Speaker 1: Bloomberg Audio Studios, Podcasts, radio news. This is Bloomberg Business
Speaker 1: Week with Carol Masser and Tim Steneveek on Bloomberg Radio.
Speaker 2: Hey, you mentioned Emily Graffeo some of the stuff happening
Speaker 2: when it comes to hacks coinbase specifically, I'm gonna read
Speaker 2: some headlines here, Okay, Sequoia Capital Partners data hacked and
Speaker 2: Coinbase breach. Coinbase hack highlights how greed can overwhelm cyber defenses,
Speaker 2: coinbased customer data stolen. Just a sample of headlines from
Speaker 2: Bloomberg News and from the Wall Street Journal. This garnering
Speaker 2: our attention on a day such as today and kind
Speaker 2: of perfect to have Wendy Whitmore back with us. She's
Speaker 2: chief intelligence officer of the one hundred and twenty eight
Speaker 2: billion dollar market cap Palabelto network. She joins us from
Speaker 2: Santa Clara, California. Wendy, good to have you back with us.
Speaker 2: The Coinbase hack, I think, really highlights how our information
Speaker 2: is at rich even if we think as consumers, as
Speaker 2: users of these products and services, it's safe. I mean
Speaker 2: when you talk about the type of data that's at
Speaker 2: risk here, I mean we're talking images of drivers' licenses,
Speaker 2: being available to hackers as a result of accessing the network.
Speaker 2: Talk to us a little bit about what we know
Speaker 2: regarding this hack and what it highlights about the vulnerabilities
Speaker 2: out there.
Speaker 3: Yeah, hey, thanks Tim, great to be back here today
Speaker 3: with you. So, I think what you highlighted is really
Speaker 3: just the fundamental problem we see here, which is how
Speaker 3: challenging it is for organizations to defend against every possible
Speaker 3: type of attack. The really interesting part of this case
Speaker 3: is that these attackers have demanded twenty million dollars in
Speaker 3: ransom payment, and coinbases really turn the table on them
Speaker 3: in something that we haven't seen yet, which is a
Speaker 3: very public disruption of the attacker. And they said, you
Speaker 3: know what we're going to do. We're going to invest
Speaker 3: twenty million dollars into a fund that goes after finding
Speaker 3: out who the attackers are that are responsible for this
Speaker 3: attack and bringing them to justice. And I think, you know,
Speaker 3: as the largest cybersecurity company in the world, we at
Speaker 3: Palo Alto Networks, we don't ever want to see any
Speaker 3: client be paying a ransom, But we have not seen
Speaker 3: organizations previously take this kind of tactic, and I think
Speaker 3: what they're doing to disrupt the incentive structure and to
Speaker 3: make it a little more challenging. And I think attackers
Speaker 3: in the future asking the question of a wait, I
Speaker 3: don't know if I want that twenty million dollar international fund,
Speaker 3: which is going to mean people who you know, I
Speaker 3: may be in my network, but maybe willing to kind
Speaker 3: of turn me over to international law enforcement. I think
Speaker 3: they're going to start asking questions, and disruption in this
Speaker 3: cycle is really critical.
Speaker 2: Yeah, I mean, I the sense that I have is
Speaker 2: that our information is not safe. I mean, I don't
Speaker 2: know how many times a day I get text messages.
Speaker 2: I probably get half a dozen text messages from these
Speaker 2: so called pig butchers. I oftentimes I don't even pick
Speaker 2: up my phone if I don't recognize the number. I mean, honestly,
Speaker 2: the world we live in when it comes to this stuff,
Speaker 2: it's pretty annoying. Like this is a very annoying place
Speaker 2: to be as a consumer right now. Is it going
Speaker 2: to get any better? Or is this just the reality
Speaker 2: that we live with?
Speaker 3: Yeah, it's a great question. I don't think you're alone
Speaker 3: in that sentiment whatsoever. It is challenging, right So, we
Speaker 3: are actually blocking thirty one billion attacks per day across
Speaker 3: our customer base, and up to nine million of those
Speaker 3: every single day are new attacks where their novel we
Speaker 3: haven't seen that same type of vector. So that gives
Speaker 3: you an idea of what companies throughout the world are
Speaker 3: up against. And then certainly you highlighted some examples that you,
Speaker 3: as an individual consumer are feeling. So your question though,
Speaker 3: was you know, hey, is it getting any better?
