Speaker 1: You're listening to Bloomberg Business Week with Carol Messer and
Speaker 1: Tim Stenebec on Bloomberg Radio. You might recall on Monday,
Speaker 1: Bloomberg reported on an episode that underscores the vulnerability of
Speaker 1: global computer networks when hackers got hold of logging credentials
Speaker 1: for data centers in Asia use by some of the
Speaker 1: world's biggest businesses. The move scene is a potential bonanza
Speaker 1: for spying or sabotage, according to a cybersecurity research firm.
Speaker 1: So we thought, let's get an update if you will
Speaker 1: when it comes to cyber attacks. Yeah, really important story
Speaker 1: that we definitely need to keep monitoring, monitoring, and I
Speaker 1: think our next guest is going to help us be
Speaker 1: smarter on it. This is Charles Henderson, Global Managing Partner
Speaker 1: and head of IBMS X Force, joining us via zoom
Speaker 1: from Austin, Texas. Charles, thank you so much for being
Speaker 1: here with us. Give us just the lowdown on IBM
Speaker 1: State of Security Report. What are your big takeaways? So
Speaker 1: you know, you think about every company that you just
Speaker 1: dealt with A closing Belle, and the name of the
Speaker 1: game is agency and return on investment and criminal organizations
Speaker 1: are no different. What you're seeing is organized crime step
Speaker 1: up to the plate and look at how do we
Speaker 1: gain efficiencies, how do we improve our gross profit margin,
Speaker 1: and how do we do that with automation. All the
Speaker 1: same things that you want to see companies doing, and
Speaker 1: right now they're doing it exceedingly well. Go ahead, no, no,
Speaker 1: go ahead no. Really really interesting to hear you talk
Speaker 1: about them doing well, because we don't always get good
Speaker 1: good news on this topic. What are some of the
Speaker 1: other major findings when it comes to sort of where
Speaker 1: you're seeing energy attacks at X Force specifically, so you know,
Speaker 1: one of the key things the attackers are looking for.
Speaker 1: The criminals are looking for is leverage. They are looking
Speaker 1: for real world output of their labors. So you know,
Speaker 1: if you think about like energy or manufacturing or industry
Speaker 1: a little tolerance for downtime, they are a key target
Speaker 1: of attackers because those sectors tend to know what the
Speaker 1: cost of downtime is going to be down to the
Speaker 1: dollars and cents. So if you have ransomware against an
Speaker 1: energy provider and the lights go out or a manufacturing
Speaker 1: facility and the assembluny line star stops working, criminals are
Speaker 1: relying on the fact that they're likely to pay a
Speaker 1: ransom or extortion because they know how much it's costing
Speaker 1: them in the real world dollars. Hey, listen, what I'm
Speaker 1: always curious about it, and and I feel like at this point, Charles,
Speaker 1: we know that this is happening, right, It's happening around
Speaker 1: the world. It's kind of a part of normal operations
Speaker 1: when it comes to business. What are we learning year
Speaker 1: by year? What's different about what happened last year versus
Speaker 1: the year before. Is it just the frequency, is it
Speaker 1: the type of cyber attacks that are happening? What is
Speaker 1: it or is it all kind of the same. It's
Speaker 1: just more perhaps, So you know, one of the biggest things,
Speaker 1: and I already talked about efficiency, but let's put that
Speaker 1: into numbers. A ransomware activity on the part of a
Speaker 1: criminal enterprise takes ninety five percent less time than it
Speaker 1: did three years ago. So three years ago, we'd say
Speaker 1: two two and a half months soup denuts from the
Speaker 1: point at which they got in to the point at
Speaker 1: which they accomplished their goals. Now that's closer to four days.
Speaker 1: That is huge efficiency gains. That means that we as
Speaker 1: an industry have way less time to detect and respond
Speaker 1: to an active attack. That means we need to get better.
