Speaker 1: The bad guys like to attack over holidays, so it's
Speaker 1: really not fun for me.
Speaker 2: That's Curtis Minder, a renowned ransomware negotiator, telling me about
Speaker 2: a time when he picked up an emergency call on
Speaker 2: a major holiday.
Speaker 1: The initial call is always very emotional, as you can imagine,
Speaker 1: even in the large companies, you know, you may have
Speaker 1: a boardroom of people with it's very emotional.
Speaker 2: On the other end of the call was a chemical
Speaker 2: manufacturing company who'd been locked out of their own assembly line.
Speaker 1: They had a complete operational interruption, so they couldn't manufacture
Speaker 1: their product.
Speaker 2: Costs can add up quickly when a cyber attack delays
Speaker 2: at game studio's next release or leads to a data
Speaker 2: breach at a bank. But when attackers shut down a
Speaker 2: manufacturing line that's part of a global supply chain, you
Speaker 2: can almost see the money circling the drain.
Speaker 1: They were losing millions of dollars a day in revenue.
Speaker 2: And for this chemical manufacturer, like with any business shut
Speaker 2: down by ransomware, the losses went way beyond a few
Speaker 2: days of missing shipments.
Speaker 1: I call it the ransomware blast radius. It's like we
Speaker 1: know the base impact. It's operational interruption, But what about
Speaker 1: these other things? And so that's cost of goods going bad,
Speaker 1: supplier confidence, that's hey, wait, you didn't make payroll for
Speaker 1: two weeks, the attrition that just occurred, wuldn't that cost you?
Speaker 3: Those are all part.
Speaker 1: Of the fairly complex equation on total cost of impact.
Speaker 1: That formula, if you will, kind of helps his decide
Speaker 1: on whether to pay a bad guy or not, or
Speaker 1: to engage a bad guy or not.
Speaker 2: In this case, after finishing this exhausting analysis with Curtis,
Speaker 2: the company decided to pay the ransom.
Speaker 1: And my job as a negotiators to make sure we
Speaker 1: don't pay the price on the window.
Speaker 3: On the sticker.
Speaker 2: Before long, the systems were back online, products were going
Speaker 2: out the door again, and Curtis was helping the company recover.
Speaker 2: But when he sat down with the companies see so,
Speaker 2: he heard something that changed how he thought about the industry.
Speaker 1: He said, Curtis, here's my biggest concern. We have been
Speaker 1: the manufacturer of this particular product for almost one hundred years,
Speaker 1: and the way that we manufacture this product and the
Speaker 1: materials we use to manufacture this product are our trade secret.
Speaker 1: I am concerned that that information has left the building,
Speaker 1: and I won't know about that risk for some time
Speaker 1: until a competitor of mine makes the exact same product
Speaker 1: in five years from now and puts me out of business.
Speaker 2: From Bloomberg Media Studios and Chrome Enterprise, this is Security Bookmarked.
Speaker 2: I'm your host, Kate Fazzini. I've been a cybersecurity professional
Speaker 2: and journalist for over twenty years, and on this podcast,
Speaker 2: I'm talking with leaders in gaming, finance, and manufacturing about
Speaker 2: what security looks like in a workplace that's moved to
Speaker 2: the cloud. In twenty twenty three, ransomware attacks against manufacturers
Speaker 2: and other industrial companies increased by fifty percent, and since
Speaker 2: twenty nineteen, cybersecurity incidents targeting operational technology have risen exponentially.
Speaker 2: So today I'm speaking with Curtis about why manufacturs are
Speaker 2: facing more ransomware attacks than ever and how AI is
Speaker 2: amplifying threats and offering new defenses for cybersecurity leaders.
Speaker 1: I'm the founder of Group Sense, which is a digital
Speaker 1: risk protection company. I'm also the lead ransomware negotiator at
Speaker 1: group Sense, and I have about thirty years in what's
Speaker 1: now just called cyber.
Speaker 2: Then i'll chat with David Adrian security product manager for
Speaker 2: Chrome about how a web focused strategy can help manufacturers
Speaker 2: secure the connection between their IT and their OT. The
Speaker 2: job title of ransomware negotiator is still fairly new, but
Speaker 2: Curtis has been dealing with cyber attackers since the early
Speaker 2: nineties when he worked on systems for an Internet service provider.
Speaker 2: He's seen pretty much every kind of ransomware scenario you
Speaker 2: could imagine.
Speaker 1: Incidence where the victim has started the negotiation before we
Speaker 1: showed up and has made some very very novice mistakes.
