Speaker 1: Really.
Speaker 2: It started relatively innocently. You have an engineer who's looking
Speaker 2: at the server and looking at files on the server.
Speaker 3: This is a story about a cyber attack on a
Speaker 3: video game studio. As a software engineer was hard at
Speaker 3: work on the company's next big game. He saw one
Speaker 3: of his files had been moved by an impostor in
Speaker 3: their network.
Speaker 2: So immediately reaches out to the head of it, the
Speaker 2: main IT guy, and says, who is this? Who owns
Speaker 2: this account?
Speaker 3: The main IT guy was the super admin, so he
Speaker 3: knew right away that something was wrong and this wasn't
Speaker 3: a normal account.
Speaker 2: So actually what he did just shut down all the accounts,
Speaker 2: killed all sessions, locked everybody out, required a password change
Speaker 2: while he could dig into this because he immediately was
Speaker 2: pretty freaked out about what was happening. And what they
Speaker 2: realized was someone had come in and made a number
Speaker 2: of accounts as super admin and had been poking around
Speaker 2: and looking at everything and even exfltrading information.
Speaker 3: They had no idea how long it's had been going on,
Speaker 3: how much data had been extracted, or what else was
Speaker 3: looking in their network.
Speaker 2: They started digging into it, and they found locker software,
Speaker 2: so ransomware software that would encrypt, and it was on
Speaker 2: the server and it was ready to be deployed, but
Speaker 2: it hadn't been deployed.
Speaker 3: Catching the ransomware didn't mean the company was safe. They
Speaker 3: still had to investigate all of their files and their
Speaker 3: accounts searching for any other signs of attack. And worst
Speaker 3: of all, they had to stop working on the new game.
Speaker 2: Those minutes count and those days count. So every day
Speaker 2: you can't have your employees behind keyboard is our days
Speaker 2: that are going to be delayed. This is making it
Speaker 2: even worse. And this Iiquy kind of becomes a hero
Speaker 2: of the story because it was a really a courageous
Speaker 2: call that he made to do this, knowing what it
Speaker 2: was going to cost the company. They probably would have
Speaker 2: had to be a huge.
Speaker 3: Ransom from Bloomberg Media Studios and Chrome Enterprise. This is
Speaker 3: Security Bookmarked. I'm your host, Kate Fazzini. I've been a
Speaker 3: cybersecurity professional and journalist for more than twenty years, and
Speaker 3: on this podcast, I'm talking with leaders in gaming, finance,
Speaker 3: and manufacturing about what security looks like in a workplace
Speaker 3: that's moved to the cloud. The video game industry is
Speaker 3: a massive business, bringing in over three hundred billion dollars
Speaker 3: per year. That's nearly ten times the size of Hollywood's
Speaker 3: global box office revenue. But as the gaming business keeps growing,
Speaker 3: more and more teams are accessing key systems and data
Speaker 3: so they can do their jobs, and that means we've
Speaker 3: seen a rise in account takeovers. So today I'm speaking
Speaker 3: with Adam Murray.
Speaker 2: I am the chief Information security officer at Arctic Wolf.
Speaker 2: We are a managed detection and response company SAC as
Speaker 2: a service and a concierge model, so that we make
Speaker 2: sure that we're not only providing them security today, but
Speaker 2: also make sure that we take them on a security
Speaker 2: journey to improve their security over time.
Speaker 3: I'm going to unpack add a story about helping a
Speaker 3: game studio survive a ransomware attack to understand the account
Speaker 3: security risks that all companies need to get control of.
Speaker 3: Then I'll chat with David Adrian, security product manager for Chrome,
Speaker 3: about why phishing attacks are so difficult to stop and
Speaker 3: why this doesn't have to be the case. In twenty
Speaker 3: twenty three, ransomware attacks in the gaming industry were up
Speaker 3: more than thirty percent year over year, and they can
Speaker 3: freeze at game studio's entire operation causing major delays. In
Speaker 3: this story from Adam, the game studio caught the ransomware
Speaker 3: threat early, but then they realized the attacker had also
Speaker 3: stolen their intellectual property, including details about new releases, videos
Speaker 3: and images that they weren't ready to share with the world.
