Episode 3 part two
1
00:00:14,699 --> 00:00:18,202
What are the things that would encourage you to or make you think about engaging?
2
00:00:18,202 --> 00:00:21,865
Or are the things to weigh up, perhaps is the best way to put it.
3
00:00:21,865 --> 00:00:22,826
Yeah.
4
00:00:22,826 --> 00:00:23,606
So.
5
00:00:24,098 --> 00:00:31,264
I think it's useful to separate out the concept of engaging with the threat actor and
paying the ransom.
6
00:00:31,264 --> 00:00:33,265
know, they're two different things.
7
00:00:33,546 --> 00:00:40,371
And conceptually, sometimes organizations can take some time to accept that.
8
00:00:40,412 --> 00:00:46,117
They can have an allergic reaction to engaging with a threat actor because they think it's
akin to paying the ransom and it's not.
9
00:00:46,117 --> 00:00:52,642
So some of the reasons why you might decide to engage, you might want to
10
00:00:53,038 --> 00:00:54,359
play for a bit of time.
11
00:00:54,359 --> 00:01:01,823
That time might help you secure the environments, eradicate the threat actor from the
environment, cetera, sort your backups out.
12
00:01:02,303 --> 00:01:08,486
You might want to obtain proof of life, i .e., that they've actually got the data they
claim to have got.
13
00:01:08,887 --> 00:01:18,772
Another reason might be, it might help you with the process of attribution, knowing who
the threat actor actually is, perhaps during the negotiation.
14
00:01:19,493 --> 00:01:22,294
Further intel might arise which might help you.
15
00:01:22,638 --> 00:01:24,899
be more confident about that attribution.
16
00:01:25,400 --> 00:01:37,106
And then does attribution, so just as an aside, can that affect your strategy as well on
the basis of say, it's only too much like a hotel guide, but some are more reliable,
17
00:01:37,106 --> 00:01:38,257
better performers than others.
18
00:01:38,257 --> 00:01:51,044
that if you're dealing with someone who's got a poor reputation for returning data or
deleting data, bad reputation for dumping it, or a reputation for taking ransoms and then
19
00:01:51,044 --> 00:01:51,764
not.
20
00:01:52,114 --> 00:01:55,976
providing keys that will factor in.
21
00:01:56,497 --> 00:02:00,939
So if we're talking about, so there might be three reasons potentially why attribution
would be useful.
22
00:02:00,939 --> 00:02:08,444
First one would be sanctions and I'll let the two people I'm sitting with who are much
more qualified to talk about that than I am.
23
00:02:08,444 --> 00:02:12,566
But having an understanding of who they are around the sanctions point.
24
00:02:12,566 --> 00:02:15,428
The second, to help your containment efforts.
25
00:02:15,428 --> 00:02:19,854
Do we know this group or this sub entity within the as a service function they're working?
26
00:02:19,854 --> 00:02:22,025
Do we know that they like to get in via a certain way?
27
00:02:22,025 --> 00:02:24,776
Have we made sure that we've looked and locked that down?
28
00:02:25,897 --> 00:02:35,731
that mean that with that ransomware as a service, back in the day perhaps, if you saw a
particular style of operation of particular tools being deployed, you would say, know it's
29
00:02:35,731 --> 00:02:36,281
that group.
30
00:02:36,281 --> 00:02:44,315
Whereas now, because you've got that sort of franchise system, you might recognize the
tools, but it might not be the creator of the tools who's responsible.
31
00:02:44,315 --> 00:02:47,086
It might be someone who's rented them.
32
00:02:47,190 --> 00:02:51,694
That link is certainly less clear these days.
33
00:02:51,694 --> 00:02:53,355
It's a marketplace.
34
00:02:53,455 --> 00:02:53,775
Yeah.
35
00:02:53,775 --> 00:02:56,628
You've also got the idea of access brokers, haven't you?
36
00:02:56,628 --> 00:03:00,520
So people who just specialize in breaking in essentially.
37
00:03:00,921 --> 00:03:04,985
So once they've compromised in environments, that might be as far as they go.
38
00:03:04,985 --> 00:03:12,350
Then they'll sell that access to another party who will then deploy the ransomware and do
the extortion and so on.
39
00:03:12,491 --> 00:03:16,887
So Oli might be looking at the way someone's accessed the system, but that doesn't mean
that the person who...
40
00:03:16,887 --> 00:03:21,739
did that is a person who will ultimately be engaging with, who'd be making the demands.
41
00:03:21,739 --> 00:03:34,713
And you know, that circles back sometimes in an insurance sense because sometimes there'll
be a condition in the policy that, you know, a ransom payment under a policy might not be
42
00:03:34,713 --> 00:03:45,786
authorized unless you do know who the threat actor is because the insurance might not be
comfortable paying a ransom if that particular threat actor has got a track record of
43
00:03:45,858 --> 00:03:50,882
then not honoring the ransom payments and not giving you the data back, not deleting the
data.
44
00:03:51,903 --> 00:03:58,109
So there are insurance ramifications as well to the idea of attribution.
45
00:03:58,109 --> 00:04:03,974
And that third point there is critical, the point around trust, which I appreciate is a
slightly ridiculous statement.
