Speaker 1: We can go back to a quote from the Depression
Speaker 1: era bank robber Willie Sutton. He had this infamous quote
Speaker 1: that said, like, I rob banks because that's where the
Speaker 1: money is.
Speaker 2: Old fashioned bank heights aren't so common today, but modern
Speaker 2: financial institutions protect more than just money, and finance is
Speaker 2: consistently in the top three most targeted industries when it
Speaker 2: comes to cyber attacks.
Speaker 1: There's accounts, but there's also a lot of strategic information
Speaker 1: with regards to transactions and the likes, and that's what
Speaker 1: continues to make financial institutions a target for this.
Speaker 2: That's JF Lego.
Speaker 1: I'm w chief Information Security Officer at JP Morgan Chase.
Speaker 2: As a leader of cybersecurity operations for the bank and
Speaker 2: its clients, JF thinks constantly about every opportunity that an
Speaker 2: attacker could exploit, from software bugs to natural disasters.
Speaker 1: Whether the scenario will be a technology outage, whether it
Speaker 1: be whether a threat actor could use that as a lure.
Speaker 1: We've actually seen, you know, like fake donation sites. When
Speaker 1: there's a natural disaster right where people are looking to
Speaker 1: donate to earthquake relief for hurricane relief, the.
Speaker 2: Bad guys are there and by setting up fake disaster
Speaker 2: relief websites, the bad guys can harvest any credentials that
Speaker 2: come with those well meaning donations. This is just one
Speaker 2: scenario and a bigger trend that JF seeing where cyber
Speaker 2: attackers set traps to compromise team accounts.
Speaker 1: We're seeing more and more threat actors using you know,
Speaker 1: search engine optimization to present fake websites. When somebody's doing
Speaker 1: an online search, the website will come up at the
Speaker 1: top versus a legitimate when they're looking for and then
Speaker 1: they get the ability to deliver malicious software. So that's
Speaker 1: like a really interesting trend that people should think about.
Speaker 1: You know, we'll use to train people to look for
Speaker 1: phishing based on like grammar and urgency and things like that.
Speaker 1: That's changing.
Speaker 2: Fishing and browser based attacks are evolving to catch us
Speaker 2: where we spend our money, our attention, and our working hours,
Speaker 2: and as work itself happens more consistently in web browsers.
Speaker 2: JF sees the role of a cybersecurity leader evolving too.
Speaker 1: I've been doing this for like twenty five years now.
Speaker 1: That overall evolution, and we used to call it computer security.
Speaker 1: Network security was very infrastructure focused, and then there was
Speaker 1: an evolution to information security. You know, when I look
Speaker 1: at the role today, a lot of it and most
Speaker 1: of it is really how do you secure a business?
Speaker 1: And I think that's where strong cybersecurity leaders are evolving towards,
Speaker 1: is like how do you interface with your business? How
Speaker 1: do you understand the practices? There's an evolution in a
Speaker 1: variety of technologies that help bad guys sell. You also
Speaker 1: need to adapt based on the evolution of just the world.
Speaker 2: From Bloomberg Media Studios and Chrome Enterprise, this is Security Bookmarked.
Speaker 2: I'm your host, Kate Fazzini. I've been a cybersecurity professional
Speaker 2: and journalist for over twenty years, and on this podcast,
Speaker 2: I'm talking with leaders in gaming, finance, and manufacturing about
Speaker 2: what security looks like in a workplace that's moved to
Speaker 2: the cloud. Much of what we think of as cybersecurity
Speaker 2: was pioneered in financial services. In fact, a bank created
Speaker 2: the first CISO rule, and banks invented many of the
Speaker 2: guidelines that are now standard across a range of industries.
Speaker 2: According to the IMF, around twenty percent of all reported
Speaker 2: cyber incidents in the past twenty years have affected the
Speaker 2: global financial sector. So today I'm speaking with JF about
Speaker 2: what he's learned as a leader of cybersecurity and finance.