Speaker 2: We call it double extortion, where I've sealed up your code, right,
Speaker 2: and then not only am I saying pay me the
Speaker 2: ransom where you don't have access to it, I'm saying
Speaker 2: I will release this to the world unless you pay me.
Speaker 2: So I would say video game companies are likely to
Speaker 2: be targeted by these ransomware groups mainly because video games
Speaker 2: are likely to pay the ransom if you're able to
Speaker 2: successfully lock up their code and get their backups and
Speaker 2: lock up their backups as well.
Speaker 3: And then finally, once they put out all the fires,
Speaker 3: they could figure out how did this attacker get access
Speaker 3: in the first place.
Speaker 2: There was actually a phishing message as at all you know,
Speaker 2: very often is it was. It was a phishing message
Speaker 2: to this it individual, to this person, the.
Speaker 3: Very person who had caught the intruder and pulled the alarm, and.
Speaker 2: You know, he clicked on the link and it take
Speaker 2: him to a web page, then a log and prompt
Speaker 2: to come up. He put in his credentials. They did
Speaker 2: not have MFA, so the attacker was able to get
Speaker 2: those credentials, then log in and quickly make other accounts
Speaker 2: and get off of that it person's account so they
Speaker 2: wouldn't notice. Social engineering works and it worked really well
Speaker 2: and it's why attackers use it so often. There are
Speaker 2: lots of other protections they could have had in place,
Speaker 2: but yeah, that was how the attackers got in, and
Speaker 2: then we're using the other accounts to worm their way
Speaker 2: through all of the servers and the whole environment.
Speaker 3: Later in the episode, i'll share my conversation with David
Speaker 3: Adrian at Chrome about how leaders can defend their companies
Speaker 3: against phishing. But first Adam and I are going to
Speaker 3: unpack what this one breach shows about the cybersecurity risks
Speaker 3: that gaming companies face and what they can do to
Speaker 3: be more resilient to attacks.
Speaker 2: Video games is a large industry and so they're all
Speaker 2: kinds of companies involved, and depending on the size and
Speaker 2: the type of game, you'll have very different levels of security,
Speaker 2: and that security will be leveraged at these different problems
Speaker 2: at different levels. Let me give you an example, with
Speaker 2: the rise of online gaming, so massive multiplayer online games,
Speaker 2: there is a huge incentive for these companies to prevent cheating.
Speaker 2: So you have these video game companies and they're spending
Speaker 2: millions of dollars and using the latest cutting edge technology
Speaker 2: AI to detect and defeat cheating on their games and
Speaker 2: their online games. They're leveraging all of this great technology
Speaker 2: to do that, and then on their corporate side, they
Speaker 2: don't have MFA to protect their main accounts. It is
Speaker 2: understandable that they focus on the anti cheating because that
Speaker 2: directly goes to their bottom line because if they're cheating,
Speaker 2: then players are going to go elsewhere, and there are
Speaker 2: other game companies that would love for that to happen.
Speaker 2: So it makes sense while they do this, But you
Speaker 2: have to understand you could have a breach that costs
Speaker 2: you millions, tens of millions of dollars.
Speaker 3: You've said that companies shouldn't treat data breaches or ransomware
Speaker 3: attacks as part of the cost of doing business. Tell
Speaker 3: me a little bit more about that.
Speaker 2: I mean, I guess if you're a business, everything is
Speaker 2: the cost of doing business, right Like, everything is going
Speaker 2: to your bottom line. But what I mean, is there
Speaker 2: are things you can do today that will greatly lower
Speaker 2: the likelihood that you will have a breach. And you know,
Speaker 2: my whole job is to prevent breaches, So I think
Speaker 2: they're terrible. We should all leverage security against them. But
Speaker 2: it might be seen as you know, a risk worth
Speaker 2: taking or a cost of doing business, or maybe we
Speaker 2: won't get hit with an attack, and you know, maybe
Speaker 2: I want to spend money on making my render look
Speaker 2: that much better and the graphics look that much better,
Speaker 2: And I just don't see how security is hitting that.