46
00:04:03,974 --> 00:04:14,102
We're talking about how much can you trust someone that's ransomed your organization, but
it is something that you kind of have to walk up to in these cases.
47
00:04:14,146 --> 00:04:21,092
There are some things that you can trust reasonably, but they get complicated, like you
saying, they get messy.
48
00:04:21,092 --> 00:04:28,718
So there are lots of cases that Jamie and I have worked together where threat actors have
claimed to have stolen data and haven't.
49
00:04:28,718 --> 00:04:32,101
So that's probably not a thing that you can necessarily trust has happened.
50
00:04:32,101 --> 00:04:34,643
You wanna validate that, that's the proof of life.
51
00:04:34,803 --> 00:04:37,405
You wanna ask for a list of all the data.
52
00:04:37,465 --> 00:04:40,338
They should then hopefully give you a choice.
53
00:04:40,338 --> 00:04:43,350
We would like this file back to prove they have actually stolen it.
54
00:04:43,350 --> 00:04:44,490
kind of thing.
55
00:04:45,091 --> 00:04:51,116
What you can probably trust, they have a big incentive that if you pay them, that they're
going to give you the decryption keys.
56
00:04:51,116 --> 00:04:57,821
That's the business model and groups that don't do that don't last long because no one's
going to continue to pay them ransoms.
57
00:04:57,821 --> 00:05:07,428
Where that becomes messier is where either the encryption hasn't worked properly on your
system and therefore the decryption key doesn't work, or as we've seen quite a lot
58
00:05:07,428 --> 00:05:10,146
recently where this is a group that's currently being
59
00:05:10,146 --> 00:05:19,602
targeted by law enforcement, they might be going through some sort of takedown and you
make a payment on day one, they're gonna provide you the key, but suddenly the FBI has
60
00:05:19,602 --> 00:05:28,999
taken them down and they don't have access to the decryption keys or suddenly the parent
organization and the as a service other party aren't able to speak to each other and
61
00:05:28,999 --> 00:05:32,361
you've paid entity A, entity B wants the money.
62
00:05:32,481 --> 00:05:40,002
So where these things get messy, because this is ultimately a criminal enterprise, you
can't trust the outcome.
63
00:05:40,002 --> 00:05:44,755
you might be able to trust the incentives, but that these things get really complicated
very quickly.
64
00:05:44,755 --> 00:05:47,287
So there's an element where you have to keep up.
65
00:05:47,287 --> 00:05:49,439
But on sanctions and things like that, that's...
66
00:05:50,620 --> 00:05:52,021
Yeah, I mean...
67
00:05:52,241 --> 00:05:54,582
Nobody wants to pay a ransom, do they?
68
00:05:54,582 --> 00:05:57,003
Nobody wants to fuel that criminal enterprise.
69
00:05:57,003 --> 00:06:12,760
And obviously there's been lots of press recently, people like ICO, Law Society, publicly
making statements about how paying ransoms is frowned upon.
70
00:06:12,760 --> 00:06:20,653
However, if you are that business where you will literally go out of business unless you
can...
71
00:06:21,325 --> 00:06:35,257
recover your systems or perhaps if you are at hospital unless you can get your computer
systems back online which can support your medical devices then there's a life and death
72
00:06:35,257 --> 00:06:48,809
decision to be made then you can understand why in some cases payment of a ransom is the
only option so if you're a business in that position once you've taken that
73
00:06:49,071 --> 00:07:03,964
big decision or as part of the decision process, you need to know whether paying the
ransom, is it going to be lawful or are you going to commit a criminal offence potentially
74
00:07:03,964 --> 00:07:05,295
by paying the ransom?
75
00:07:05,295 --> 00:07:17,545
So just quickly, as a matter of first principles, making a ransom payment isn't unlawful
in the UK and many other jurisdictions.
76
00:07:17,839 --> 00:07:29,575
but you can unwittingly commit another offence by making the payment if, for example, the
person you are paying is a named entity on a sanctions list.
77
00:07:29,575 --> 00:07:36,499
So we're talking here principally in the UK about the OFSI list in the US, obviously it's
OFAC.
78
00:07:37,660 --> 00:07:44,183
So there's a process that needs to be worked through to understand whether the payment can
be made lawfully.
79
00:07:44,904 --> 00:07:47,985
And that usually looks something like...
80
00:07:48,079 --> 00:07:50,830
being really clear about attribution.
81
00:07:51,191 --> 00:07:57,475
So we knew we speak to Ollie, how certain are you Ollie, that the threat actor is so and
so?
82
00:07:57,475 --> 00:08:07,362
And obviously we'd look to push the sort of forensic experts to commit to that, ideally in
writing as to who the FET actor is.
83
00:08:07,522 --> 00:08:14,286
And also if there's you know, ransom negotiator on board, there'd be intel gained from
them too that go into the mix.
84
00:08:14,867 --> 00:08:17,679
Once we were as clear as we can be,
85
00:08:17,679 --> 00:08:25,817
and we had some confidence around who the threat actor is, that knowledge then enables you
to search against sanctions lists.
86
00:08:25,817 --> 00:08:32,840
there's a number of mitigations that the organisation can also perform to reduce that risk
even further.
