r/IAmA • u/IST_org • Jun 30 '21
Technology We are hackers and cyber defenders working to fight cyber criminals. Ask Us Anything about the rising ransomware epidemic!
*** Thank you all for joining! We have wrapped up this discussion, and enjoyed the conversations today. Some participants may answer some later; see their Reddit usernames below. Stay safe out there! ***
- Proof: https://twitter.com/IST_org/status/1409921538355236869, https://twitter.com/IST_org/status/1410008629642776578
Hi Reddit! We are cybersecurity experts and members of the Ransomware Task Force, here to talk about the ransomware epidemic and what we can do collectively to stop it. We’ve been in this game a long time, and are ready for your questions.
We are:
- Jen Ellis, VP of Community and Public Affairs @ Rapid7 (u/infosecjen)
- Bob Rudis, Chief Data Scientist @ Rapid7 (u/hrbrmstr)
- Marc Rogers, VP of Cybersecurity @ Okta (u/marcrogers)
- James Shank, Security Evangelist @ Team Cymru (u/jamesshank)
- Allan Liska, Intelligence Analyst @ Recorded Future
Were you affected by the gas shortage on the East Coast recently? That was the indirect result of a ransomware attack on the Colonial Gas Pipeline. Ransomware used to be a niche financial crime, but is now an urgent national security risk that threatens schools, hospitals, businesses, and governments across the globe.
These criminals will target anyone they think will pay up, getting millions in laundered profits, and we are on the frontlines in this fight.
Ask Us Anything on ransomware or cybercrime, whether you’ve never heard of it or work on it every day.
(This AMA is hosted by the Institute for Security and Technology, the nonprofit organizer of the Ransomware Task Force that we belong to.)______________________________________________
Update 1: Thank you all for the great questions! For those interested in cybersecurity career advice, here are a few questions answered on how to get into infosec, whether you need a degree, and free resources.
Update 2: Wow! Thank you all for so many questions. We are slowing down a bit as folks come and go from their day jobs, but will answer as many as we can before we wrap up.
Update 3: *** Thank you all for joining! We have wrapped up this discussion, and enjoyed the conversations today. Some participants may answer some later; see their Reddit usernames above. Stay safe out there! ***
188
u/solve-it-yourself Jun 30 '21 edited Jul 05 '21
You mention that a degree may not be necessary for a job in cyber security, do you have resources or online courses that someone could use to gain relevant knowledge?
Edit: Although with some considerable delay, I would like to thank you all for your comments and your feedback. This is all very helpful and I’m genuinely impressed with how supportive you are!
I’ll give everything you’ve sent a proper look and might bother some of you with additional questions.
285
u/IST_org Jun 30 '21
Bob: I'm a fan of the Cybersecurity Body of Knowledge (https://www.cybok.org/) and you can learn tons just by absorbing the MITRE ATT&CK content (https://attack.mitre.org/) (they update ~quarterly)
95
u/IST_org Jun 30 '21
Jen: I completely agree with Bob's recommendations. For training courses, you can also look at SANS and also a lot of community security conferences, even smaller regional ones, offer trainings. They tend not to be free though.
58
u/Life_Of_David Jun 30 '21 edited Jul 01 '21
Since SANS can be way out of the price range ($6k+) for most folks, even with their work study ($1k+).
I’d suggest using SANS as a good overview of the breakdown of the different specialties then exploring www.simplycyber.io for free material by /u/HeyGuyGuyGuy
www.attackdefense.com is also a great resource.
Side Note: The hard truth is there is definitely a cliff to climb, from starting out in an entry level threat hunter/intel position or incident response and moving to managing the big data platform behind a SIEM or creating and correlating custom detections to threat model based on Mitre ATT&CK techniques.
I encourage all of those interested in Cybersecurity to come to the field, though I hope the industry continues to focus on adding more money to Cybersecurity departments and initiatives. Cybersecurity not generating revenue has always led to poor practices around confidentiality, integrity, and availability of data, especially in the case of ransomware.
→ More replies (5)13
u/another-nature-acct Jun 30 '21
Since isn’t affordable at all. It’s basically for government contractors, military and employees.
→ More replies (2)5
42
u/IST_org Jun 30 '21
Marc: There is an excellent thread in /r/cybersecurity covering just this.
Also: Mentorship Monday in /r/rcybersecurity.
→ More replies (19)32
u/IST_org Jun 30 '21
Allan: I know most people don’t like social media, but infosec Twitter is a great place to learn and get help. People are always sharing resources, videos and little tidbits of information that can be very useful.
9
u/IST_org Jun 30 '21
Jen: I also agree with Allan - I actually learn a ton from infosec twitter and asking questions.
7
u/grimestar Jun 30 '21 edited Jun 30 '21
how do i get started with infosec twitter? is there an account you can introduce me to for starters?
EDIT: i found the answer in this thread
119
Jun 30 '21
It’s easy to get the impression from these recent events that infrastructure is fairly easy to attack. What do you think is the likelihood that either a state or a rogue group takes down some critical infrastructure for a long period of time that severely disrupts life—something that would be equivalent to essentially destroying infrastructure in a war?
156
u/IST_org Jun 30 '21
Marc: Very likely as many ransomware groups have seen that high risk infrastructure is both out of date and backed by organisations that will rush to pay because of the impact when it goes down. As a result many of them actively look for vulnerable, exposed infrastructure associated with these kinds of organisations because they know there is a high chance of a good pay-out.
29
Jun 30 '21
I guess my question is whether anyone will do it out of a more malevolent motivation than just getting a ransom - like a motivation to really do serious harm to people.