Speaker 2: It's the similar thing many companies do, and then when
Speaker 2: they get breached, they really regret it. Because if you've
Speaker 2: been developing a game for three years, an attacker comes
Speaker 2: in and they're able to deny you access to all
Speaker 2: of your information, your source code, your art assets, all
Speaker 2: of that, and get your backups. You are in a
Speaker 2: world of hurt. That is a very bad position to
Speaker 2: be in, and the likelihood that you're going to pay
Speaker 2: the ransom is very high. I don't recommend that, obviously,
Speaker 2: my stance is not to pay ransoms, but.
Speaker 3: Yeah, it's almost I can't imagine not paying it in
Speaker 3: that because if your whole entire company is at stake.
Speaker 3: It's the entire lifeblood of your company, the reason for
Speaker 3: its existence basically exactly.
Speaker 2: It is literally your entire business. And so then you're
Speaker 2: going to want to start thinking as an organization and
Speaker 2: you try to say where are attackers being successful.
Speaker 3: So when you think of enterprise security for game studios,
Speaker 3: what are the most critical threats that you're watching out for.
Speaker 2: You know, there are many threat or attack reports that
Speaker 2: come out or data breach reports that come out each year,
Speaker 2: artic Wolf as one as well, and if you look
Speaker 2: at these, you'll see the primarily attackers are success full
Speaker 2: in doing basically one of two things. Either attacking accounts
Speaker 2: so you can think user name, password, MFA, attacking that
Speaker 2: and getting access through that, or attacking vulnerabilities, so looking
Speaker 2: at the code, looking at the configuration of cloud software,
Speaker 2: SaaS software, whatever it is, and being able to exploit
Speaker 2: those vulnerabilities and get in. So if you can really
Speaker 2: look at this and say, how do I protect identities
Speaker 2: at my company and how do I make sure that
Speaker 2: we're patching and updating and not introducing vulnerabilities and misconfigurations.
Speaker 2: If you can do those things to the right level,
Speaker 2: you're going to protect your company and you certainly won't
Speaker 2: be the low hanging fruit where attackers will try to
Speaker 2: attack you.
Speaker 3: What are some other ways that the companies can be resilient.
Speaker 2: If you want to get really technical, we can talk
Speaker 2: about shift left. In other words, you want to create
Speaker 2: games and systems that are secure, so you want to
Speaker 2: make sure you're baking security in from the very beginning,
Speaker 2: so when you're still like whiteboarding the design of what
Speaker 2: you're trying to do in the game, add a threat
Speaker 2: model to that process from the very beginning, thinking about
Speaker 2: how could somebody take advantage of this, how could it
Speaker 2: go wrong? And by the way, you can also add
Speaker 2: anti cheat in there at the beginning too and help
Speaker 2: solve that problem at the very beginning, so you're not
Speaker 2: trying to tack it on at the end. And then
Speaker 2: when you have your detection and prevention methodologies out there,
Speaker 2: they're going to be much more effective because the underlying
Speaker 2: system itself is resistant to attack and resistant to cheating.
Speaker 3: Game developers are obviously digital first. When you think about
Speaker 3: the day to day work and collaboration that goes on
Speaker 3: behind the scenes at the enterprise level, I'm interested in
Speaker 3: how do workers collaborate. You're in an industry where you're
Speaker 3: working with people who are specialists and extraordinarily talented, but
Speaker 3: maybe like at one thing, and that guy lives in Aspen,
Speaker 3: and then you know the other guy lives in the
Speaker 3: forests of Oregon, and you've got to connect all of
Speaker 3: these teams in different areas. How do you handle collaboration
Speaker 3: across environments like that.
