to take us six hours, twelve hours, twenty four, whatever
Speaker 1: the case may be, to get access to that data.
Speaker 1: But we have it, and it's just a matter of
Speaker 1: getting access to it and restoring it and then certainly
Speaker 1: securing the ability for the attackers to successfully do that. Again,
Speaker 1: we want to prevent that as well. I feel like
Speaker 1: a lot of those lessons can be applied not just
Speaker 1: in the corporate culture, but in our personal day to
Speaker 1: day operations as well. This thought of taking security seriously,
Speaker 1: it's interesting to me because I'm old enough to remember
Speaker 1: when no one wanted to use the internet to buy
Speaker 1: anything because everyone was worried about security. They're thinking, I
Speaker 1: don't want to put the numbers that are on my
Speaker 1: card onto this computer thing and have it sent out
Speaker 1: to everybody. And oddly enough, now we're in a world
Speaker 1: where a lot of things that would drastically improve security
Speaker 1: are either an afterthought for some people. They never consider it,
Speaker 1: or they think of it as an annoyance. I know
Speaker 1: people who find multi factor authentication to be irritated, Oh
Speaker 1: I have to type in my that six digit code
Speaker 1: that just got sent to my smartphone. And explaining to
Speaker 1: them that this is a way in order to make
Speaker 1: it harder for an attacker to find that exploit, whether
Speaker 1: it's in a company or it's in your personal information.
Speaker 1: I think that is incredibly valuable, and I want to
Speaker 1: see that culture adopted at large, not just in companies
Speaker 1: but beyond as well, Alison, any other little tips or
Speaker 1: tricks or any any fun ways to terrify people that
Speaker 1: you would like to share before we wrap up. Yeah,
Speaker 1: I mean just you know, for my area, it's where
Speaker 1: can we get you? What are those things we like
Speaker 1: to almost think really like a hacker in a way,
Speaker 1: and what are those areas that we can take advantage
Speaker 1: of and then show you what those are? And that's
Speaker 1: really what we're you know, working on within that. But
Speaker 1: you know, like when you said all of these areas
Speaker 1: to you know, to stay cyber safe, working on that
Speaker 1: as you know, a security culture, even having those security
Speaker 1: culture pieces at homes, staying cyber safe at home with
Speaker 1: your family and kids, that can kind of just penetrate
Speaker 1: that within your you know, entire self and bring that
Speaker 1: into your organization. I'd say, you know, those are areas
Speaker 1: and just practice, practice, practice, keep those plans going, keep
Speaker 1: going with those tests, you know, emulating those experiences and
Speaker 1: making sure that you're really taking those plans into action.
Speaker 1: Out of curiosity, Allison, does your team look at a
Speaker 1: response plan in advance and then look to see if
Speaker 1: there are any potential holes in that response plan? So
Speaker 1: that you can demonstrate that this is something that they
Speaker 1: the client really needs to focus on in order to improve. Definitely,
Speaker 1: we'll take the response plans, study them, and then create
Speaker 1: scenarios that are specifically designed to possibly you know, go
Speaker 1: around or you know, penetrate certain areas that they might
Speaker 1: be missing. We also take it where we might not
Speaker 1: have any insight and show that there are you know,
Speaker 1: openings and holes that might you know, appear. A lot
Speaker 1: of it has to do with human human interaction, things
Speaker 1: that we might miss, things that are happening, So it's
Speaker 1: kind of taking all those in and then showing where
Speaker 1: you need to add those within your plan. So definitely
Speaker 1: that's an area. Yeah. I think of that a lot
Speaker 1: in terms of things like learning a martial art where
Speaker 1: you practice practice, practice, practice, and then you're ready to
Speaker 1: show off to someone and say, all right, i'll show
Speaker 1: you how you get out of it. Here, grab me
Speaker 1: from behind. Someone grabs you from behind. Oh no, no,
Speaker 1: not like that. You need to grab me from behind
Speaker 1: this way so I can get out of it. And
Speaker 1: you think, well, that's not how the bad guys are
Speaker 1: going to do it. They're not going to attack you
Speaker 1: at your strongest point. Just because you really practice that.