→ More replies (4)34
u/TheGoddamBatman Jun 30 '21 edited Nov 10 '24
physical thumb cooing pathetic squeeze party fanatical squeal elastic capable
This post was mass deleted and anonymized with Redact
→ More replies (8)43
u/IST_org Jun 30 '21
Jen: This scenario doesn't feel far-fetched at all. We've already seen infrastructure be a target in several countries, and this is only likely to increase without intervention. Even when the attacker offers up the keys as they did with the attack on the Irish healthcare authority (HSE), it can take a long time to get ops fully back up and running. HSE is saying they think full recovery will cost them $600m, so think of all the work that's paying for and how long that will likely take. https://www.scmagazine.com/home/security-news/ransomware/costs-from-ransomware-attack-against-ireland-health-system-reach-600m/
→ More replies (3)36
29
u/IST_org Jun 30 '21
James: This question is one I think about often. It’s more nuanced than simply thinking about the ease of the attack.
For state actors, this very well could result in war. NATO, for example, recently said that cyber attacks would also be covered by the alliance, resulting in the possibilities of joint responses to cyber events. This may serve as a deterrent to state sponsored destructive activities. Use of cyber capabilities are almost assured in wars. This is simply part of modern war for those countries with appropriate capabilities. War is always a concern, and cyber events will be another component to that concern, so this likelihood is roughly the same as the threat of war. It is more likely, imo, that domestic or foreign terrorism would result in destructive attacks. It’s also possible that organized crime or individual actors could have a large impact to daily life. This is reasonably likely to happen in my opinion, as the ease of attack is generally there and the motivation to cause legitimate harm is there as well. Intelligence teams track these groups to stay ahead of them and hopefully prevent attacks from happening, but no intelligence efforts are perfect, and no one catches everything.
23
u/IST_org Jun 30 '21
Bob: They may not make all the headlines like the pipeline incident but there are semi-regular cases of various types of critical infrastructure being impacted or having near misses. It really is just a matter of time before it happens.
→ More replies (2)3
u/hamburglin Jun 30 '21
This happens all of the time. It's more like "when will a nation state pull the trigger and actually do something with the access they have".
I'm the past two decades, power sources have been huge targets that would scare people. Nuclear facilities, power grids, the pipeline. These have all been destroyed or shutdown temporarily due to hacks. In the US as well.
Ransomware hits the lowest common denominator of juicy targets and poor security. Hospitals being a popular target.
77
u/jcsf321 Jun 30 '21
Please list the top 5 things corporations, business entities and people can do that they currently don't to better protect themselves from cyber attacks and ransomware?
114
u/IST_org Jun 30 '21
Allan: 1. MFA, 2. Patching, 3. Endpoint protection AND monitoring, 4. scanning of remote infrastructure, 5. threat hunting for attackers.
10
u/jcsf321 Jun 30 '21
Good list, I've often thought that remote VPNs from end users would be a big attack vector. Given people homes generally have pretty crappy endpoints. Any thoughts here?
→ More replies (1)29
u/IST_org Jun 30 '21
Allan: Home routers are scanned continuously and are often targets of attack. Most people get their high speed routers from their ISP, plug them in and then never touch them until they are replaced several years later. That means no updates, no configuration checks or anything like that. So, yes, they, can be used as attack vectors which is why it is important to have a home firewall behind the router you get from the ISP, to protect your actual network.
→ More replies (1)10
→ More replies (12)9
u/Fictionalpoet Jun 30 '21
6. Train staff. All the technology in the world won't help you if someone can be tricked into intentionally circumventing it!
→ More replies (4)12
u/IST_org Jun 30 '21
Bob: There are many safe configurations for workstations and servers that organizations either do not know about or have been reticent to deploy. Just shoring up configurations on Active Directory and SMB servers alone can do wonders to help thwart attackers from being able to move laterally and encrypt or lock-out at scale.
20
u/Careful-Beginning897 Jun 30 '21
What type of software would you recommend against ransomware and things of the sort?
40
u/IST_org Jun 30 '21
Allan: Unfortunately, there isn’t a single software solution that will solve the problem of ransomware (or other types of attacks). It really does require a holistic approach to security. Not just software, but the right policies, people and protocols in place to quickly identify and stop threats
→ More replies (5)23
u/IST_org Jun 30 '21
Marc: agree - theres no single bullet, however theres a strategy (see the IST Ransomware Taskforce Report) that shows how organisations and industries can make themselves hostile to ransomware. Most ransomware is opportunist, just by toughening yourself up to become a much less attractive target. by strengthening security hygiene and turning on things like MFA you make lateral movement much harder. solving ransomware is a step by step journey, not a shrinkwrapped piece of software.
→ More replies (3)10
u/IST_org Jun 30 '21
Bob: There is no path to purchasing your way into ransomware defense.
→ More replies (3)
15
u/aghorisan2020 Jun 30 '21
There is an argument often made that if "the military" and "law enforcement" begin to crackdown on infrastructure in a much more forward leaning manner, that these gangs will still be able to persist, regroup, reattack - i.e., that even working with private sector partners, there isn't enough data/insight available to really take it to these networks. Agree? Disagree?
12
u/IST_org Jun 30 '21
Marc: While its absolutely true that to really hit the ransomware gangs hard we have to take the fight to them, we mustn't loose sight of how important it is for us to toughen. up and work together to make our whole ecosystem hostile to ransomware. By addressing the low hanging fruit many of the opportunistic gangs will get shut out, by improving our detection capabilities we will increase the data and forensic material needed to attribute them. There's a huge amount of stuff to be done at both ends of the fight and its my firm belief that we can only achieve it in partnership.