Speaker 1: Really, my role is twofold. One is to represent cybersecurity
Speaker 1: in the lines of businesses, but it's also to hear
Speaker 1: where they're heading towards from a business strategy standpoint.
Speaker 2: And I'll find out why he's flipping the script on
Speaker 2: enterprise security from simply defending the perimeter to transforming whole
Speaker 2: teams into early detection networks. Then I'll chat with David Adrian,
Speaker 2: security product manager for Chrome, about how businesses can implement
Speaker 2: this kind of strategy and set up a strong monitoring
Speaker 2: system to protect their teams. Going back to the trend
Speaker 2: of cyber attackers using fake websites as phishing lures, JF
Speaker 2: talked me through each step of their attack path.
Speaker 1: A lot of it starts with the endpoint. It starts
Speaker 1: via email or web browsing. Credential theft continues to be
Speaker 1: a driver of this and phishing phishing from two standpoints,
Speaker 1: either the credential theft that I mentioned, but also delivery
Speaker 1: of malwer via those channels is normally step one. What
Speaker 1: we continue to see in terms of exploitation is things
Speaker 1: like you know, not having multi factor authentication on remote access,
Speaker 1: on remote log in, or an element of like push fatigue.
Speaker 1: There are multi factor authentication solutions that send a pop
Speaker 1: up and then people just end up hitting the yes
Speaker 1: button somehow because they're just tired of seeing it.
Speaker 2: But tricking someone into signing into a website is just
Speaker 2: the first step, and.
Speaker 1: I think what's important for organizations is that there's multiple
Speaker 1: steps that are carried out by an actor. I think
Speaker 1: understanding these attack paths of how actors operate and carry
Speaker 1: out their activity is hugely important because the more you understand,
Speaker 1: the more you can design layered control. So what if
Speaker 1: an actor is able to obtain credentials, Well, those credentials,
Speaker 1: if you've got multi factor, they won't work right. They
Speaker 1: might get them part of the way, but they won't
Speaker 1: get them logged in. Let's say they're able to get
Speaker 1: logged in. Well, actors are going to start carrying out
Speaker 1: some element of reconnaissance on the network. So how would
Speaker 1: you detect that reconnaissance or how would you detect them
Speaker 1: setting up a foothold on the network. So it's really
Speaker 1: about as early detection as possible and understanding those early
Speaker 1: indicators of an adversary being present on the network.
Speaker 2: One of the biggest threats that JF and I talked
Speaker 2: about was an ongoing rise in ransomware attacks, where attackers
Speaker 2: don't go directly after a bank's money or even its data. Instead,
Speaker 2: they try to paralyze the bank itself, which can have
Speaker 2: serious consequences for the greater business world.
Speaker 1: The financial services ecosystem interfaces with utilities, infrastructure, all of
Speaker 1: the clearing and settlement, payment providers, the third parties that
Speaker 1: we rely on day to day.
Speaker 2: And protecting that entire ecosystem at a global scale that's daunting.
Speaker 2: So I asked Ji of how to secure a high
Speaker 2: stakes perimeter that goes way beyond the bank.
Speaker 3: Fauld.
Speaker 1: What's made this so interesting for bad guys is when
Speaker 1: you look at organizations that are historically stored sensitive information
Speaker 1: or process sensitive information, they have been highly regulated, they've
Speaker 1: had a lot of focus in terms of building up
Speaker 1: security controls. But by focusing on the disruption the availability
Speaker 1: aspect right like, ransomware, operators are now able to target
Speaker 1: a variety of organizations that don't store transactional information, that
Speaker 1: don't store personally identifiable information, and that causes broader disruption
Speaker 1: and I think that's why we take our role incredibly
Speaker 1: seriously in securing the broader financial ecosystem.