87
00:08:32,840 --> 00:08:46,214
For example, notifying law enforcement, for example, speaking to OFAC or OFSI about what
you're thinking of doing, do they have any allergic reaction to it?
88
00:08:46,214 --> 00:08:51,875
know, documenting all of this, and that can all reduce the risk.
89
00:08:51,875 --> 00:09:01,638
You can never eliminate the risk in these situations, and that's made very clear in legal
advice, but you might be able to reduce it to an extent to which you can be.
90
00:09:01,840 --> 00:09:06,444
as comfortable as you can be in these sorts of unfortunate circumstances.
91
00:09:06,444 --> 00:09:15,850
you've got an idea from the instance you deal with of the MOs of various outfits and the
kinds of
92
00:09:16,963 --> 00:09:26,783
tools that are deployed and the way people go about things that will assist you in forming
a view as to who they likely or who the most likely sort of...
93
00:09:26,783 --> 00:09:27,783
100%.
94
00:09:27,783 --> 00:09:37,503
And it's one of the things that the industry is fairly good at, got a lot better at, which
is sharing information in these groups.
95
00:09:37,503 --> 00:09:46,359
So thankfully we all know that there are the really baddies and the ones that...
96
00:09:46,359 --> 00:09:50,462
you know, we're willing to tolerate slightly above some of the others.
97
00:09:50,462 --> 00:09:57,648
So identifying the ones that we absolutely want to make sure no one is paying any kind of
ransom to and want to, you know, get out of the system.
98
00:09:57,648 --> 00:10:01,830
Are there situations where you will actually go, that were these people before?
99
00:10:01,911 --> 00:10:02,391
Yeah.
100
00:10:02,391 --> 00:10:03,261
Yeah.
101
00:10:03,272 --> 00:10:09,296
and you know, it's funny, I've got colleagues that have, you know, thrown their arms out.
102
00:10:09,296 --> 00:10:13,339
It's the fifth one of these that I've dealt with in the last six months.
103
00:10:13,749 --> 00:10:18,082
Unfortunately, these things are slightly, you know, they go in campaigns, they go in wave.
104
00:10:18,082 --> 00:10:21,603
And I've had colleagues equally.
105
00:10:21,603 --> 00:10:29,687
It's happened to me as well, where I've had negotiations where I know that I've come off
one straight onto speaking to the same person again on the next incident.
106
00:10:29,687 --> 00:10:34,251
And I've known it's the same person because the language has been very similar.
107
00:10:34,251 --> 00:10:37,532
And I'm now in the situation where I'm making sure that my language isn't the same.
108
00:10:37,532 --> 00:10:42,336
I don't want them necessarily to know that it's the same person doing that kind of work as
well.
109
00:10:42,336 --> 00:10:52,501
is there a flip side as well to paying because if someone's going to leak the fact that
you paid, it's like other areas of crime perhaps, you've become a sort of repeat victim.
110
00:10:52,542 --> 00:10:59,885
Have you seen incidents where the bad guys come back for a second go because they think
having paid up once should pay up again?
111
00:11:01,166 --> 00:11:03,047
It's talked about a lot.
112
00:11:03,468 --> 00:11:06,309
I don't think it's borne out by the data.
113
00:11:06,621 --> 00:11:08,432
I mean, unfortunately, fortunately, I'm not sure.
114
00:11:08,432 --> 00:11:15,444
Yeah, so because people are just, made themselves, are post incident make themselves a bit
more resilient and learn from it pretty rapidly?
115
00:11:15,444 --> 00:11:16,124
Possibly that.
116
00:11:16,124 --> 00:11:18,845
I think also the targeting is quite broad.
117
00:11:18,845 --> 00:11:27,007
know, when we're talking about the kind of groups that are performing ransomware as a
service encryption, they're looking at entire sectors.
118
00:11:27,007 --> 00:11:34,749
If that, they're probably actually looking at everything on the internet and they're
trying to find the organizations with revenue over a certain amount.
119
00:11:35,629 --> 00:11:43,344
it doesn't really work in their favor to be saying, we're now gonna look at the, instead
of the however many hundred thousand million organizations that have over a hundred
120
00:11:43,344 --> 00:11:49,877
million in revenue, we're now gonna look at the thousand in the world that have paid a
ransom in the last year.
121
00:11:50,338 --> 00:11:52,158
The two don't marry up.
122
00:11:52,379 --> 00:12:03,301
In terms of pattern of victims, is there a tendency to focus on, I guess from an
attacker's point of view,
123
00:12:03,301 --> 00:12:13,608
bigger the organization, the bigger surface area, the more valuable, but the more likely
it is to have resilience and insurance and cyber response teams and preparedness.
124
00:12:13,788 --> 00:12:24,055
And then you scale down to tiny organizations that might not have many of those or any of
those things, but perhaps haven't got the funds to provide you with a ransom that makes it
125
00:12:24,055 --> 00:12:26,156
worth your while and there's everything in between.
126
00:12:26,877 --> 00:12:32,495
Is there a sort of, does it ebb and flow or is there a sort of a spread of attacks?
127
00:12:32,495 --> 00:12:37,248
It's certainly a spread I'd say, but both ends of the spectrum are covered.