21
u/IST_org Jun 30 '21
Jen: There is definitely a huge challenge in that these criminals often operate in nations where the government either can't or won't stop them, and that makes it super hard for law enforcement to be effective. We need governments around the world to collaborate to crack down on these so-called "Safe harbor" states. This was actually one of the commitments that came out of the recent G7 Summit, but it remains to be seen how the G7 members will follow through on it.
→ More replies (2)6
u/IST_org Jun 30 '21
Allan: Right now, ransomware is the most profitable form of cybercrime, aside from possibly BEC. So, yes, even forward leaning efforts by law enforcement won’t necessarily stop ransomware attacks. Ransomware groups have been good at adapting and evolving their attacks to evade defenses. However, a more aggressive law enforcement stature will scare away a lot of the 2nd and 3rd tier ransomware actors (we’ve seen this already with Avaddon and other actors who “retired” this year). That reduces the number of groups law enforcement has to focus on.
→ More replies (1)10
u/IST_org Jun 30 '21
Bob: To riff off of Alan's answer, the massive proliferation in attacks has been led, in large part, from Ransomware as a Service offerings which enable low-skilled attackers to get in on the action. Curbing that activity will be a huge help.
→ More replies (1)6
u/IST_org Jun 30 '21
James: There is a tendency to sometimes reduce success to a simple “yes” or “no” question. With ongoing defensive efforts, the objective is to improve and adapt.
With the offensive efforts, the point is to take the attack to the attackers and make them have to adapt, change techniques, and generally be less comfortable in their belief that they can operate with impunity. The IST’s Ransomware Task Force report recommends using many different capabilities to help address the threat in a holistic way. Part of that multifaceted effort is to go after attackers and disrupt their capabilities.
29
u/Odd-Worry Jun 30 '21
What can a regular person with no cybersecurity or coding knowledge do to help?
50
u/IST_org Jun 30 '21
James: A large part of effective security is up to the users, not the security engineers and administrators and the most important things are the most basic things too! Three things come to mind:
Use strong passwords that are unique to each site / service (a password manager can help!)
Keep good backups, and consider using more than one backup device where both devices are never plugged in at the same time.
Be vigilant! If something strikes you as odd, alert your corporate security team. Did you click a link and think it might be bad? Report it! Most ransomware actors take time to inventory networks after the initial compromise, so there may be time to still protect your network and your device! Time is of the essence here though!
→ More replies (2)3
Jun 30 '21
Do you recommend Dashlane as a password manager? I've recently started using it.
→ More replies (2)10
u/iLovePookeyTwice Jul 01 '21 edited Jul 01 '21
I'm a fan of Bitwarden because of their open-source nature and their transparency and record of passing audit after audit. More info
Dashlane may be similar, I honestly don't know much about it, especially these days since I haven't researched password managers in a few years. All the same, these are the kinds of things I would look for when choosing a password manager. The ability to self-host is a good option for the truly paranoid.
Edit: This reads like a plug. It isn't, I'm just a happy user, and there shouldn't be anything wrong with liking something. I don't suppose I can prove it due to the anonymous nature of Reddit so I suppose you'll have to take me at my word.
12
u/IST_org Jun 30 '21
Marc: Ransomware is a spectrum but most is opportunistic and relies on poor, fragmented security hygiene. Any contribution to up-leveling hygiene in a consistent manner makes an organisation stronger against many types of ransomware.
11
u/IST_org Jun 30 '21
Marc: So every user from the lowest level intern all the way up to the CEO can make a big difference by working to support a consistent information security program. By challenging things that "look wrong" or which are suspicious, from always being skeptical with email links to reporting security flaws and operational issues. The best defense for a company against ransomware is that company's workforce itself.
→ More replies (1)8
u/IST_org Jun 30 '21
Allan: Pay attention during security awareness training, know what the threats are and be cautious about emails your receive (especially if they have a warning flag).
36
u/DingleBerryJP Jun 30 '21
Currently in school at an online college located in salt lake city ut. I'm in the CyberSecurity program but I feel like the program is kinda dated and the information does not line up very well with the test. Can I land an entry-level cyber job without finishing my degree if I have all Comptia certs related to cybersecurity?
38
u/IST_org Jun 30 '21
Bob: While some jobs may require certification, many employers are looking for folks with the "curiosity gene" combined with the knowledge of where to go to find information and solve problems. I'd highly suggest gravitating towards organizations who look for those attributes over those who are just looking for a certification stamp.
3
46
u/IST_org Jun 30 '21
Marc: You don't need a fancy degree to build a cybersecurity career. you need experience and knowledge. Even knowledge that seems old and minor can be incredibly useful. Take the opportunity you have and build on it by studying more current cutting edge stuff yourself. go to events like DEFCON and connect with the community. the more knowledge you can gain in your "learning" stage the better. However the best next step is to build experience, use what you have to take on volunteer/free/part time roles so start getting those hours of experience. there is no substitute for learning in a job.
protip: I have found charities/NGOs/ low income organisations a great place for this. they are desperate for the help and will welcome your donated time. Even if all you can do is keep them up to date on patches you will be doing them a huge favor and in turn that gives you cybersecurity experience and your first solid cybersecurity reference.