Speaker 2: That is a great answer because I think to the
Speaker 2: consumer or the banker who needs availability, it kind of
Speaker 2: doesn't matter if it's down because of ransomware or a hurricane.
Speaker 2: It's just wait, is it coming back up? And what
Speaker 2: is the alternate?
Speaker 1: Yeah, and I still remember back in my early days,
Speaker 1: we had one vendor that had a data center in
Speaker 1: Florida and another women in California. So you basically have
Speaker 1: a data center in hurricane territory and you have another
Speaker 1: one in earthquake territory. And you might go like, why
Speaker 1: is this part of your role to think like site
Speaker 1: resiliency strategy with clients, Well, our clients operate in a
Speaker 1: bunch of different industries and if they can't move money
Speaker 1: because people can't go into the office and they can't
Speaker 1: work from home, that has a direct impact on their
Speaker 1: day to day operations if they can't move money. And
Speaker 1: I think that's why ransomware has had such an impact
Speaker 1: because it attacks confidentiality, and integrity and availability, so actually
Speaker 1: three elements of the CIA triad, and that causes broader
Speaker 1: disruption and I think that also gains more focus because
Speaker 1: organizations are actually stricten as a result of these attacks.
Speaker 2: You know, businesses are always online now, especially after COVID,
Speaker 2: lots of people working remotely having to be on at
Speaker 2: all times. Customers expect you to be available at all times.
Speaker 2: Another source of constant surprises, I imagine is the third parties
Speaker 2: that you had to work with, and the hundreds and thousands,
Speaker 2: maybe hundreds of thousands. So how do you manage resilience
Speaker 2: when there are all of these other factors in the
Speaker 2: form of vendors and other companies that you're hinging your
Speaker 2: operations on. How do you deal with that in terms
Speaker 2: of resilience.
Speaker 1: You know, you mentioned the pandemic. The pandemic was a
Speaker 1: vector for adversaries. Everybody was after information for the pandemic, right,
Speaker 1: so it became a very interesting lure for bad guys
Speaker 1: to send like phishing emails, set up fake websites, So
Speaker 1: it became like a lure for social engineering. And then
Speaker 1: companies shifted very very quickly to work from home, and
Speaker 1: by doing so, they may have exposed infrastructure that may
Speaker 1: not has been as secure as it should to be
Speaker 1: exposed to the Internet and that gave threat actors a
Speaker 1: path into some organizations, but it also affected business practices.
Speaker 1: There were organizations that were ready for it, that had
Speaker 1: been working their resiliency plans for years for pandemics. The
Speaker 1: financial services sector is one of those areas where it's
Speaker 1: basically part of our DNA to build out strong resiliency
Speaker 1: and recovery mechanisms. And our role is to work with
Speaker 1: our business to rethink some of the controls and get
Speaker 1: the message out, the awareness message out to our clients.
Speaker 1: And it gets really interesting when you start to break
Speaker 1: down resiliency and recovery for organizations as a result of
Speaker 1: things like a ransomware event.
Speaker 2: Then I am also thinking of vulnerability management, which we
Speaker 2: kind of never it's not very fun to talk about.
Speaker 1: I think vulnerable management foundational to everything, right.
Speaker 2: The patching, the kind of day to day You know,
Speaker 2: there's a lot of talk about alert fatigue, but you
Speaker 2: have people who need to access the web, who are
Speaker 2: on their browsers from wherever they are all the time.
Speaker 2: How do you deal with web browser security? What is
Speaker 2: sort of the best practices today versus what they were
Speaker 2: when you first started.
Speaker 1: That's a great question. I get the point around alert
Speaker 1: fatigue and volumes. But it's really about thinking through the
Speaker 1: entire life cycle of that attack. So going back to like,
Speaker 1: how do you drive awareness for employees not to click
Speaker 1: on links. If they do click, how are you filtering
Speaker 1: the sites that they're going to that could be malicious.