128
00:12:38,210 --> 00:12:47,577
what you have is obviously a significant reconnaissance phase that the threat actors would
engage in to sort of understand the targets.
129
00:12:47,577 --> 00:12:58,446
And as part of that reconnaissance phase, they might already have intel about whether that
organization's insured, for example, that might factor into their decision -making.
130
00:12:59,307 --> 00:13:02,109
Or it might just be a certain sector of the market.
131
00:13:02,541 --> 00:13:12,828
Olly alluded to, I mean, a classic one in recent years, of course, has been law firms
themselves, know, convincing transactions, you always been right pickings for sort of BEC
132
00:13:12,828 --> 00:13:16,790
attacks and payment diversions and whatnot.
133
00:13:17,852 --> 00:13:19,834
So nobody's immune.
134
00:13:19,834 --> 00:13:20,915
I suppose.
135
00:13:21,059 --> 00:13:30,304
The only place where the targeting changes slightly is where we're talking about
organizations that might be legitimately targets of financially motivated nation states.
136
00:13:30,304 --> 00:13:33,696
Those are the groups that really are potentially looking at that.
137
00:13:33,696 --> 00:13:42,071
So if you're a financial institution that holds Bitcoin, then Lazarus are probably well
aware of most people that work in your IT teams.
138
00:13:42,071 --> 00:13:45,473
They're probably getting messages on LinkedIn on a fairly regular basis.
139
00:13:45,473 --> 00:13:48,114
That sort of targeting does happen.
140
00:13:48,114 --> 00:13:49,965
It's a small subset of
141
00:13:50,499 --> 00:13:53,470
organizations that are being targeted, but it is there.
142
00:13:53,470 --> 00:13:57,623
I think that that kind of thing is gonna happen more and more in the future,
143
00:13:57,623 --> 00:14:09,256
in terms of where we are at the moment, the things you're sort of actively sitting on your
to -do lists, is there anything that's sort of jumping out in terms of type of attack,
144
00:14:09,256 --> 00:14:15,068
where they're coming from, how they're evolving that you're able to share?
145
00:14:15,868 --> 00:14:21,590
So I've been saying the same thing for three years now, but ransomware is top of mind.
146
00:14:21,620 --> 00:14:26,052
I think has to be the principal risk for any organization that's thinking about
cybersecurity.
147
00:14:26,052 --> 00:14:28,133
It is getting more sophisticated.
148
00:14:28,133 --> 00:14:30,094
It's targeting basically everybody.
149
00:14:30,094 --> 00:14:37,016
If you've got any kind of presence on the internet or ability to be impacted, you're a
potential victim.
150
00:14:37,837 --> 00:14:39,698
It's extremely profitable.
151
00:14:39,698 --> 00:14:42,819
The amount of ransoms paid are still going up every year.
152
00:14:42,819 --> 00:14:47,201
We're seeing some improvement in terms of the resilience activities from lots of
organizations.
153
00:14:47,201 --> 00:14:50,998
Is the amount the overall sum that's being paid in ransoms or?
154
00:14:50,998 --> 00:14:54,698
the number of people who are paying up in terms of a percentage of people affected.
155
00:14:54,698 --> 00:15:02,178
It sounds like the amount is going up, but the resilience means that fewer people are
having to.
156
00:15:02,178 --> 00:15:12,078
So we're certainly seeing, so over the last two, three years, we've seen the number of
people pay go from sort of 60 % down to where we're sort of around 30%.
157
00:15:12,078 --> 00:15:13,918
So it's about half from our data.
158
00:15:13,918 --> 00:15:14,438
Yeah, yeah.
159
00:15:14,438 --> 00:15:16,158
So that's an important and.
160
00:15:16,158 --> 00:15:17,278
Yeah.
161
00:15:17,632 --> 00:15:24,704
Bearing in mind there could be some measurement bias or other things in there, but
certainly I think if you speak to anyone in this industry about what they're seeing from
162
00:15:24,704 --> 00:15:27,985
their victims, that's the case.
163
00:15:27,985 --> 00:15:33,426
The amounts are absolutely going up and I think the number of victims are also increasing.
164
00:15:33,687 --> 00:15:42,339
So that's why you're seeing the increase in overall payment going up, even though
organizations are better able to recover without having to pay.
165
00:15:42,339 --> 00:15:46,358
And does payment increase probably tie in with, I guess what I saying right at beginning
that
166
00:15:46,358 --> 00:15:50,338
the dependence, people's dependency on the kit has increased.
167
00:15:50,338 --> 00:15:59,598
And so the attackers are in that sort of better negotiating position because the
organization can't function because it's IT systems are locked up.
168
00:15:59,598 --> 00:16:01,018
Is that the bottom line?
169
00:16:01,018 --> 00:16:09,058
Partly, I wonder if there is this sort of an economic Pareto 80 -20 thing going on as well
where, know, threat actors are, you know, understanding that a certain number of people
170
00:16:09,058 --> 00:16:14,934
aren't going to have to pay, but some of them are going to have to pay and therefore
they're going to start off higher.
171
00:16:14,934 --> 00:16:16,764
they're not gonna negotiate down as much.