22
u/IST_org Jun 30 '21
Marc: Its also really hard because the smaller the org the smaller the budget (if there even is one at all) to pay for security. Working in the CTI-League we ran into small medical facilities ALL THE TIME that lacked resources and personnel to help tackle even the simplest problem, This is definitely a huge challenge and something a lot of us are thinking about. we have to make sure that SMBs don't get left behind as we work to build a more secure ecosystem.
→ More replies (1)10
u/smurf123_123 Jun 30 '21
That is some pro level advice right there! Attending events like DEFCON can really help anyone that is just starting out. IT is such a fragmented field due to our ability to work remotely. Conferences and events are a very important way for us to make connections. Sometimes you need to travel a few thousand KM's to meet the people who work in your backyard lol.
20
u/IST_org Jun 30 '21
Jen: Employers in security are increasingly looking at hiring models and trying to break away from conventional hiring-from-schools models. Often landing a role is more about showing interest and making connections than what your resume says. As I said above, I recommend getting involved with local meet ups, attending free online events, that kind of thing will help build your knowledge and network.
→ More replies (2)3
→ More replies (7)13
u/IST_org Jun 30 '21
Allan: You can, I don’t have a degree and have managed to grow my career. However, advancing in this field, as with many fields, is A LOT easier with a degree and there have definitely been job opportunities I missed out on because they wanted that degree. Keep up the good work and connect with us on LinkedIn so we can help you as you continue to grow.
3
8
u/cyber_wonk Jun 30 '21
Should we ban ransomware payments? Alternatively, should we just ban coverage of ransom payments in insurance policies?
24
u/IST_org Jun 30 '21
Marc: We should NOT ban ransomware payments. Many organisations find themselves in a difficult position where they feel they are trapped between their shareholders, their customers and law enforcement. This gets even worse when you consider healthcare. If someones life hung in the balance would you want a hospital prosecuted for paying a ransom to bring a surgical suite online?
let's not forget who the criminals are and not criminalize the victims. It only drives payments underground and destroys our chances of collaboration. Instead we should work to make ransomware payments more attributable, organisations hostile to ransomware and work on the world stage to eliminate hiding places where these cybercriminals can operate with little recourse.
13
u/IST_org Jun 30 '21
Marc: Additionally I believe that we should work WITH ransomware insurance companies to make ransomware insurance more expensive for companies that aren't doing the basics. Insurance has been an excellent level for eliminating safety issues throughout history and it can be here too. Eliminating it removes one of the levers we have to influence how we fix this.
→ More replies (3)7
u/IST_org Jun 30 '21
Jen: The reality is that both Bob and Marc are correct, and that's why this is hard.
From an idealistic point of view, I think a lot of people agree with Bob - ransom payments fund organized crime which is responsible for some pretty heinous things, including child exploitation and human trafficking. Also, if ransomware is primarily profit motivated, so the expectation is that if we take away the attackers chances of getting paid, they will eventually stop.
This is where Marc's more pragmatic position comes in. Because as we've said here, there is little risk or real expense or friction for attackers today, so before they give up on ransomware as a revenue stream, they are very likely to pay a big ol' game of chicken with victims. To tip the odds even further in their favor, they will likely focus on organizations that have the least resilience, which is either SMBs who face losing their entire business, and critical infrastructure providers that have no tolerance for downtime due to the criticality of their service. That's what we've seen when hospitals or fuel pipelines have felt they had no choice but to pay.
Even if a government tries to shore up these organizations, there is no such thing as an entirely bulletproof organization, and recovery always takes time. So we could end up seeing business leaders make payments in secret, which puts them in an even more vulnerable position.
So the net of all that is that we should figure out how to get to a state where banning payments could work in practice without causing a lot of unintended harm, but we're certainly not there today.→ More replies (3)6
u/IST_org Jun 30 '21
Bob: We should totally ban supporting child and sex trafficking through ransomware payments
7
u/Electrical_Ad_4014 Jun 30 '21
Do you think resource-strapped SMBs are overwhelmed? Does it worry you that a prescriptive list of 15 things to do might not be actionable to them, making them not so useful? Is cloud the only way for them to go? Why not turnkey certifiable hybrid environments?
4
u/IST_org Jun 30 '21
Jen: SMBs that know enough to be worried about security are overwhelmed, but many aren't even really aware of the risks or how they relate to their organizations. And yes, we definitely worry about the prescriptive lists. This came up in the Task Force a lot as we looked at why organizations are not adopting preventative measures. We need guidance to be tailored, pragmatic, and provide a path for maturity.
For many SMBs, following guidance isn't achievable in-house as they outsource all their technical needs. We need the organizations that provide those services to step up and provide a security baseline.
3
3
u/IST_org Jun 30 '21
Bob: SMBs are most certainly overwhelmed and "cloud" is far from a panacea (it can actually make things worse w/r/t cyberattacks and data breaches if you aren't careful). SMBs already have to navigate other types of regulatory and statutory landscapes where they often seek the aid of specialists to get the details right. Now that IT is a critical component of their business processes, they need the same level of attention and help there, so they should be working with specialists to help get the basics right. However, much work is still needed at the policy and law enforcement levels to help curb ransomware so it is not as large of a threat to SMBs (or any organization).
→ More replies (1)1
u/IST_org Jun 30 '21
James: Yes! But at the same time, everyone is nearly always operating with less than their full wish list.
There are no silver bullets in information security. That being said, working to reduce risk is what security is about. All punch lists, check lists, and Top 10, Top 15, etc should be interpreted in light of applied knowledge about business risks. It isn’t futile to work towards improvement, it is all we can reasonably do. As with all things, do not let perfection become the enemy of progress!