Speaker 3: We've also had incidents.
Speaker 1: Where we're in the middle of the negotiation and the
Speaker 1: thread actors get back in and do more damage, where
Speaker 1: there's some confidence from the victim that hey, we've got
Speaker 1: the doors locked, they can't get back in, and they
Speaker 1: were wrong about that, and that causes issues.
Speaker 2: Going back to his ransomware story, Curtis couldn't reveal exactly
Speaker 2: how the attacker got in, but he told me they
Speaker 2: didn't have to be very creative.
Speaker 1: One of the things that is frustrating for us is
Speaker 1: that at the end of this we're taking stock on
Speaker 1: how the thread actors gained access, and it can be
Speaker 1: distilled down into like seven to eight sort of preventable things.
Speaker 2: Strong passwords, multi factor authentication, staying on top of your
Speaker 2: updates and patches, securing remote access. These are just a
Speaker 2: few of the things Curtis considers low hanging fruit for
Speaker 2: any company.
Speaker 1: They're trying to gain access to your systems as cheaply
Speaker 1: and as efficiently as possible, and so they're not buying
Speaker 1: zero days on the dark web to break into your
Speaker 1: to break into your network because they don't have to.
Speaker 1: They can use some very simple mistakes and so fiber
Speaker 1: hygiene or processes to gain access, and often that is
Speaker 1: the case. It is something fairly simple to gain the
Speaker 1: initial access, and then once they're in, they're very good
Speaker 1: at expanding their access and pivoting.
Speaker 2: Later in the episode, i'll chat with David Adriene at
Speaker 2: Chrome about how a web focused strategy can secure that
Speaker 2: point of access.
Speaker 3: But first i'll hear.
Speaker 2: More from Curtis about his experiences helping manufacturers recover from
Speaker 2: ransomware attacks and what he sees in the near future
Speaker 2: for enterprise cybersecurity.
Speaker 1: You know, when you talk about partners or constituents who
Speaker 1: lose confidence in the manufacturing and supply chain space, a
Speaker 1: lot of these companies have a fairly robust supply chain
Speaker 1: resiliency strategy, right, and if one of your manufacturers in
Speaker 1: your supply chain stops producing, you've got a backup or
Speaker 1: two or three, and you might not never ever go
Speaker 1: back to that manufacturer. When I'm talking to companies about
Speaker 1: how to prepare and respond to this in ants of
Speaker 1: an attack, I tell them that when the dust settles
Speaker 1: on an attack, you're going to need a tremendous amount
Speaker 1: of goodwill from your community, and the quickest way to
Speaker 1: make that go away is to lie to them or
Speaker 1: make them think you're lying to them or withholding information.
Speaker 1: And so their ability to address this quickly and also
Speaker 1: communicate transparently is so important.
Speaker 2: Yes, I am so kind. You're saying that I've seen
Speaker 2: the communication piece goes so wrong, both as a practitioner
Speaker 2: and then as a reporter, even though that doesn't have
Speaker 2: to be the case. So thank you for emphasizing that. Now,
Speaker 2: going back to the start of your ransomware story, I
Speaker 2: want to ask something more simple. Why are manufacturers and
Speaker 2: in particular, operating technology itself a target? To begin with?
Speaker 1: Yeah, I think increasingly, like everywhere else in the world,
Speaker 1: the devices and manufacturing are connected, and the reason why
Speaker 1: we're connecting them is data. We want to manage them,
Speaker 1: we want to optimize them, we want to look for
Speaker 1: errors and mist and things like that. And so as
Speaker 1: we've implemented technology to manage those manufacturing devices and connected
Speaker 1: those systems to the network, we've introduced a new attack
Speaker 1: vector for the bad guys.
Speaker 2: And it's not just one attack vector, right, there's this
Speaker 2: whole Internet of things now, lots of new devices attached
Speaker 2: to the network.
Speaker 3: They're all targets. Yeah.
Speaker 1: So in a manufacturing environment that is dealing with something
Speaker 1: that is sensitive to temperature control, the HVAC system is
Speaker 1: very important. So the thread actors obviously have gotten better
Speaker 1: at this. They know that impacting those devices and those
Speaker 1: systems makes a bigger impact operationally. And so HVAC systems
Speaker 1: and IP phone systems and product life cycle devices.
Speaker 3: You lock one of those up.
Speaker 1: In manufacturing stops, things stop getting built.