Speaker 1: Interestingly enough, most systems that assist in like categorization of
Speaker 1: websites have a functionality that blocks. Uncategorized websites mean websites
Speaker 1: that are too new to have a category associate with them,
Speaker 1: and oftentimes these are the ones that the threat actors
Speaker 1: have just recently set up to look like a legitimate
Speaker 1: website that you know somebody will click on, and you
Speaker 1: can actually see a significant reduction of that browsing risk
Speaker 1: if you're eliminating websites that are too new, that have
Speaker 1: just been stood up, that have like a certificate mismatch
Speaker 1: and things like that.
Speaker 2: When you think about enterprise security and finance, and especially
Speaker 2: about protecting teams, what are the most critical threats that
Speaker 2: you're watching out for.
Speaker 1: I think there's two aspects to this. We often talk
Speaker 1: about how do we protect the workforce, but it's also
Speaker 1: like how do we use our workforce? As the first
Speaker 1: indicator of an attack or of targeting. So you know,
Speaker 1: one of the things that's like hugely important is how
Speaker 1: do you mine the reports that you're getting from end
Speaker 1: users around cyber issues or targeting. We test our employees
Speaker 1: for phishing on a quarterly basis. The first thing we
Speaker 1: were doing was we were measuring click rates and then
Speaker 1: we thought to ourselves, well, let's start measuring the reporting
Speaker 1: rate because what we want to know is if somebody
Speaker 1: is going to get this, are they going to forward
Speaker 1: it to us? But then it was also measuring the
Speaker 1: forward rate, meaning people's reaction often with a phishing email
Speaker 1: is they send it to their colleagues and they go,
Speaker 1: is this legit? So they're actually amplifying the adversaries reach
Speaker 1: by forwarding it to a bunch of people who may
Speaker 1: click on it who would have never gotten it. So
Speaker 1: it's really how do you think through the awareness for
Speaker 1: people with the most common types of attacks, But also
Speaker 1: so how do you turn your entire workforce into early
Speaker 1: detection sensors where they're reporting what they're seeing to the
Speaker 1: cybersecurity organization so they can promptly take action on it.
Speaker 1: And that is a game changer in the early stages
Speaker 1: of an attack because people will notice, hey, there's something
Speaker 1: wrong here. I have never seen this happen before. It
Speaker 1: might be a glitch, but it also might be a
Speaker 1: bad guy, a threat actor that's doing something that's absolutely
Speaker 1: unexpected that just revealed their presence on the network. Organizations
Speaker 1: need to be ready and continuously adapting to the threat landscape.
Speaker 2: Jf's strategy called out the importance of monitoring for potential
Speaker 2: threats and risky activities, but when monitoring means catching a
Speaker 2: fake disaster relief website leaders need to recognize how opening
Speaker 2: a browser for work shapes people's behavior.
Speaker 3: Security certainly isn't top of mind for most users. Most
Speaker 3: of the time, they're trying to get their work done,
Speaker 3: and they're probably also trying to get their life done.
Speaker 2: That's David Adrian, security product manager for Chrome.
Speaker 3: For most people, browsing the Internet may not seem like
Speaker 3: a big deal, But if you're an administrator for a
Speaker 3: bank or other organizations that have a lot of customer data,
Speaker 3: then keeping your employees safe on the web should be
Speaker 3: even more top of mind.
Speaker 2: He told me how he would approach protecting teams from
Speaker 2: cyber attacks that take advantage of search.
Speaker 3: Chrome runs a feature called safe Browsing, which attempts to
Speaker 3: warn on sites that are known to be fishing, sites
Speaker 3: known to be malware, and it doesn't reveal what sites
Speaker 3: that you're visiting. You can opt into a version of
Speaker 3: it called Enhance Safe Browsing, which is able to do
Speaker 3: the checks in real time by sending them back to
Speaker 3: the safe browsing server. That could be a good sort
Speaker 3: of trade off to make if you want additional protection
Speaker 3: against malware and against phishing, regardless of they're being fished
Speaker 3: at work or fished at home on their work device.