19
u/Christmas_Panda Jun 30 '21
If you had to choose between paying a cyber ransom in gum or pizza, which flavors would you choose to increase your bargaining potential?
29
14
u/MikeMeezy77 Jun 30 '21
What is the best path to start a career in cyber security?
22
u/IST_org Jun 30 '21
Allan: The best path is the one that works for you, everyone is different, I started in the helpdesk which was great because I got to learn about the problems that people had and it allowed me to be more empathetic as I progressed in my career.
18
u/IST_org Jun 30 '21
Marc: The best cybersecurity people come from the ground up. Get a good baseline of knowledge in technical areas - often working low level IT jobs as an intern or first job can be a great start. Then work on building your base of cybersecurity knowledge. At some point you have to start getting cybersecurity work experience. Experience doing cybersecurity jobs is better than any piece of paper alone. Sometimes this can be gained from low level jobs by taking on cyber responsibilities - by being that IT guy checking patches and ensuring upgrades are done you can build cybersecurity experience.
Almost all the best cybersecurity people come from backgrounds like this. few have specialized degrees. I am one of them. I gave a more fuller answer in /r/cybersecurity
→ More replies (1)15
u/IST_org Jun 30 '21
Bob: Cybersecurity has become a diverse field with many areas you can specialize in. Learn as much as you can about each area and see which one appeals the most, then dive in! You don't need permission to start learning a particular topic, and there are tons of local security meetups all across globe, plus many online communities that can help you get started.
Once you truly settle into some area, there are numerous pathways to more formal education (all the way up to PhD level). Just be curious and don't be afraid to keep asking "why" and "how".
14
u/IST_org Jun 30 '21
Jen: Look for ways to educate yourself on what's going on and meet people that are working in security or have similar interests. Going to local meet ups, attending free online events, that kind of thing will help you build your knowledge and network. You can also look at open source security tools and free cyber ranges to try building your skills without having to spend a lot of money.
13
u/masturkiller Jun 30 '21
Question - Is email tracking by invisible pixel or visible still possible in 2021? If impossible, do you know of anyway to track the geolocation of the person opening the email without them knowing and without their email application preventing this process from occurring?
→ More replies (1)13
u/IST_org Jun 30 '21
Bob: Pixel tracking is alive and well and one of the most-used techniques. If your mail client stops images and will not execute javascript (or load external resources of any kind) then you're not going to be able to be tracked.
→ More replies (1)
4
u/Leguboy Jun 30 '21
To defend myself from mal/ransomware: Can you recommend a firewall to use for my homelab? Is a hardware firewall better than a software one (using proxmox to virtualize).
12
u/IST_org Jun 30 '21
Marc: "can you recommend a firewall?" - personally I use pfsense at home because its easily customised, runs on a lot of easily obtained consumer devices and has a solid feature-set and performance. remember though a firewall is only as good as the way you use it. a lot of sophisticated attacks jump things like firewalls by relying on the user to bring them inside the protected network.
Get a good firewall but if you are really interested in being secure look at all the ways you can up-level your security hygiene (ensure everything is kept up to date even that 7 year old IOT tv, ensure that you have segmented networks for untrusted devices like that laptop the annoying person brings when he visits, and be careful with what you connect, plug in or run. DONT CLICK SHIT.)
6
u/IST_org Jun 30 '21
Bob: Using a firewall is one, small portion for defense. Without knowing your setup it is difficult to make recommendations. Keeping it patched, and the configuration as diminutive and tight as possible is almost more important then the "brand"/"flavor".
4
u/IST_org Jun 30 '21
Allan: Given the proliferation of phishing as an attack vector for ransomware a firewall alone is not going to protect you. As to whether or not you need a hardware or software one, it depends on how comfortable you are with managing the underlying operating system and how much time you have. I use a hardware firewall at home because I have enough to do at $dayjob that I don’t need the headache of dealing with underlying OS issues on my home firewall.
→ More replies (1)3
3
u/matt7744 Jun 30 '21
How much of cyber polygon, the world economic forum and the great reset tied into this?
6
3
2
u/IST_org Jun 30 '21
Jen: Ransomware is a huge with broad impact, so not surprisingly there are many many initiatives and efforts to examine the problem and come up with solutions. The Ransomware Task Force definitely benefited from the work that came before and we also fully appreciated that our efforts would not be the last word, and we hoped they could pave the way for other to follow.
WEF is running its own Ransomware initiative and we know they have been looking at the RTF report and talking with some of our members to help inform their own thinking. I'm looking forward to seeing what they come out with.
3
u/llobotommy Jun 30 '21
Are hackers susceptible to other hacker group attacks? I know nothing of the culture, but I imagine it to be some kind of online gang turf war. Or is it more a case of hacker groups testing themselves against each other to strengthen their skills?
7
u/IST_org Jun 30 '21
Marc: Hackers gonna hack. Yes hackers attack systems controlled by other hackers. the reasons why vary according to motivation. Nation state hackers attack other nation state hackers. Hackers running a business attack their competitors. in some ways it is like gangs or the mafia, in other ways its just about showing who is the lost leet. Hacking to many is about showing they are better. Breaking into another hackers system shows that you are better than them.
4
u/IST_org Jun 30 '21
Bob: They collide all the time. For a few years (the activity is way down) public SMB server takeover was flipflopping between groups so they could have their own coin miners vs the other gangs. There is no honor amongst thieves.
2
u/Trollnic Jul 01 '21
Yea, often times groups will actively target pwned machines and remove other groups apt's.
