Video: A Hacker’s View of the Cyberthreat Landscape in 2024 – PPOV Bonus Episode Part 2

hey Channel insiders welcome back for part two of our first ever bonus episode I'm your host Katie boso and if you haven't watched or listen to part one of my interview with Cody cret singer go back and do that right now you can listen on your preferred podcast platform watch on YouTube or better yet watch on Channel insider.com today in part two of my interview with Cody we continue to talk about the 2024 thread landscape and we discuss how Channel solution providers can better secure themselves and their clients as well as use this as a business opportunity to expand their portfolio and their client base can you walk me through what exactly the timeline is on average for ransomware how long will it be until you realize a ransomware has come into my system and is it that you're recognizing it right away or does it take a while that is a difficult question to answer but let's let's start with what most organizations have uh and that is cyber security hygiene so when you have okay cybercity hygiene you have okay security tools which means you have okay policies and procedures which means everything's just okay so when you have just okay everything it can take some time in order to not only detect this but also see what's going on and maybe who it was from and what I mean by that is thread actors typically want somebody to click a link or they want somebody to uh go to a website or enter credentials or scan a QR code with their phone to bypass security controls any number of things they're going to probably focus on an individual or individuals as opposed to systems as humans are a little easier sometimes to Target than network devices but what we're not perfect are you kidding me I know right we'll get to that a little bit later uh so once they've managed to establish a beach head or a footh hole they're going to move laterally through the network and all that it's a that's a fancy industry term for basically being able to move around the network and they're going to figure out what information that organization has specifically they're going to try to find anything valuable um and once they figure out that information they're going to extract it so that that that they have a copy of it uh and on their way out the door they're going to deploy ransomware some sometimes the bad guys have access for several days sometimes it's several weeks as the sisa report said volt typhoon had access for 5 years and that was one or more organizations for five or more years I think is what I was reading between the lines on the biggest thing is the more noise they make the more likely they are to be detected and when you have okay tools you're not going to see um the noise until it gets pretty significant and that's usually when ransomware is deployed so that's their last step before they exit the network if that is the point in which you're aware that the bad guys are there that means they've already done all of the damage uh so far and and will continue to do damage because that'll lead to either double or triple extortion depending on the threat group and just to give an idea of like what we're talking about with the payloads that we're looking at uh NBC News did report that last year uh ransomware attacks on us Healthcare networks that equated to paying a record $1 billion just in that sector in that vertical specifically so we're not talking small chunks of change they're going after a lot of money so with that said Cody you mentioned zero trust already but what else do we need in our systems today and when when for the msps the msps listening to this what does the opposite of okay look like as far as what our Stacks need to look like so there's no perfect stack that's that's going to be number number one the biggest thing is being able to Monitor and respond to things as they happen often times this will be with EDR xdr MDR whatever you want to call it uh those particular products are going to give some visibility into things and then kind of the the flip side of that is you need to have all of the data from audit logs and behavioral analysis and silliness like that that generally is collected through a Sim product and when you bolt those two things together often times you've got some pretty good visibility so at a bare minimum that would be kind of if I was building a stack I would definitely have those two components in there's also a number of different things out there in terms of monitoring Network traffic back and forth and seeing whether that's malicious in some way there are you know DNS uh options out there to detect malicious activity there's all sorts of different security tools uh outside of that password managers I mean the list can go on and on and on um but I think it's really important to to note in terms of uh when it comes to security is you've got to make sure that you're you're covering all your bases and and and what I mean by that is you have to be able to validate whether or not your tools are working and if whether or not the bad guys are getting in so having a independent third party make sure that uh you are doing the things that you say you're doing or you are providing that stuff to your clients um is incredibly helpful do you ever see or have you seen a managed service provider or even one of their customers neglecting like is there an often neglected area of their security stack that you would tell them you really have to pay attention to this yeah actually the uh audit logging is probably the one of the the first things that I I double check with a lot of a lot of our partners at Galactic so um by default and this is a Microsoft default audit logging is not enabled on many of their products and that may come to as a surprise to some people um because M365 audit logs are incredibly important uh post incident and if they're not turned on uh then you're not going to get any data which means you don't know whether or not they actually exfiltrated any information so that would probably