172
00:16:16,764 --> 00:16:22,194
It used to be that you'd start off with a $100 million ransom and you end up getting it
down to 10.
173
00:16:22,194 --> 00:16:24,194
That's happening less and less.
174
00:16:24,194 --> 00:16:33,714
Threat groups are being much more controlled about what discounts are allowed within,
before they're...
175
00:16:33,714 --> 00:16:42,494
Yeah, it's almost like the thing Jamie was talking about that, the professionalism of the
threat actors is seeping through, not just from the early days when the focus might have
176
00:16:42,494 --> 00:16:44,502
been on the tools they deployed.
177
00:16:44,502 --> 00:16:59,242
to attack someone, now to that whole strategic comms piece, to even their negotiators are
now more experienced, more capable, more sort of, they've got a thought out approach that
178
00:16:59,242 --> 00:17:00,422
perhaps they didn't have early on.
179
00:17:00,422 --> 00:17:08,942
And I suppose just before I let Jamie give his, also the importance of understanding that
sort of data theft element of this as well.
180
00:17:08,942 --> 00:17:13,812
So we've seen in the last 12 to 18 months, a couple of very large.
181
00:17:13,812 --> 00:17:24,957
supply chain attacks, so targeting a central software vendor that has given access to lots
of organizations' data and then trying to get some kind of ransom off all of those.
182
00:17:24,957 --> 00:17:29,689
I think that that proved to be pretty profitable for the organization that did it.
183
00:17:29,689 --> 00:17:31,349
I think that we'll see more of that in future.
184
00:17:31,349 --> 00:17:32,490
There's a bit of an outlay.
185
00:17:32,490 --> 00:17:36,091
You've got to find your zero day, your vulnerability for that kind of vendor.
186
00:17:36,212 --> 00:17:42,294
So those vendors are likely to be, I don't know, the cloud service providers, they're
likely to be.
187
00:17:42,326 --> 00:17:47,276
as good as they can be and to be very aware of the importance of their IT security.
188
00:17:47,276 --> 00:17:51,986
But if you crack one, you've hit a gold You've got 5 ,000 organisations.
189
00:17:52,846 --> 00:17:55,796
Yeah, it's the idea of a sort watering hole attack, isn't it?
190
00:17:55,796 --> 00:18:00,236
know, lots of people drinking out of the same fountain or watering hole.
191
00:18:00,236 --> 00:18:06,886
If you hit the watering hole, then you can potentially get a lot of victims in one sort of
foul swoop.
192
00:18:06,886 --> 00:18:12,378
I think what I'd say in terms of what we see most often on the books at the moment
193
00:18:12,786 --> 00:18:17,968
is ransomware attacks that have just skipped the encryption elements.
194
00:18:18,348 --> 00:18:29,533
So it's the same old ransomware groups who are perpetrating the attacks, but rather than
going to the trouble of encrypting the organization systems, they are simply sneaking in,
195
00:18:29,693 --> 00:18:37,776
exfiltrating the data, and then ransoming the victim because of the data theft and the
threat of leaking.
196
00:18:38,337 --> 00:18:42,458
I think that's an acknowledgement of
197
00:18:42,710 --> 00:18:44,430
people having better backups.
198
00:18:44,951 --> 00:18:49,732
And it's also partly, I think, for factors just making growing lives easier.
199
00:18:50,412 --> 00:18:59,815
Obviously they have seen a return from people paying ransoms because of leaking threats,
threats of leaking data.
200
00:18:59,815 --> 00:19:01,916
So it certainly works.
201
00:19:03,697 --> 00:19:07,819
So that is something that we see more and more and seems to be a sort of continuing trend.
202
00:19:07,819 --> 00:19:18,006
have you seen, sort of, in terms of, say, who the threat actors are, where they're based,
any changes over the last sort three, four, five years?
203
00:19:18,006 --> 00:19:21,538
Is it a reliable pool of...
204
00:19:23,436 --> 00:19:28,128
teams or locations where we would sort of see attacks coming from?
205
00:19:28,128 --> 00:19:38,982
Generally, I think we saw a bit of a complicated situation during the most recent outbreak
of conflict in Ukraine because you suddenly had people that were used to be working
206
00:19:38,982 --> 00:19:41,634
together with the suddenly on opposite sides of conflict line.
207
00:19:41,634 --> 00:19:44,855
So that created some tension in groups.
208
00:19:44,855 --> 00:19:50,297
didn't last particularly long, but I think it did see, we saw a drop off in the number of
ransomware events.
209
00:19:52,620 --> 00:19:56,961
broadly where these attacks are coming from is pretty consistent.
210
00:19:56,961 --> 00:20:00,651
But that's because I think they're linked to sort of economic drivers.
211
00:20:00,651 --> 00:20:07,994
These are generally people that are relatively well educated in places where they can't
find good employment in legitimate industries.
212
00:20:07,994 --> 00:20:11,105
People don't become criminals tomorrow because they've got good jobs.
213
00:20:11,105 --> 00:20:17,697
They have it because they don't have another outlet for that kind of expertise, I suppose,
in general.
214
00:20:18,917 --> 00:20:19,508
agree with that.
215
00:20:19,508 --> 00:20:21,186
It's largely the same.