Speaker 1: So I think that again, the service you're providing is
Speaker 1: incredibly valuable. And as we're seeing the landscape change, I
Speaker 1: think it's going to be important for more and more
Speaker 1: companies to really focus on this, to continue to focus
Speaker 1: on it. You don't want your story to become the
Speaker 1: next big scandal. You want your story to be a
Speaker 1: success story of how you were able to respond in
Speaker 1: a in an agile way, an effective way, and a
Speaker 1: way that was responsible both to your company, to your customers,
Speaker 1: to your clients. That those are the stories we want
Speaker 1: to see. We want to see because we know the
Speaker 1: bad guys aren't going away. We know that they're not
Speaker 1: going to just stop, but we do know that we
Speaker 1: can work better at responding to it and make sure
Speaker 1: that the actions we take are more effective and that
Speaker 1: people don't feel like they are left out in the
Speaker 1: lurch and there's nowhere to turn to and you're just
Speaker 1: you're just going through the absolute worst feeling of your life.
Speaker 1: We want to prevent that as much as possible. You can.
Speaker 1: You can save that for the stage, and then in
Speaker 1: real life you can have the actionable plan. Do you
Speaker 1: have any other last thoughts you would like to share
Speaker 1: before we conclude. I think I've learned a lot in
Speaker 1: this conversation. First of all, I mean I've learned I
Speaker 1: definitely want to see one of these simulations because I
Speaker 1: think it would be incredibly informative. And also I've learned
Speaker 1: that I probably need to update my password manager. Yeah.
Speaker 1: My last thoughts would be, do not be part of
Speaker 1: the people that believe they don't need to change their passwords? Right.
Speaker 1: We mentioned that, you know, we hear about breaches happening
Speaker 1: on a daily basis, and then so many people just
Speaker 1: kind of think, oh, well, now they happen all the time,
Speaker 1: so it's no big deal. Just keep my passwords the same.
Speaker 1: Don't do that. Please change your passwords, Please use a
Speaker 1: password manager. And if you've got questions on other things
Speaker 1: related to things we talked about, you can also visit
Speaker 1: ibmsecurity dot com and read more about all of the
Speaker 1: services that we have to offer. We'd love to chat.
Speaker 1: I again want to thank Wendy and Allison for their
Speaker 1: time and their expertise. I am convinced that companies absolutely
Speaker 1: need to have an incident response team and a response
Speaker 1: plan in place to deal with cyber threats. Reducing the
Speaker 1: attack surface is important, but making sure you've got the
Speaker 1: right plan and people ready to go should the worst
Speaker 1: happen is absolutely critical. It reduces the cost of an
Speaker 1: attack dramatically, and when you consider the cost we're talking
Speaker 1: about isn't just the significant financial cost, it's also how
Speaker 1: others perceive your company. It's an imperative. We've seen companies
Speaker 1: large and small take massive hits to their credibility as
Speaker 1: a result of attacks. I hope one day I get
Speaker 1: to see Alison and her team at work, and her
Speaker 1: description of people going through real world emotions even in
Speaker 1: a simulated event reminded me of how we can experience
Speaker 1: stuff like fear and trepidation even when we're in a
Speaker 1: virtual environment. But it's better to have that experience in
Speaker 1: a test run than the real thing. That's all from
Speaker 1: this episode of Smart Talks. To learn more about IBM's
Speaker 1: cyber security services, visit IBM dot com, slash Security Slash Solutions.
Speaker 1: Tex Stuff is an iHeartRadio production. For more podcasts from iHeartRadio,
Speaker 1: visit the iHeartRadio app, Apple Podcasts, or wherever you listen
Speaker 1: to your favorite shows.