be the the the first thing that I would do uh I because I built a sock I'm I I hinge absolutely everything on a good Sim platform there are tons of really good Sim products out there and tons of really good managed socks that can uh actually monitor uh the Sim solution for you as well that way you don't even have to be the one doing all the nerdy stuff and with the dials and the knobs and the alerts and the silliness they'll they'll reach out to you when something actually happens which which is for busy MSP owners that is exactly what they need you set a name in there and uh I want to turn around and talk about it Microsoft Microsoft just launched co-pilot um and there is some concern there that you and I had spoke about as far as like what it is and what we need to do to make sure that we're using it to the best of our abilities and still being safe can you talk to me just around some of best some of the best practices in using it so in M365 there is something called Data classification and essentially it's part of the the DLP uh component of M365 it's a fancy way of basically saying being able to control who has access to what documents if they can leave the environment that kind of stuff right so uh that component has to be enabled and then sensitivity labels have to be applied to every single document and email in the entire organization in SharePoint on one drive and if that is isn't done then co-pilot can essentially do whatever it wants with any of the data that is in any of those documents emails team messages so on and so forth it can do whatever you want it to and frankly I know it's a a a learning model that might be just for your tenant uh but I wouldn't trust that that's going to be widely um the case for the entire time that co-pilot exists at some point some of that metadata has got to make its way out and at some point that is going to then train other AI models I am all for AI in particular ways having car blanch on an entire organization's documents regardless of sensitivity um that's scary so uh I've talked to a number of msps recently specifically around this particular component and this is the first thing that I say is is sensitivity labels on and if so so then we can go to the next step but that is where most people are going to say nope too much work it's going to cost too much to deploy it ain't worth it um to be fair you can go and enable it without the sensitivity labels but basically that means who knows what information is going to show up at what time when uh you're calling on that language model to uh to generate something for you uh too much of a question mark for me so I'm going to pump the brakes there when it comes to working with artificial intelligence tools even from your your basic level of chat GPT all the way up to using something like Microsoft co-pilot or gemini or any of these things that we're hearing about coming out um from the large hyperscalers are there any other safety measures any other notes any other maybe just don'ts uh that you would tell people to apply in their day-to-day I think the the basic that anything that you give to these providers could potentially be disseminated is is enough for me to Warrant a little bit of worry at least on my side I think that there's a lot of real risk in putting in data that you're not okay with others seeing at least from my perspective but at the same time I'm enthusiastically cautious uh and I use those words in that way because I think in cyber security there's a lot of possibilities in terms of us being able to leverage AI to better protect people and to find things faster and to stop things but the more that we do that the more that type of system has control over very critical things it's it's almost like uh you know it's almost like Terminator it's almost like the uh what's the Terminator thing called uh he says I'll be back oh well yeah but there's um Skynet goodness I couldn't think of Skynet well while talking about AI um we're just it edges not to say skynet's going to take everything over it is uh but at some point it edges us pretty close to that and it's going to be challenging I think uh in the next several years to see where the delineation is um where we do want AI to help us and where we want to protect whatever it may be let's talk specifically about the solution providers what are the questions that you should be prepared to answer if you want to be able to call yourself a trusted advisor yeah it's going to be it's kind of two components there uh the first one is being able to identify risk and the second component there is to be able to communicate risk every organization is going to have different risks there are going to be some shared risks so let's imagine for a moment you have two clients you know some of the users are reusing passwords okay that is a shared risk that is a common risk but you need to be able to talk about it in such a way that it's a risk to the business not a risk to the enduser not a risk to the data but the risk to the organization when we're communicating risk back to business owners U we have to do it in such a way that they understand what we're talking about one of my former co-workers I love him to death is is as nerdy as nerdy can be he is straight up Mr geek right and I am too like really but he brought a 50-page report to a quarterly Business review and started going over all of this other data and metrics that we are judged on internally but frankly the client doesn't care about they want to hear information that they then can take and help their business proceed so we have to educ educate them in ways where they not only understand the data but it's presented in a way where they can leverage that data often times as nerds we get it really really close but we don't share a story or share something that will relate it back to that individual when you have that talk with that client they're much more apt to remember the story and say oh crap we've got to make these changes because if we don't then this could happen to us so Cody considering that