216
00:20:21,186 --> 00:20:23,707
countries that we've always been dealing with.
217
00:20:23,827 --> 00:20:25,207
We all know who they are.
218
00:20:25,948 --> 00:20:27,589
Name and shame.
219
00:20:27,589 --> 00:20:36,512
But then I guess that brings me then on to against that backdrop, what do we see coming
down the pipeline, so to speak?
220
00:20:36,512 --> 00:20:44,596
I one of the things I'll throw in straight away is obviously because it's something
everyone's talking about things that AI is acting to affect things.
221
00:20:44,596 --> 00:20:50,368
I've seen a fair amount of material around and understandably perhaps because
222
00:20:50,368 --> 00:20:59,847
organizations just apocryphally talk to friends, are finding that AI has been very good on
things like customer complaints processes, customer interaction, but it doesn't take a
223
00:20:59,847 --> 00:21:07,584
genius to think, well actually, we could fine tune that for phishing attacks, we could
fine tune it for that sort of.
224
00:21:09,122 --> 00:21:18,886
groundwork of trying to solicit information from organisations, from individuals, try and
get passwords or details, all the kind of things that might make an attack easier.
225
00:21:19,206 --> 00:21:28,189
Do either of see AI having a role in being deployed by, well, on the good guy side or the
threat actor side going forward?
226
00:21:28,550 --> 00:21:38,912
Yeah, I'll give you a quick comment on AI and I'll mention what perhaps is coming down the
tracks as it were, on AI generally.
227
00:21:38,912 --> 00:21:44,206
I think it's still too early to say that we're detecting any real patterns by threat
actors.
228
00:21:45,387 --> 00:21:47,379
I think they're still getting to grips with this as well.
229
00:21:47,379 --> 00:21:50,611
also, their existing methods work.
230
00:21:51,412 --> 00:21:54,074
why, if it's not broke, don't fix it sort of thing.
231
00:21:55,176 --> 00:22:04,563
But there have certainly been cases and reports when it comes to ransom negotiations,
threat actors are starting to deploy.
232
00:22:04,563 --> 00:22:06,404
And again, this is anecdotal.
233
00:22:08,050 --> 00:22:12,391
AI powered chat bots in place of a live negotiator.
234
00:22:12,651 --> 00:22:19,303
So you the victim are having to try and negotiate with an AI chat bot, which can't make it
any easier.
235
00:22:19,303 --> 00:22:24,934
So that's one example.
236
00:22:25,215 --> 00:22:37,218
And also, there's an interesting paper recently from, I think it was the University of
Illinois, who had developed a GPT -4 powered
237
00:22:39,229 --> 00:22:52,930
autonomous SQL injection bot that would just, without any human intervention at all,
deploy SQL injection attacks, like complicated ones, which I think had sort of 38
238
00:22:52,930 --> 00:22:54,630
different steps to them.
239
00:22:54,870 --> 00:23:00,690
And yet this system using CHAP GPT -4 could do that, pump those attacks out.
240
00:23:00,710 --> 00:23:05,300
And I think they worked out that it was something like a 70 % success rate.
241
00:23:05,300 --> 00:23:06,176
Wow.
242
00:23:06,431 --> 00:23:17,618
And it cost us the it cost it literally a few dollars per attack so it's not hope that
doesn't foretell the future in terms of what might be coming down the track, but One of
243
00:23:17,618 --> 00:23:22,234
the most interesting stories I saw recently was was this
244
00:23:23,996 --> 00:23:33,633
idea that the UK might, UK governments might be on the verge of launching a consultation
about whether ransom payments should be licensed.
245
00:23:34,614 --> 00:23:40,178
Now there wasn't much detail at all about how that would work or who would do the
licensing.
246
00:23:40,178 --> 00:23:50,826
I presume that OFSI and at the same time or similar time there was a cyber review
completed by Stephen McPartland MP.
247
00:23:51,466 --> 00:23:57,768
And one of the outputs from that was to call for mandatory ransomware payment reporting.
248
00:23:57,788 --> 00:24:03,529
That's something they have in the States now under the CIRCIA legislation.
249
00:24:03,610 --> 00:24:07,491
If you're designated as a critical infrastructure.
250
00:24:08,351 --> 00:24:09,861
But I understand Mr.
251
00:24:09,861 --> 00:24:15,073
McPartland's one of the recent casualties who's resigned from the Conservatives.
252
00:24:15,073 --> 00:24:18,374
So think that's going to fall by the wayside along with a few other...
253
00:24:18,964 --> 00:24:20,135
initiatives.
254
00:24:20,135 --> 00:24:24,759
So, you know, there's a political element to this in terms of what the government's going
to do about anything.
255
00:24:24,759 --> 00:24:29,764
Yeah, that obviously feeds into our world in terms of legal and regulatory.
256
00:24:29,764 --> 00:24:34,047
Well, DPDI Bill was another casualty, wasn't it, recently?
257
00:24:34,548 --> 00:24:40,794
Anything on your radar in terms of what might be coming down the line?
258
00:24:40,794 --> 00:24:41,224
You're right.
259
00:24:41,224 --> 00:24:43,596
think AI is interesting.