Speaker 2: It's just devastating. And when you think about the kind
Speaker 2: of leverage that an attacker can get when they deploy
Speaker 2: ransomware on these operational devices, it's astonished.
Speaker 1: Yeah, I mean, the thread actors have gotten better at
Speaker 1: learning how to disrupt our businesses and ot or ICs
Speaker 1: devices industrial control devices. They are computers, they are running
Speaker 1: an operating system. It is typically not a normal operating system,
Speaker 1: and so one of the challenges for organizations is how
Speaker 1: do you secure those And on top of that, those
Speaker 1: devices are often not managed by the IT staff or
Speaker 1: even the organization itself. Sometimes whoever's making these devices have
Speaker 1: a maintenance contract to manage those devices inside the network.
Speaker 1: So you've got a third party who's responsible for keeping
Speaker 1: that device up to date and secure, et cetera. And
Speaker 1: then you've got an IT staff who's responsible for the
Speaker 1: overall organization. And it makes for an interesting dynamic that
Speaker 1: creates a sort of a paradox for the IT security
Speaker 1: folks in those organizations as far as protecting those devices,
Speaker 1: and they are connected, so that connected he needs to
Speaker 1: be closely monitored and managed and also be minimalistic, so
Speaker 1: it only the things that need to talk need to talk,
Speaker 1: and that is it right, and keep it very very tight.
Speaker 2: That's great advice, Thank you so much, Curtis. Now you're
Speaker 2: constantly reminding business leaders that they don't want to have
Speaker 2: low hanging fruit, that attackers have plenty of old tricks
Speaker 2: that still work so, and I know you also do
Speaker 2: reconnaissance on thread actors. So looking to the future, do
Speaker 2: you see it change happening in the way cyber attackers
Speaker 2: are approaching their attacks?
Speaker 1: You know, I think having done quite a bit analysis
Speaker 1: on this, and my core company does a lot of
Speaker 1: work around intelligence, I think right now our biggest concern
Speaker 1: is synthetic content. So the phishing campaigns are more effective,
Speaker 1: the landing pages that they send you to to carvesture
Speaker 1: credentials are more real. I'll just give you a quick
Speaker 1: example of one of those. The thread actors will go
Speaker 1: to your management page of your company and they'll pick
Speaker 1: out all the names of your board members, and then
Speaker 1: they will have AI generate a fake email threat between
Speaker 1: those people on a particular topic, and it looks very
Speaker 1: very real.
Speaker 2: Okay, that's a new one. That's new. I haven't heard
Speaker 2: that before.
Speaker 1: Yeah, you're a mid level finance person and then suddenly
Speaker 1: you're looped in on this email thread by a board
Speaker 1: member and they say, hey, we need you to do this,
Speaker 1: and you scroll back and you look at Oh my gosh,
Speaker 1: it's the board they need you know, I feel important.
Speaker 1: I'm going to do this thing right away. I'm not
Speaker 1: going to ask any questions. We've seen evidence of that,
Speaker 1: and the AI makes that very easy for the bad
Speaker 1: guys to do, to create the sort of synthetic content
Speaker 1: that looks very very real to the average person and
Speaker 1: create sort of a social pressure in the email chains
Speaker 1: and things like that. And I say that in lieu
Speaker 1: of are the bad guys using AI to write custom malware?
Speaker 1: Not yet, we haven't seen any in the wild yet,
Speaker 1: but it is plausible that AI can write, you know,
Speaker 1: polymorphic malware for bad guys. But primarily they're not doing
Speaker 1: that because they don't have.
Speaker 2: To exactly, it's just totally unnecessary.
Speaker 1: Yeah, they're running a business, and this is it's just
Speaker 1: easier to trick you into giving your credentials or wiring money.
Speaker 3: That's easier and cheaper for them.
Speaker 1: Where I do think AI will play a risk, if
Speaker 1: it hasn't already, is the volumes and volumes and volumes
Speaker 1: of data that have been collected, you know, prior to
Speaker 1: generative AI, finding the needle in the proverbial haystack in
Speaker 1: that data was difficult and time consuming. So in some
Speaker 1: ways we were sort of protected by the fact that
Speaker 1: they have too much data right, But now AI, they
Speaker 1: can train a model in AI and say this is
Speaker 1: the kind of information that I'm looking for in this haystack,
Speaker 1: and it will go find it for them in seconds.
Speaker 3: And that is dangerous. Now on the.
Speaker 1: Flip side, you could say the same On the defense,
Speaker 1: one of the biggest challenges the security teams have is
Speaker 1: log data.