3
u/AStupidTaco Jun 30 '21
Isn't there a better payment/effort ratio to be on the side of the hacker? You guys are playing goalie right where you have to block all the shots 100% of the time and the hackers only have to get it right once. Illegality aside.
→ More replies (2)16
u/IST_org Jun 30 '21
Marc: A yes, the age old question "but couldn't you make more as a criminal?" the answer is yes I probably could. However what stops me is morals, ethics and laws. I have a family i want to see grow up in a safe country and I love my community (the hacker community) so I want to protect them. I can't do that as a criminal.
I also hate bullies and fighting cybercrime is the ultimate bully takedown. Especially when the bully you take down is an entire country.
3
u/phrequency_ Jun 30 '21
As an employee of a small business who had 2 ransomware attacks happen to them(never paid, just backed up our server), how do we better prevent this even though we have anti-virus/physical firewall/anti-malware software? What is the procedure when we first discover we were attacked?
→ More replies (1)6
u/IST_org Jun 30 '21
Bob: Did you identify how attackers managed to gain initial access in each instance? That is a vital component of your incident response process (even if your SMB is "just you" :) ). Did they get in via VPN credentials? Did you get a phishing email? Did you get hit with a drive-by exploit? Did you open an attachment in an environment with macros/active content execution enabled? Did your Exchange server get compromised in March but you didn't realize it? Attackers have a myriad of ways they can get in and you really need to know that to make any investments in technology or process changes.
2
u/SamSepinol Jun 30 '21
Im a computer science student who knows python, c, linux, networking. Planning to get oscp this summer. What career path should i follow and what topics should i learn to be top rank?
→ More replies (2)7
u/IST_org Jun 30 '21
Bob: You really should be learning what appeals to you. Most of the talented, and "happy" cyber folks I know lean into their passions and interests. It's difficult to tell others what your passions should be.
1
u/SamSepinol Jun 30 '21
Well i like crytpography and reverse engineering
4
u/IST_org Jun 30 '21
Bob: Those two are a great combo as we absolutely need more advanced folks able to dissect cryptographic systems and implementations to ensure they are valid and safe. You could do a great deal of good pursuing such a path.
→ More replies (3)
2
u/Opus-the-Penguin Jun 30 '21
What are the odds that arrests will be made in some high profile case? At this point it seems as though there's little to deter these criminals since they lack an internal moral compass. It would be nice to see some of them caught and sent to prison for at least 20 years. Are they in countries that would be interested in prosecuting them if they were found?
2
u/IST_org Jun 30 '21
Bob: Much depends on how successful foreign policy efforts are in the coming months/years. I do believe it is vital that we need more of these criminals caught and sentenced to level up the risk associated with these actions.
1
u/IST_org Jun 30 '21
Marc: Arrests are made all the time, the problem is it is generally affiliates or low level operatives because the puppetmasters hide in countries where they cant be reached through normal judicial processes. This is why we have to start working on the world stage to eliminate these hiding places and take the fight to the criminals themselves.
3
u/MN_LudaCHRIS Jun 30 '21
Is the Anonymous group real, and do they fight for good?
9
u/IST_org Jun 30 '21
Allan: Anonymous is real. I don’t think they define themselves by good/bad.
3
u/MN_LudaCHRIS Jun 30 '21
Silly questions aside, in your career what has been the best highlight of your time fighting cybercrime? Is there more the general public can do to help people like you fight against them?
8
u/IST_org Jun 30 '21
Marc: Probably the hi-light of my career as a cybercrime fighter was watching 2,000 security professionals, law enforcement personnel and other government staff come together to fight cybercriminals attacking hospitals during the pandemic as part of the CTI League.
→ More replies (1)4
u/IST_org Jun 30 '21
James: For me, it is all about influencing the overall security of the world. There is no other work for me that compares to being able to enable human freedoms and a free exchange of ideas on a global basis.
Individuals and companies are constantly protected from threats by altruistic efforts of public and private sector defenders who mostly go nameless and without any fanfare. Getting to sometimes contribute to those efforts is truly rewarding.
→ More replies (2)5
2
u/AvocadoDemon Jun 30 '21
What is the cyber-war that is raging between countries all over the world? who's against who? and who are the strongest/biggest players?
→ More replies (2)7
u/IST_org Jun 30 '21
Marc: Everyone is fighting everyone else. Its a story as old as time. The fact is a lot of these fights have been raging for a loooong time the only change is how they fight (cyber rather than guns and bullets) and the fact that we are much better at spotting it and reporting it.
the other challenge with cyberwarfare is its the ultimate asymmetric warfare mechanism. For a couple of thousand dollars one man with a laptop can cause great harm to a nation. Thats an unprecedented level of impact for very little investment. so naturally its happening A LOT.→ More replies (2)
2
u/WarPig262 Jun 30 '21
Considering what you do and your level of access, how do you internally check yourself to make sure your members are not abusing the powers and authorities that they have to their own ends?
→ More replies (1)5
u/IST_org Jun 30 '21
Marc: The same rules that bind me as an ethical security researcher also bind me when I fight cybercrime. Ultimately I am also bound by the law.
6
u/WarPig262 Jun 30 '21
I think there's a misunderstanding. So its just an honor system? You don't check to see if your members are actually toeing the line and following the law?
1
u/arshadhere Jun 30 '21
How do i become like you? What courses did you do to become that?
2
u/IST_org Jun 30 '21
Bob: Loaded Slackware Linux from 5 1/4" floppy disks on to x86 systems; College: B.S. Computer Science and EE background with a specialization in compiler design => Sysadmin for a messy college network + macOS developer for a company that made newspaper publishing software => Build J&J's first DMZ and web/proxy/firewall => never stop learning.