260
00:24:45,428 --> 00:24:46,388
It is a double -edged sword.
261
00:24:46,388 --> 00:24:56,142
It's a classic double -edged sword in that it brings so much to the party that those
organizations that can engage with it, that do implement it properly to run parts of their
262
00:24:56,142 --> 00:25:04,045
security, are going to almost essentially wipe out old school versions of certain types of
cybercrime.
263
00:25:04,126 --> 00:25:11,249
So AI is really quite good at spotting things like phishing emails or particularly sort of
whaling emails.
264
00:25:11,249 --> 00:25:15,030
The ability to sort of train it on that kind of data and for it to spot it is...
265
00:25:15,166 --> 00:25:17,668
It's really, really good at that already.
266
00:25:18,529 --> 00:25:26,226
Obviously what that means is that those organizations that do that, it'll go away and then
there'll be a whole load of others where suddenly you've got the chatbots that are being
267
00:25:26,226 --> 00:25:35,634
written to sort of scrape LinkedIn profiles and write really convincing phishing emails
for almost no money at all are going to be targeted at those that haven't engaged, haven't
268
00:25:35,634 --> 00:25:38,887
bought, can't afford that kind of technology.
269
00:25:38,887 --> 00:25:42,764
Almost like what we saw, I would say, sort of four or five years ago with
270
00:25:42,764 --> 00:25:49,066
sort of a huge number of BEC events when everyone moved to cloud email from on -prem email
exchanges.
271
00:25:49,066 --> 00:25:55,548
And I don't know what you saw, but it was a large number of those kind of BEC events with
fraud.
272
00:25:55,548 --> 00:26:01,359
So just for the audience benefit, it might be worth just expanding what that looks like
and what it is.
273
00:26:01,359 --> 00:26:06,321
So around five years ago, there was this big adoption of cloud email.
274
00:26:06,321 --> 00:26:10,742
So everyone went from having an email server inside their environment that you all logged
into and that worked.
275
00:26:10,742 --> 00:26:11,982
And suddenly,
276
00:26:12,002 --> 00:26:19,022
everyone realized it was much cheaper and more effective to use Microsoft 365 or G Suite
or one of the others.
277
00:26:19,922 --> 00:26:28,142
Threat actors realized that this meant that you needed one login platform as long as you
got someone's email address and their password, you could log in with their email and
278
00:26:28,142 --> 00:26:35,962
download all of the mailboxes, get in the middle of all of the conveyancing transactions,
if that was an example, but essentially any email chain where you were trying to get
279
00:26:35,962 --> 00:26:38,642
someone to put a large amount of money in a bank account.
280
00:26:39,050 --> 00:26:46,904
If you were able to find that in a mailbox somewhere, you were able to hide the
communication from whoever was actually meant to be on that email, redirect that money to
281
00:26:46,904 --> 00:26:48,796
your own bank account and move on.
282
00:26:49,039 --> 00:27:00,939
a good example I think of the school of thought that know cyber criminals often wait until
software has a certain degree of market saturation point before they will invest the time
283
00:27:00,939 --> 00:27:04,339
and energy to compromise it.
284
00:27:04,639 --> 00:27:12,345
MS 365 is a good example of that and you might say there's a similar case can be made for
certain types of AI.
285
00:27:12,549 --> 00:27:25,487
So if a dominant AI platform merges that lots of businesses start to deploy, then I think
at that point we can see on a much bigger scale, threat actors try and target that.
286
00:27:26,589 --> 00:27:27,851
Yeah, definitely.
287
00:27:27,851 --> 00:27:34,633
And now with the next sort of evolutionary cycle, there are different pieces of kit and
tools that people are using.
288
00:27:34,633 --> 00:27:42,179
And it sounds like you would be looking at the use of AI from a defense point of view,
Ollie, but equally you're
289
00:27:42,179 --> 00:27:47,840
sort of the people you're having to engage with would be using it for an offensive
purposes.
290
00:27:47,901 --> 00:27:52,402
Yeah, and I think the defenders are making better use of AI now.
291
00:27:52,402 --> 00:27:56,223
I think that there are sort of notional use cases for threat actors.
292
00:27:56,223 --> 00:27:58,184
It's not very good at writing malware.
293
00:27:58,184 --> 00:28:03,285
It is quite good at writing a phishing email, but obviously it's also good at finding a
phishing email as well.
294
00:28:03,525 --> 00:28:10,887
So finding those sort of asymmetric points where the threat actor can use that advantage,
they only need to be right once kind of thing is...
295
00:28:10,971 --> 00:28:12,831
That's where it's going to tell.
296
00:28:13,211 --> 00:28:22,351
think another area where things are going to change is we're already seeing this, and
we've sort of talked about it a bit, but the world is going to get a lot messier over the
297
00:28:22,351 --> 00:28:25,351
next 12, 24, 36 months.
298
00:28:26,351 --> 00:28:34,831
The NCSC, the FBI, the Australian federal authorities are being much more proactive in
what they're doing against these groups.
299
00:28:34,831 --> 00:28:37,264
And the reaction to that is...
300
00:28:37,453 --> 00:28:45,249
is a marketplace that isn't as well defined, is not really knowing who you're dealing with
and losing negotiations part way through because someone's been impacted.