Speaker 3: It's just huge. They can find they're finding a needle
Speaker 3: in a haystack too.
Speaker 1: AI can also help with that, right, AI can help
Speaker 1: them find the bad guys quicker.
Speaker 2: So I'm just thinking that what we know about technology
Speaker 2: and how it's always part of this race between attackers
Speaker 2: and their targets, what do you say to CISOs who
Speaker 2: maybe feel like they're losing this race, especially when it
Speaker 2: comes to AI, or maybe to put this another way,
Speaker 2: we often know the first steps in attacker will take
Speaker 2: to compromise your business. What's the first step a cybersecurity
Speaker 2: leader needs to take so their operation can stand up
Speaker 2: to that risk.
Speaker 1: Yeah, So cyber risk, in mitigating cyber risk is a
Speaker 1: top down thing for organizations. I think that it does
Speaker 1: start with culture and education for the greater staff. That
Speaker 1: is step one is understanding that you know cybersecurity is
Speaker 1: not an overhead. It is a fundamental operational part of
Speaker 1: the business. When we start talking about how to mitigate
Speaker 1: these risks, there's this very well known set of cyber
Speaker 1: risk practices that all companies should use. That said, you
Speaker 1: should also assume that that's not always going to work.
Speaker 1: What organizations can do, and manufacturers specifically can do, is
Speaker 1: put in place a response in mitigations strategy that contains
Speaker 1: these things quickly.
Speaker 2: The AI assisted phishing emails that Curtis told me about,
Speaker 2: the warning that attackers will eventually breach your perimeter, these
Speaker 2: reminded me that the first step of so many cyber
Speaker 2: attacks is using your own accounts against you.
Speaker 4: Step one is like, if an employee doesn't have access
Speaker 4: to something, they can't leak it right, whether intentionally or
Speaker 4: because their account was taken over by an attacker or otherwise,
Speaker 4: so strong access control sort of limits the problem down.
Speaker 2: That's David Adrian and the security product manager for Chrome.
Speaker 2: When I brought up the equipment that attackers can target
Speaker 2: after they gain account access, David took a step back
Speaker 2: and looked at the overall posture. He explained how the
Speaker 2: network connections that make them vulnerable could be transformed into
Speaker 2: points of defense.
Speaker 4: I saw some research recently about we'll call it industrial
Speaker 4: control systems or ICs systems, these sort of factory floor
Speaker 4: management systems, and it was saying that the core sort
Speaker 4: of ICs protocols, you weren't really seeing them online as
Speaker 4: much anymore, which is good because these protocols don't really
Speaker 4: have any security in them, but they do expose a
Speaker 4: web interface HTTP configuration pages for this equipment for managing
Speaker 4: factories or other industrial control systems or other manufacturing processes.
Speaker 4: It's bad if these administration pages are accessible, but it's
Speaker 4: good because it kind of shapes the problem from how
Speaker 4: do I secure this old protocol that wasn't built for security,
Speaker 4: that's confusing, that's used for somewhat niche applications for like
Speaker 4: managing centrifuges or whatever it is that you're using in
Speaker 4: your manufacturing process, And instead it just boils down to
Speaker 4: limiting access to websites on the front end and then
Speaker 4: sort of strong network segmentation on the backside. And then
Speaker 4: you can build access controls on top of a system
Speaker 4: that was never built for this in the first place,
Speaker 4: right by just routing all of the traffic and all
Speaker 4: of that access through an enterprise browser.
Speaker 2: I think if you were talking ten years ago, you
Speaker 2: might say you wanted the OT and IT systems to
Speaker 2: be not connected at all, or that you would want
Speaker 2: an OT system never to connect to the Internet. Talk
Speaker 2: to me a little bit about why, with the way
Speaker 2: that we work today, that's not as realistic.
Speaker 4: Yeah, air gappening sounds nice in practice, but in reality,
Speaker 4: systems end up needing to be connected directly to the
Speaker 4: Internet or to some other network that is then connected
Speaker 4: to the Internet, and so it makes way more sense
Speaker 4: to adopt these sort of zero trust approaches where each
Speaker 4: device is behind its own sort of authentication proxy, and
Speaker 4: then you access the configuration pages through the web browser,
Speaker 4: through the enterprise browser, and you leverage everything that's built
Speaker 4: into the enterprise browser, and then you can do that
Speaker 4: without any of these devices actually needed to be updated
Speaker 4: to understand all of these sort of modern authentication and
Speaker 4: device authentication protocols.