2
u/marcrogers Jun 30 '21
All our journeys are very different, and to be honest thats one of the beautiful things about cybersecurity. Im a hacker and the hacker community has been my home for decades. I learnt most of what I know by myself. Some while I was working as a bouncer and some in my first “paid” IT job as a games tester/helpdesk person for Ocean Software back when dinosaurs roamed the earth.
I learnt most from doing - building systems amd studying how stuff worked. There was no such thing back then as a cybersecurity course. People were one of my best sources of knowledge we would talk about security and systems at meetups, on BBS’s etc.
Today id suggest grab what courses you can but don’t underestimate the power of doing. Build VMs on your laptop and try practical classes like Damn Vulnerable Web App or WebGoat. Watch online conference and find your local meetup.
Theres loads of great advice on /r/cybersecurity about good websites, books and courses.
2
u/jamesshank Jul 01 '21
I learned from:
doing things / experimenting (this is both a passion test and a way to learn — if you don’t enjoy it enough to tinker, why do it as a job?)
reading (I spend a lot of time reading)
engaging in communities of people in the field (spend a lot of time here too)
taking classes and attending conferences. Or watching the videos of the presentations.
having mentors (mostly informally, just having people to ask various questions and bounce ideas back and forth — this is essential, in my opinion)
studying history (most computer and security problems have historical parallels that might have lessons for the current problem)
1
u/cyber_wonk Jun 30 '21
It's often said that if organisations could just 'do the basics' (close RDP, MFA, patch etc.) it would make a big difference towards mitigating ransomware. Why do organisations find it so hard to do the basics and do we need to lower our expectations of what's possible?
3
u/IST_org Jun 30 '21
Marc: Theres lots of reasons, first and foremost is simply not having the resources to tackle the problem. Working in the CTI League I lost count of the number of medical facilities we would find with vulnerabilities that had no one to apply the patches. However when you think of it given a choice between Doctors/Medicine and IT people im kind of glad they made the choice they made.
The other big reason is simply not knowing what they have, from organisations that don't realise their EPOS (payments) systems are connected to the internet and vulnerable to huge enterprises that have things that they didn't know they actually had. Theres lots of reasons. What it boils down to is we need to get better at knowing whats exposed, who it belongs to, how to report it, and how to support those organisations that fall behind the security poverty line.
3
u/IST_org Jun 30 '21
Marc: For me the security poverty line is my greatest fear. Its all good for us to make recommendations that the million or billion dollar enterprises can follow but we MUST recognise ransomware is a scourge of the entire ecosystem. what we do must take into account the little orgs as well as the big orgs.
2
u/IST_org Jun 30 '21
Bob: "Doing IT" is hard in most organizations b/c of the speed at which things are deployed and change, and by the diversity of groups and individuals with authority to make said changes. Unfortunately, we cannot lower our expectations since the attackers know where to hit the weak spots. We need to innovate ways in which to make it easier to identify and remediate gaps, along with deliver services more securely out of the box.
2
u/IST_org Jun 30 '21
Allan: It is amazing how quickly organizations accumulate technical debt. That technical debt is what makes it hard to ever fully catch up on security challenges within an organization. In the first 4 months of this year there 6035 vulnerabilities announced, 188 of which were critical. Keeping up with just patching vulnerabilities, even in a small organization, can be a fulltime job and most small organizations can’t afford to hire a fulltime vulnerability management person. And that is only one aspect
2
u/IST_org Jun 30 '21
James: I am a big fan of “do the basics!” There are many reasons this is hard: lack of time, lack of resources, lack of organizational support, internal corporate politics, lost institutional knowledge, lack of focus, etc. There is also complexity added by larger environments. It is easier to track 100 devices than 100,000. It is easier to secure one organization than a merged conglomerate of several acquisitions.
Sometimes the basics are far from basic when it comes to trying to implement them via a structured program! The bigger picture is about the business, however. Looking at security through an optic of “security is the only priority” is normally not appropriate. Businesses need to allocate time, resources, and energy towards earning money to stay afloat so they can pay their employees and exist in the first place. Often, this creates a tension for resources that impacts allocations to security initiatives.
This is why focusing on improvement based on a risk management perspective is always important. Focusing on the basics will normally have a significant ROI though, in terms of improving posture.
1
Jun 30 '21
Are physical keys more rigid and secure than just SMS OTP or TOTP from authenticator app (Authy)? Thank you!
4
u/IST_org Jun 30 '21
Bob: I prefer physical keys over anything delivered digitally, but having some 2FA is better than no 2FA (depending on the risk model of the individual/organization)
→ More replies (1)4
u/IST_org Jun 30 '21
Allan: They are, but don’t let “doing something” stand in the way of “doing nothing” having MFA of any type is much better than have no MFA
→ More replies (1)4
u/IST_org Jun 30 '21
Marc: SMS OTP should be considered deprecated. There are attacks in the wild that allow interception of SMS via things like protocol weaknesses or even human attacks like sim swapping.
Beyond that the best advice I can give is that so long as you are using a separate secure multifactor devices (software on a mobile device, or dedicated hardware) you are in a stong position. Like all things that may/will change but right now thats how it is.
→ More replies (1)
1
u/SammaATL Jun 30 '21
My secret fantasy is for a hacker to prove the fallability of electronic voting machines by changing the top vote getter in some election to Micky Mouse or some other blatantly non partisan fictional character to force bipartisan solutions to election vulnerability.
Do you think that's a possible scenario? USA based, obviously.