Speaker 1: We need to gain those efficiencies as well. Where are
Speaker 1: we at now with those efficiencies? How what like letter
Speaker 1: grade would you give us in our ability to respond
Speaker 1: to these four day attacks? Not great? And I'll tell
Speaker 1: you why. We have a vulnerability debt that is going
Speaker 1: to be difficult to overcome. Most organizations cannot keep up
Speaker 1: with patching anymore, and so it's no longer a wise
Speaker 1: strategy to just try and keep everybody out and count
Speaker 1: on that as working. So what we need to do
Speaker 1: is focus on assuming that you've been breached and what
Speaker 1: can you do to detect and respond to an attacker
Speaker 1: that's moving laterally through your environment. That pivot is going
Speaker 1: to be key as we go forward. Organizations are starting
Speaker 1: to do it. You see, you saw an executive order
Speaker 1: two years ago that has really changed the way a
Speaker 1: lot of organizations approach working from a sooon breach a strategy,
Speaker 1: implementing zero trust strategies. All these things come together to
Speaker 1: modernize our approach to security. But the final piece of
Speaker 1: this is giving up on the perimeter and starting to
Speaker 1: focus on the interior. Hey, listen, one thing I was wondering, Charles,
Speaker 1: how much of an impact of a global war, the
Speaker 1: war in Ukraine. How is that impact in the frequency
Speaker 1: and severity of cyber attacks? You know, it certainly didn't
Speaker 1: help in any time that you have conflict, you have
Speaker 1: folks that are straying, they're under stress, and that's exactly
Speaker 1: what criminals are looking for. They're looking for either supply
Speaker 1: chain stress, real world stress that they can pile onto
Speaker 1: with cyber attacks and gain leverage. Because at the end
Speaker 1: of the day, extortion is all about leverage. It's knowing
Speaker 1: that your victim has no choice but to pay you.
Speaker 1: And this is also getting worse because of like activist groups. Right,
Speaker 1: I don't necessarily have the best understanding of those groups,
Speaker 1: but I know that it's not good and that they're
Speaker 1: getting better. Are you more concerned about them or about
Speaker 1: um more? I guess institutional hackers that we've already known
Speaker 1: about for some time. You know, Look, activism is a
Speaker 1: real problem for organizations. But at the end of the day,
Speaker 1: I'm most concerned with the evolution of attacks. We've gone
Speaker 1: from the advanced technical attacker to organized crime employing business
Speaker 1: tactics that they've tested long and true in street crime
Speaker 1: and applying them to digital crime. And what that means
Speaker 1: is they're gaining efficiencies, they're working smarter, not harder, and
Speaker 1: they're using a fail fast mentality that quite frankly, it's
Speaker 1: going to be difficult to keep up with. If the
Speaker 1: defenders don't adapt as well, we're gonna need to start
Speaker 1: thinking like attackers. Hey listen, but I wonder too, Charles,
Speaker 1: and I feel like this is just like I said,
Speaker 1: you know, cyber attacks, unfortunately, are just a way of
Speaker 1: life for us increasingly. So having said that, I mean,
Speaker 1: you guys certainly play into the space and provide, you know,
Speaker 1: ways for companies to protect themselves. What's the uptick that
Speaker 1: you've seen in demand for your products? So you know,
Speaker 1: I would say that the biggest demand we are seeing
Speaker 1: now is for you know, threat hunting, adversary stimulation, things
Speaker 1: that help organizations think like an attacker. So they're concerned
Speaker 1: with their attack surface monitor and they're they're concerned with
Speaker 1: red teaming that will help them understand where they may
Speaker 1: have gaps in detection. So it's not enough just to
Speaker 1: defend anymore. Now you need to understand do your defenses
Speaker 1: work and how are they working? Whereas in the past
Speaker 1: it was more of a bioproduct, set it and forget it.
Speaker 1: Now it's more of an interrogation of those products. I
Speaker 1: wonder too, if you've seen any sort of interest from
Speaker 1: consumers about wanting to protect ourselves as well, and if
Speaker 1: you have any advice for the average listener out there
Speaker 1: who might be hearing this and thinking, yes, this is
Speaker 1: obviously bad for big companies and governments, but also we
Speaker 1: want to make sure we're protecting ourselves on an individual
Speaker 1: level from any cybersecurity threats. You know, everyone needs to
Speaker 1: worry about cybersecurity now. It's no longer just big companies,
Speaker 1: and you know, you only need to look at the
Speaker 1: real world repercussions of cyber attack, whether it's colonial pipeline
Speaker 1: a year ago or any number things. But consumers can
Speaker 1: do some things just to protect themselves on a personal level.
Speaker 1: Multi factor authentication is huge, you know that's been in
Speaker 1: the news a lot lately. But a lot of organizations,
Speaker 1: a lot of the businesses that you work with already
Speaker 1: offer multi factor authentication, but it doesn't come enabled by
Speaker 1: default necessarily, So go into your settings, look for multi
Speaker 1: factor authentication. They may call it two factor Authentication or
Speaker 1: other names similarly and enable it. Also, make sure that
Speaker 1: your passwords are are not easily guessed. Make sure that
Speaker 1: you're not sharing passwords between multiple platforms because remember, if
Speaker 1: one password is compromised, you don't want it to affect
Speaker 1: you multiple times. Okay. And then finally, be aware of
Speaker 1: your surroundings into the digital realm. Understand that you're scammer
Speaker 1: on us out there and they're looking to take advantage
Speaker 1: of you. All right, Charles Henderson, thank you so much.
Speaker 1: Global Managing Partner, head of x Force at IBM, joining
Speaker 1: us Vias Zoom from Austin, Texas,