Speaker 2: That's the point that I think is really important because
Speaker 2: it's many conversations about OT developments while you can't keep
Speaker 2: updating all of these different operating systems all of the time,
Speaker 2: and you know it's just never going to get better.
Speaker 2: But then another layer of security on top is what's helpful.
Speaker 4: Absolutely or alternatively, if you somehow made a mistake and
Speaker 4: there is a way to access sort of the configuration
Speaker 4: or the management of some ot device that doesn't go
Speaker 4: through the browser, then hopefully that's a lot more obvious
Speaker 4: than the sign of like immediate concern because commands are
Speaker 4: getting sent or configuration is being pushed to some device
Speaker 4: on the manufacturing floor and isn't corresponding with some sort
Speaker 4: of known employee log in, like this is a red flag, and.
Speaker 2: It's an instantaneous red flag too.
Speaker 4: Absolutely, So one thing you get from Chrome Enterprise is
Speaker 4: sort of real time reporting and analytics of what all
Speaker 4: of your users are doing. And if you have strong
Speaker 4: authentication of all of your users, you know they're your employees.
Speaker 4: Then if you have you know, corresponding visibility on the
Speaker 4: say factory floor manufacturing floor that isn't aligned with what
Speaker 4: you're seeing out of the Chrome braan houser, then you know, well,
Speaker 4: something is wrong. Something is accessing something on the manufacturing
Speaker 4: floor and is not going through one of my managed browsers,
Speaker 4: and that's an immediate red flag.
Speaker 2: So David, just looking forward as technology improves, we've seen
Speaker 2: a lot of new approaches by attackers using that technology
Speaker 2: and making it more sophisticated, so particularly attackers using AI
Speaker 2: to their advantage. One example, which I had never heard
Speaker 2: before was an attacker using generative AI to create a
Speaker 2: very realistic email chain that included basically spoofs of the
Speaker 2: target's bosses and even board members, and then after that
Speaker 2: they looped the target into the email.
Speaker 4: In this type of situation, with this sort of AI
Speaker 4: phishing email, it sounds more like they're trying to trick
Speaker 4: the user to go to a legitimate site and do
Speaker 4: the wrong thing. And I think the best way to
Speaker 4: defend against that is to make sure that your organization
Speaker 4: has processes in place for doing things that are sensitive.
Speaker 4: And then once you have those sort of processes in place,
Speaker 4: these sort of steps in your workflow that get pushed
Speaker 4: to some sort of application in the browser is then
Speaker 4: another opportunity to have someone else verify that yes, this
Speaker 4: is actually the business process we expected. And so as
Speaker 4: you start to route these business processes through web apps
Speaker 4: through the browser, then every single step in the process
Speaker 4: where you do that is a step where you can
Speaker 4: secure it in the sense that you can make sure
Speaker 4: that the people participating in it are actually your employees
Speaker 4: and give more people an opportunity to identify when something
Speaker 4: is going wrong.
Speaker 2: This is a really cool way of looking at it too,
Speaker 2: I think from a security person's point of view, where
Speaker 2: you have this visibility now that we didn't have before.
Speaker 2: You can see each step of a compromise or each
Speaker 2: step of an attempted breach. Now you can also see
Speaker 2: each step of the pre breach, the pre boom scenario
Speaker 2: in a way that's really systematic. That's actually really exciting.
Speaker 4: Yeah, in the modern web based workplace that we've all
Speaker 4: become accustomed to, there's a ton of opportunities to solve
Speaker 4: enterprise caity problems that have plagued companies for years. Using
Speaker 4: a managed browser like Chrome enterprise can be a critical
Speaker 4: component of these solutions. But I think we're really understanding
Speaker 4: that there's a leadership aspect to cybersecurity that's absolutely critical
Speaker 4: as well. So I hope that we've been able to
Speaker 4: help leaders understand the direction that cybersecurity is headed in
Speaker 4: and demonstrate how much companies can benefit from setting up
Speaker 4: their teams with protections that take into account the way
Speaker 4: that we all work on the web.
Speaker 2: To learn more about how the most trusted enterprise browser
Speaker 2: can help protect your organization, visit Chrome Enterprise dot Google.
Speaker 3: Security.
Speaker 2: Bookmark does a podcast from Bloomberg Media Studios and Chrome Enterprise.
Speaker 2: Check out our other episodes about cybersecurity and finance and
Speaker 2: gaming in your podcast app. I'm Kate Fazzini. Thanks for listening.