301
00:28:45,249 --> 00:28:50,183
So I think that in the long term, I suspect that's a good thing.
302
00:28:50,183 --> 00:28:57,759
We all want to work in a world where I'd love to go back to network engineering rather
than necessarily doing incident response because it was no longer a thing anymore.
303
00:28:57,759 --> 00:28:59,780
I think we're a long way off that.
304
00:29:00,060 --> 00:29:03,803
But I do think that it's going to get more.
305
00:29:03,803 --> 00:29:09,047
painful to deal with these kind of things from that perspective, at least in the short
term, whilst they figure out what's going on.
306
00:29:09,047 --> 00:29:20,865
And I guess sort of following on from that perhaps just as a final takeaway perhaps, if
you were sort of had the opportunity to say to organisations who are listening, here are a
307
00:29:20,865 --> 00:29:27,880
few things I suggest you do to make yourself a bit more resilient in the next year, the
next two years.
308
00:29:27,880 --> 00:29:32,083
What would be your sort of shopping list, so to speak?
309
00:29:32,827 --> 00:29:34,887
For me it's all in the preparation.
310
00:29:35,067 --> 00:29:37,847
As they say, practice makes perfect.
311
00:29:38,287 --> 00:29:43,507
Having an incident response plan that is actually effective.
312
00:29:43,647 --> 00:29:46,407
not a 40 or 50 page plan that looks nice.
313
00:29:46,407 --> 00:29:49,767
And it's filed in the cabinet somewhere that no Yeah, gathering dust.
314
00:29:50,047 --> 00:29:53,927
But one that actually is going to be helpful to the C -suite.
315
00:29:53,927 --> 00:29:57,087
And it's more about communication and coordination.
316
00:29:57,087 --> 00:29:58,047
That's what they need.
317
00:29:58,047 --> 00:30:00,267
How are the different business units going to interact?
318
00:30:00,267 --> 00:30:01,967
Who's going to take the lead?
319
00:30:01,967 --> 00:30:11,351
that's the sort of plan that you need to having that plan in place, a good plan and then
thoroughly testing that plan against a range of different scenarios not just once but on a
320
00:30:11,351 --> 00:30:13,932
regular basis, certainly perhaps annually.
321
00:30:14,412 --> 00:30:18,554
That would be my biggest bang for your buck takeaway.
322
00:30:19,614 --> 00:30:24,546
And I would completely agree but given that that's a boring answer and there needs to be
two.
323
00:30:24,546 --> 00:30:25,777
I'd say we need a bit of disharmony.
324
00:30:25,777 --> 00:30:31,499
Normally we get two lawyers at least in a room we can have a bit of a dust up but if
harmony is broken out that's tremendous.
325
00:30:32,287 --> 00:30:32,987
Rigor.
326
00:30:32,987 --> 00:30:41,947
So from a technical perspective, I think there's a lot of focus and I appreciate that I've
just spent some time talking about the benefits of AI controls, but I think that
327
00:30:41,947 --> 00:30:51,167
organisations focusing on the basics, making sure that you're doing, you've got patching
in place, making sure that you've got multi -factor on emails, that the basics are going
328
00:30:51,167 --> 00:30:53,727
to stop 99 % of these kind of threats.
329
00:30:53,727 --> 00:30:59,287
And also, as an aside, the private may have all the coverage work I have to do, which
would be great.
330
00:30:59,287 --> 00:31:00,123
But we don't.
331
00:31:00,123 --> 00:31:04,486
At end of the day, I don't think the market wants coverage issues and policyholders don't
want them.
332
00:31:04,486 --> 00:31:14,763
So if people can do all those things, then that would be tremendous as well, because then
you don't have to run into any of the fights you might otherwise have, because the system
333
00:31:14,763 --> 00:31:16,764
hasn't been patched and has been compromised as a result.
334
00:31:16,764 --> 00:31:20,337
that would be fab news on my side as well.
335
00:31:20,337 --> 00:31:21,217
Sorry, I interrupted.
336
00:31:21,217 --> 00:31:30,063
Is there anything else on the, so all those traditional things, the patching, the making
sure the systems are up to speed, the.
337
00:31:30,145 --> 00:31:33,357
MFA when you can, backups, are they still...
338
00:31:33,418 --> 00:31:35,979
Making sure you're logging and monitoring stuff.
339
00:31:36,640 --> 00:31:41,463
Exactly, it's those things that feel basic and boring.
340
00:31:41,463 --> 00:31:47,928
And I fully understand, know, I've managed a network, I've sat in those seats, it's nice
to talk about the interesting stuff.
341
00:31:47,928 --> 00:31:53,872
But ultimately, if you do the basics right, you're probably not gonna have a problem.
342
00:31:54,273 --> 00:31:57,786
What a sensible note to perhaps wrap up on.
343
00:31:57,786 --> 00:32:04,843
I hope that was all very useful and thank you for joining us and we hope you will join us
next time for the next episode in the series.
344
00:32:04,843 --> 00:32:06,143
Thank you very much.
Global
Australia
France
Germany
Ireland
Italy
Poland
Qatar
Spain
UAE
UK