Speaker 2: Yeah, so it's an interesting question in security. We've been
Speaker 2: doing this for a long time, collaborating across time zones,
Speaker 2: using various tools, different SaaS, apps or other applications to
Speaker 2: collaborate and communicate. That means a lot of very sensitive
Speaker 2: information as being passed through these suites of software. And
Speaker 2: so if you can think of one thing, like the browser,
Speaker 2: so much work happens right in the browser, and many
Speaker 2: companies just don't think of the security of that particular
Speaker 2: piece of software. If we dig into that a little bit,
Speaker 2: you know, are you hardening that piece of software. Are
Speaker 2: you making sure that everyone's using the same browser so
Speaker 2: you can have the same type of security across the
Speaker 2: entire organization. Are you making sure they're not sinking personal
Speaker 2: accounts that can bring in different extensions that they're using
Speaker 2: at home that do backups or copy and now you
Speaker 2: have information going places you weren't thinking of. So really
Speaker 2: making sure that each one of those pieces of software
Speaker 2: is secured, especially the browser, is a really important consideration,
Speaker 2: especially if we're talking about companies that are collaborating, you know,
Speaker 2: with lots of remote employees and using software to do that.
Speaker 2: There is one third aspect to this, and it's actually
Speaker 2: illustrated by the story I told, and that is you've
Speaker 2: got to have a good security culture. You've got to
Speaker 2: train your people to be wary of social engineering attacks
Speaker 2: like phishing and be resistant to those. You know, you
Speaker 2: can have technologies to protect against it. But there's a
Speaker 2: reason why so many attackers use social engineering is because
Speaker 2: it's very very successful, because it's pretty easy to trick
Speaker 2: human beings.
Speaker 3: If you're leading a gaming company, your entire product is software,
Speaker 3: and that product is constantly being accessed, tested and updated
Speaker 3: by your teams. The same goes for your IP designs, assets, code,
Speaker 3: marketing trailers showing new characters, new content, and it all
Speaker 3: lives online. So how do you keep your own accounts
Speaker 3: from being used against you?
Speaker 4: So, if I'm a CSO or I'm in charge of
Speaker 4: security an organization. The number one thing that I would
Speaker 4: be focusing on is deploying strong, unfishable authentication to all
Speaker 4: of my employees.
Speaker 3: That's David Adrian, a security product manager for Chrome.
Speaker 4: I focus mostly on network security, but I help everything
Speaker 4: up and down the stack to make sure that we're
Speaker 4: building Chrome to be as secure as possible, from the
Speaker 4: application through the network to the cloud.
Speaker 3: When I brought up ransomware attacks and gaming, he picked
Speaker 3: up on account security and how important it is to
Speaker 3: plan for what happens when an employee account is compromised.
Speaker 4: Game assets or designs are I think the crown jewels
Speaker 4: that gaming companies are trying to protect, and so I
Speaker 4: feel for them in the situation and that they need
Speaker 4: to figure out like how do we make this run fast,
Speaker 4: how do we get access to everyone that needs it?
Speaker 4: But also how do we, you know, make sure that
Speaker 4: if someone bad gets in, they don't get everything. When
Speaker 4: things go wrong, they go wrong bad and you risk
Speaker 4: all of you your game assets getting encrypted and ransomwared.
Speaker 4: And in many industries, the high value accounts are sort
Speaker 4: of the administrators of the organization who might have access
Speaker 4: to create new users in the gaming industry, there might
Speaker 4: be a broader set of targets because any developer who
Speaker 4: can build the game likely has access to all of
Speaker 4: the assets for the game and able to get in
Speaker 4: and they get access, let's say, as anybody who has
Speaker 4: access to the underlying game assets, there might not even
Speaker 4: need to be a lot of escalation of privileges. Sure,
Speaker 4: if they get an administrator, they could create their own account,
Speaker 4: but if they get a game developer, they might just
Speaker 4: be able to walk away with all of the assets
Speaker 4: for the game by default, because the developers already have
Speaker 4: access to it.
Speaker 3: And so we zeroed in on the moment when an
Speaker 3: attacker breaks into a company account through a phishing link.