we've spoken a lot about the new threats this year uh the new targets or the growing number of Targets in for example the health care space we should also be looking at this I would say as a business case for how solution providers could expand the number of organizations or type of organizations that they approach about offering their services is there anything that you can tell me about where they should start I think at a bare minimum what these these events these cyber events do is continuously refresh most people's memories in terms of what's going on out there on like the bad guys side of things um and what I mean by that is when it comes to cyber security events it's almost a selling opportunity and I'm not saying ambulance Chase here I'm not saying like go to the person that's just been breached and say hey I can I can do security better that that's certainly not what I'm saying but that will not open doors for you by the way no want not at all what it is is a learning opportunity right so for existing clients that are um tangental or directly related to whoever has been breached right especially if they're local a good example would be you know Chicago based clients hey a Chicago based you know Hospital recently got compromised let's start to look and analyze ear security to see whether or not you would be susceptible to this kind of same style of attack again that'll work for Prospect effects that'll work with current clients because it gets the kind of the gears turning in terms of what would happen during that event I'll Follow That under number one number two is your clients inevitably are going to have a breach at some point there will be an incident um it's it's almost like death taxes and incidents like they're it's something is going to happen and that can be something small like an email compromise or it could be something very very large like a large scale ransomware deployment heaven forbid but preparing clients for that that inevitability would be a a a really good project as well one of the other things that an MSP can do here is when something does kick off being that advisor during an incident so often times if there's like cyber liability insurance they're going to call the IR team they're going to be handling the incident and stuff like that but the thing is most of the time during incidents the checkbook comes out and I'm not saying try to get them to buy all sorts of stuff that they don't need but what I am saying is it's a really good time to be able to talk about all of those challenges that uh maybe security wise uh that they didn't buy at a particular time uh and then I would say number three incident response policies acceptable use policies things along those lines the administrative side of things not the technical controls but the administrative controls to help limit some of that is going to be incredibly important as well we're seeing more and more organizations aligned to a compliance framework or we're seeing more msps leverage a compliance framework to standardize all of their clients towards so having all of those three would be great maybe just focusing on one in the first couple of quarters might be a little bit helpful too Cody this has been such a fun conversation and I'm so excited about everything uh that is going to happen in 2024 and being back here at the end of the year I would say to discuss um but I really also want to make sure that I give you an opportunity to talk about Galactic advisors and all the the things that you're involved in you know I've talked about having an independent third party come in and validate whether or not you're doing the things you say you're doing and that is the easiest way for you to become one of our partners we want to check to see whether or not your tools will catch the bad guys and you might be surprised because the majority of the time we're able to bypass things like EDR xdr MDR all of those DRS uh and and walk a network and get some really really interesting data we'll even crack some passwords so that's where it begins and then the next step is helping you get to that that vcso level that trusted advisor level um through not only as compliance as a service but also building your security stack and then being able to educate and talk about risk really what we're trying to do is help protect 1 million people and uh by helping msps do that that helps our mission I got to do one more plug here I am one of the executive directors for the Illinois cyber Foundation that's Illinois cyber foundation.org we are all about educating um youth all about educating the the older folks who might not understand some of the scams and educating cyber Security Professionals on what is going on if you just so happen to be in Illinois or uh know somebody who's in Illinois and would like to get involved we would be more than happy um to uh to to have you on board um we do a bsides peia in in Poria Illinois every single year uh myself and Nick are expanding our program in 2024 for a lot of other kind of crazy stuff uh we've got some really cool stuff in store there um so if you're interested please please uh hop by Illinois cyber foundation.org and Cody if we want to get in touch with you if we have questions if we just want to reach out to you where can we find you and how can we reach you yeah easiest way is going to be find me on LinkedIn it'll be Cody cret singer thanks again to my guest Cody cret singer for coming on the show and thank you for watching or listening to our first bonus episode if you want more episodes of Channel Insider partner POV you can watch on Channel insider.com or YouTube at Channel inssider newws and Trends you can also listen to our podcast on your preferred podcast platform don't forget to like follow And subscribe wherever possible so you never miss an episode we've got another new episode of Channel Insider partner POV coming out this Thursday so I'll see you then I'm Katie boso see you next time

This transcript was generated automatically from the video's captions and may contain errors.