Speaker 3: And in fact, safe browsing is like such a popular
Speaker 3: feature that it's also an open API leveraged by some
Speaker 3: other browsers.
Speaker 2: So of course you're dealing with data on these vulnerabilities
Speaker 2: that is at the scale of Google, So you have
Speaker 2: access to a great deal of very relevant data about vulnerabilities.
Speaker 2: And not only that, but what of those vulnerabilities can
Speaker 2: actually lead to a problem.
Speaker 3: Absolutely. Yeah, Google is crawling the web every day for
Speaker 3: its search engine, and as part of that, it's also
Speaker 3: seeing malware, and that sort of same crawling is powering
Speaker 3: safe browsing, and safe browsing is something that you just
Speaker 3: get out of the box with Chrome, among other end
Speaker 3: user features like site isolation, then we have other features
Speaker 3: that are built with enterprises and businesses in mind. For example,
Speaker 3: with Chrome enter Price Premium, you can implement filters based
Speaker 3: on website categories that you've defined, and you can get
Speaker 3: reporting that shows how your teams are handling those filters. So,
Speaker 3: for example, our people get fatigued by their alerts and
Speaker 3: clicking through regardless. Having that kind of information means teams
Speaker 3: can get visibility into what's happening in their fleet and
Speaker 3: they can take action based on their findings.
Speaker 2: This is great because one of the big intractable long
Speaker 2: time problems in cybersecurity is just a lack of visibility
Speaker 2: into process and how things are working in the web,
Speaker 2: apps and web browsers, which is realistically how people are
Speaker 2: actually working today in the modern office workspace.
Speaker 3: Absolutely, And like the old way of looking at this
Speaker 3: would just be what programs did you launch? And it'd
Speaker 3: be like, oh, well you launched a web browser and
Speaker 3: it's like okay, well what does that mean? Right? You
Speaker 3: could have done anything inside of that now, So you
Speaker 3: need to know what's happening inside.
Speaker 2: Yeah, and thinking about where the work is actually happening right,
Speaker 2: because too often, I think in security we've gotten used
Speaker 2: to looking at the people in a certain way. They're
Speaker 2: just people making mistakes, people forwarding emails, people clicking on
Speaker 2: dangerous links. We look at people and see them as
Speaker 2: weak points. But so we could be treating every one
Speaker 2: of those people as a point of defense. What do
Speaker 2: you think about this growing emphasis on resiliency and managing
Speaker 2: threats and what is the role of teams in creating
Speaker 2: that resiliency.
Speaker 3: Yeah, I think this idea of cybersecurity resilience is becoming
Speaker 3: more and more popular, especially in the financial services sector
Speaker 3: where the stakes are really high. Breaches are going to happen,
Speaker 3: and mitigating and responding to them should be something that
Speaker 3: takes five minutes, not five days or five years. I
Speaker 3: talked last time about how strong an identity is really important.
Speaker 3: Once you have strong identity, you can start doing access
Speaker 3: controls and authorization and limiting who has access to what
Speaker 3: instead of everyone having access to everything. The more that
Speaker 3: you can do that, and then you conpair that with
Speaker 3: audit logs. Audit logs are the key to any security monitoring.
Speaker 2: Yes, and whenever you compare different pieces of information that
Speaker 2: you have vulnerabilities. With audit logs, for instance, you start
Speaker 2: to get that matrixed view which allows you to take
Speaker 2: action in a much more meaningful way.
Speaker 3: What you want is that people regular day to day
Speaker 3: web browsing is instrumented and understood as a baseline, so
Speaker 3: that when something anomalist happens, it's detected as being anomalists.