Speaker 2: It's not getting any better for me, will it?
Speaker 3: I think it can get better, and I think that
Speaker 3: we're seeing AI actually be a massive tool for the
Speaker 3: side of the defenders because, as I highlighted, we're up
Speaker 3: against such a major scale problem, these attacks are going
Speaker 3: to be more sophisticated. Real time defense is absolutely critical.
Speaker 3: So what you're going to start seeing tim certainly at
Speaker 3: the company level, all of the technologies we're able to
Speaker 3: use are actually making us able to scale against that better.
Speaker 3: But you're going to see that get into your consumer
Speaker 3: technologies as well, where they're going to start doing more
Speaker 3: effective blocking and you're going to receive less text match
Speaker 3: messages moving forward that are scams in nature.
Speaker 4: When you talk about AI, you know, something that comes
Speaker 4: to mind is just how scammers can use AI to
Speaker 4: say impersonate so impersonate a parent, a family member, a
Speaker 4: loved one and try and hack you that way. How
Speaker 4: concerned are you that the advancement of this technology like
Speaker 4: we're not going to be able to keep the defenses
Speaker 4: up strong enough to kind of combat the growth of
Speaker 4: cyber criminals using AI.
Speaker 3: Well, I think there's two parts of it to really
Speaker 3: hit effectively to answer your question. First is on the
Speaker 3: tech side that has to continue to get better. But two,
Speaker 3: we have to continue to increase awareness at the public
Speaker 3: level and then make sure that people are making smart
Speaker 3: decisions about how they use technology. So when we look
Speaker 3: at it at a wider spread level in organizations, we
Speaker 3: see what you're talking about. Just last week, we were
Speaker 3: investigating a case where we were working for a firm
Speaker 3: who was a victim of ransomware, and we were negotiating
Speaker 3: with the attackers to try to get additional information from them,
Speaker 3: and it became very clear almost instantly that we weren't
Speaker 3: talking to a person on the other end, but we
Speaker 3: were actually talking to a chatbot that they had enabled
Speaker 3: to do the negotiations for them. We certainly will continue
Speaker 3: to see more of that. Another example that we saw
Speaker 3: just in the last couple weeks of investigating a case
Speaker 3: for a major organization, the attackers, once they got inside
Speaker 3: the environment they actually used, they went straight to that
Speaker 3: company's internal large language model and started interacting with it
Speaker 3: to try to get more sinse me asking them questions
Speaker 3: about where the domain controllers were, what were their names,
Speaker 3: and finding out information that was actually helpful for them
Speaker 3: in the course of an attack. So that means that
Speaker 3: in order to really be successful here, organizations have to
Speaker 3: fight AI attacks with AI on the defense, and that
Speaker 3: has to be in real time.
Speaker 2: And then what do we do as consumers? I mean,
Speaker 2: I know a guy who was getting calls like that
Speaker 2: looked like it was from his bank. It literally said
Speaker 2: his bank's name on the phone, and he was so
Speaker 2: close to actually giving up the information when he realized
Speaker 2: that it wasn't actually his bank. Like, what are we
Speaker 2: supposed to do as consumers?
Speaker 3: Well, I think we've got to approach every conversation unfortunately
Speaker 3: with skepticism, do that same with every message. But for
Speaker 3: your bank, for example, most banks will say, hey, we're
Speaker 3: not going to reach out to you and ask you
Speaker 3: for personal information. Everywhere you can use multi factor authentication,
Speaker 3: it not only sometimes adds a little bit of time
Speaker 3: for you to get in, but it's going to make
Speaker 3: it a lot harder for an attacker to try to
Speaker 3: log in as you and essentially try to steal money
Speaker 3: or move money or maybe infact a social media account
Speaker 3: if they have to go through a number of additional
Speaker 3: steps to get there as well.
Speaker 2: All right, well leave it on a positive note. Make
Speaker 2: sure to have two factor authentication, art time unique passwords too,
Speaker 2: is something that we hear over and over again when
Speaker 2: it comes to sort of safe security hygiene. Wendy always
Speaker 2: appreciate you joining us. Wendy Whitmore, chief intelligence officer of
Speaker 2: the one hundred and twenty eight billion dollar market cap
Speaker 2: Palo Alto Networks, joining us from Santa Clara, California,