Speaker 4: The most common sort of attack factor is still phishing.
Speaker 4: It's not too hard to find who's working for some
Speaker 4: company and then try and figure out what their email is,
Speaker 4: and once you know their email, you can try and
Speaker 4: start phishing them.
Speaker 3: I think I had somebody tell me once that teaching
Speaker 3: people to not get fish is like teaching them not
Speaker 3: to fall in love. It's never going to happen.
Speaker 4: I would flip it around a little bit and say
Speaker 4: that trying to solve phishing with like phishing training fake
Speaker 4: phishing emails. That type of thing. Even if it works
Speaker 4: ninety nine point nine nine percent of the time, the
Speaker 4: point zero one percent that it doesn't is enough for
Speaker 4: everything to go wrong. Right, We've seen one phishing attempt
Speaker 4: that succeed have impacts on everything ranging from gaming companies
Speaker 4: to elections, and so, sure, you can try and like
Speaker 4: get your employees to hide their emails, you can append
Speaker 4: random digits to their emails, but at the end of
Speaker 4: the day, eventually something's going to leak and someone's going
Speaker 4: to get fished.
Speaker 3: So let's talk about phishing protection. Obviously, these people are
Speaker 3: going to get spearfished. It will happen, So what are
Speaker 3: some of the protections available to them.
Speaker 4: So the good news is that we have effective solutions
Speaker 4: against fishing. I think if I were a CSO or
Speaker 4: a CIO, like, the number one thing that I would
Speaker 4: be doing is deploying strong, unfishable authentication. And while that
Speaker 4: seems kind of straightforward, like let's just authenticate the people
Speaker 4: that work for me and make sure they work for me,
Speaker 4: that is probably most of the challenge for a lot
Speaker 4: of security engineering teams is making sure that that can happen.
Speaker 4: The easiest context to deploy them is web browsers for
Speaker 4: enterprise users, where you have this source of truth where
Speaker 4: you can say, hey, I know what all my employees are.
Speaker 4: I'm going to ship them all some sort of token
Speaker 4: to plug into their computers, making sure that every work
Speaker 4: application that every employee goes through has to use one
Speaker 4: of these authentication methods and does it from a managed browser.
Speaker 4: And so if you can deploy those authentication methods and
Speaker 4: you can make all logins only go through a web
Speaker 4: browser and only use those authentication methods, you solve phishing.
Speaker 4: With Chrome, enterprise premium organizations can access a centralized enforcement
Speaker 4: point for all of their endpoint security in controls. This
Speaker 4: allows for endpoint visibility across the entire enterprise network. IT
Speaker 4: and security teams can deploy advanced security capabilities like advanced DLP,
Speaker 4: like context A wear access controls, and then you can
Speaker 4: get in depth reporting for all of those features and
Speaker 4: so deploying stronger authentication that can actually be more user
Speaker 4: friendly when done right, in the sense that it lets
Speaker 4: people act how they would naturally and not have to
Speaker 4: try to treat every email adversarially like it might be
Speaker 4: a phishing email. Because with the right authentication, they'll actually
Speaker 4: be protected by default, so if you send them a
Speaker 4: fishing link and they get tricked by it, it doesn't
Speaker 4: matter and the login won't work for the attacker.
Speaker 3: To learn more about how the most trusted enterprise browser
Speaker 3: can help protect your organization, visit Chrome Enterprise dot Google.
Speaker 3: Next time on Security Bookmarked, i'll talk strategy with jf Lego,
Speaker 3: Deputy Chief Information Security Officer at JP Morgan Chase.
Speaker 1: So it's really how do you think through the awareness
Speaker 1: for people with the most common types of attacks, but
Speaker 1: also how do you turn your entire workforce into early
Speaker 1: detection sensors.
Speaker 3: Security Bookmark is a podcast from Bloomberg Media Studios and
Speaker 3: Chrome Enterprise. Subscribe in your podcast app so you don't
Speaker 3: miss our newest episode. Kate Fazzini, thanks for listening.