Speaker 3: You can't have an anomaly without a baseline. Ideally, you
Speaker 3: want that detection to happen automatically, whether that's just because
Speaker 3: you've it's something very simple like blocking a copy paste
Speaker 3: from your CRM and it's some sort of public document,
Speaker 3: or it's something more complicated about detecting a download from
Speaker 3: a site that normally doesn't have a download. And then
Speaker 3: where Chrominer price premium can really help is identifying the
Speaker 3: non standard usage, is the anomalies and remediating those. You
Speaker 3: can get an audit log of all of the events
Speaker 3: that are happening in Chrome, all of the user interactions
Speaker 3: and so on, and that is exposed through the cloud,
Speaker 3: either directly to you via APIs, or it can integrate
Speaker 3: with a sort of third party sim provider and hook
Speaker 3: into your security team's workflow to look for anything out
Speaker 3: of the ordinary, whether that's through integrating with data loss
Speaker 3: prevention or just more specific rule sets on hey, this
Speaker 3: thing looks different than normal. And then in that world,
Speaker 3: you're not relying on the users to always make the
Speaker 3: right decision, but you're trying to detect when the users
Speaker 3: haven't made the right decision or are doing something weird.
Speaker 3: And then if you've paired that with all of the
Speaker 3: other best practices, then hopefully your time to mitigation is
Speaker 3: very fast and it's actually a very low impact event
Speaker 3: if something bad did happen.
Speaker 2: Yeah, I know, we have so many amazing technology solutions now,
Speaker 2: but it also reminds me of how difficult it can
Speaker 2: be for a security team to implement the new technologies
Speaker 2: that they want to have. And that's where again we
Speaker 2: go back to the people involved. You really have to
Speaker 2: have strong leadership who are listening in to their security
Speaker 2: teams and their experts and able to make the right
Speaker 2: decisions for the company in terms of what kind of
Speaker 2: security measures are going to work the best for them
Speaker 2: and the level of visibility that they want.
Speaker 3: Absolutely, I think that's this move to management becoming something
Speaker 3: that the security team or whoever is responsible for security,
Speaker 3: that the management of the web browser or of a
Speaker 3: phone or of the device is actually a security product,
Speaker 3: like rather than just an IT product, because all of
Speaker 3: sort of modern security operations is about identifying who's logging
Speaker 3: in a web browser and securing that web browser, whether
Speaker 3: that browser is on a laptop, that browser is on
Speaker 3: a phone, it's on a company owned phone, or it's
Speaker 3: on a personal phone. It's ensuring that whatever device the
Speaker 3: user is going to, some browser signing it on has
Speaker 3: some minimum security posture. You've strongly authenticated them, you can
Speaker 3: wipe data if you need to. And all of these
Speaker 3: things might have previously been something that you'd just been like, oh,
Speaker 3: that's something that just it has to deal with for
Speaker 3: IT related reasons, and it's like, you know, actually, these
Speaker 3: problems are really deeply central to the security story of
Speaker 3: a modern workplace as well.
Speaker 2: To learn more about how the most trusted enterprise browser
Speaker 2: can help protect your organization, visit Chrome Enterprise dot Google.
Speaker 2: Next time, on security Bookmarks, i'll talk to Curtis Minder,
Speaker 2: a renowned ransomware negotiator, about the security challenges he's tackled.
Speaker 2: In the manufacturing industry.
Speaker 4: We have been the manufacturer of this particular product for
Speaker 4: almost one hundred years, and the way that we manufacture
Speaker 4: this product and the materials we use to manufacture this
Speaker 4: product are our trade secret. I am concerned that that
Speaker 4: information has left the building, and I won't know about
Speaker 4: that risk for some time until a competitor of mine
Speaker 4: makes the exact same product in five years from now
Speaker 4: and puts me out of business.
Speaker 2: Security Bookmarked is a podcast from Bloomberg Media Studios and
Speaker 2: Chrome Enterprise. Subscribing your podcast app so you don't miss
Speaker 2: our newest episode. I'm Kate Fazzini. Thanks for listening.