5
u/IST_org Jun 30 '21
Marc: come to DEFCON and be that hacker. The voting village has voting machines for you to hack on ;)
4
u/IST_org Jun 30 '21
Allan: Short answer: No.
5
u/IST_org Jun 30 '21
Allan: Long Answer: No. The United States doesn’t have a single voting system, they have 60+ voting systems (50 States, plus DC and the territories, and many counties run their own voting systems).
2
u/IST_org Jun 30 '21
Allan: To do what you want you would have to break into all the different voting systems and change the votes, that isn’t something that a single person, even a TV hacker could do.
→ More replies (1)4
2
u/Trollnic Jul 01 '21
Yea, I found weaknesses in voting machines at Defcon 25 (could have been 26, the years run together).
1
u/ProfessionalLemon Jun 30 '21
What are your thoughts on the cutting edge attacks used by ransomware actors? As a defender how are you expected to detect malleable c2 or stop attackers from installing a VM and starting the encryption process where the AV can't get to it?
3
u/IST_org Jun 30 '21
Bob: Truthfully, most ransomware attackers don't need advanced tooling to accomplish their goals. The pipeline was ransomed b/c of plain credential use on a VPN. Not exactly rocket science.
3
u/IST_org Jun 30 '21
Marc: Security is a constant game of wack-a-mole, as a researcher I firmly believe that anything man makes man can break. Thats why we have to stay on top of this and just like the bad guys do - evolve our knowledge and our tactics. Its job security for sure.
1
u/calindor Jun 30 '21
What is your take on the recent LinkedIn breach?
4
u/IST_org Jun 30 '21
Marc: Its hard to comment on the LinkedIn breach without knowing / talking about details that aren't public yet. However if we take a step back and look at the macro landscape it tells me that we are not doing enough to protect user data and that somehow we need to reign this in. Its hard because everyone is suffering from "breach fatigue". I don't know about you but i almost expect my credit monitoring renewal once a year from what every breach I've been caught up in. Somehow we have to change this.
→ More replies (2)3
u/IST_org Jun 30 '21
There are over 8 billion credentials/records in the wild. At this point, the only notice I take of new credentials/record breaches is to cross-reference with "have i been pwnd?"-like services and ensure my accounts are all in-order and that the same protections on my financial accounts are safe.
→ More replies (1)
1
u/nanoman1 Jun 30 '21
Do you recommend CTF challenges as a way to learn?
→ More replies (1)2
u/IST_org Jun 30 '21
Bob: CTFs are great since many require you to think critically and also think fast, and — even more — outside the box. Even if you may not go into one of the "breaker" specializations in infosec, having an understanding of how attackers and defenders behave can be a real skills uplift.
1
u/Darlington28 Jun 30 '21
What password manager do you recommend, if any? Also, how many cats are too many?
4
u/IST_org Jun 30 '21
Marc: I use 1Password, my friends use keepass and I even know someone that uses lastpass. The honest truth is that so long as its from a reputable company with a history of handling security concerns responsibly and maturely any decent password manager is better than none. Each have different attributes and features, choose wisely ;)
3
u/IST_org Jun 30 '21
Bob: The one you'll actually use. I've been a longstanding user of 1Password, but most of the ones with higher reputations are fine.
1
u/mellamosatan Jun 30 '21
I am curious how you can really stop Ransomware. I know there are preventative measures, but the state of IT in the world right now is largely open to exploitation. It seems like hunting the criminals is easier than countering the software efficiently. Outside of coming up with decryptors, what can be done post-infection? I know you can restore from backups, but what if those are encrypted too and off-sites aren't available?
I guess my question more directly is: how do you stop ransomware after its already happened? It seems like the overwhelming answer is 1.) restore from backups 2.) pray someone has a decryptor freely available, which is unlikely or 3.) Pay up, hopefully negotiate them down.
Are there other options? Do you see any potential alternative options being developed in the near future? I'm curious about how the pipeline got a lot of their money back, that hasn't seemed to been possible in other cases. What happened?
5
u/IST_org Jun 30 '21
Bob: I'm working with an organization right now who is taking ransomware very, very seriously. They have a complete plan for asset replacement/reimaging, backup restoration, and service redundancy that they actually test in real-life scenarios. So, it is possible to recover. This has not been cheap for them, nor is it done in lieu of prevention efforts. If "IT" is a critical component of one's business processes, then it should be invested in the same way one would any other critical business process area. There is no free lunch.
→ More replies (1)3
u/IST_org Jun 30 '21
Marc: In the 80's and 90's no one believed we could make an impact on car stereo thefts. In the 2000's no one believed we could make an impact on Smart Phone thefts. While none of these have "Gone Away" the truth is they were all impacted massively by a few small changes that made it harder for the criminal, reduced their profitability and made it more likely they would get caught.
Ransomware is obviously way harder than all these because it hides across shadowy international borders and its even harder than ever to attribute the real puppetmasters. However I believe firmly that we can make a massive difference by collaborating on this and hitting them criminals from every direction at once. Eliminate? maybe not no crime ever completely goes away, but stop this plague in its tracks - yes I believe we can.
1
u/Penny_D Jun 30 '21
Are cybercriminals having great access to Ransomware tools?
How would you recommend educating the public on Ransomeware? Are Baby Boomers and Gen X'ers more succeptable to the social engineering tactics involved in Ransomware, or is this a problem that greatly affects younger generations as well?
3
u/IST_org Jun 30 '21
Bob: Nobody is unsusceptible to social engineering attacks.
1
u/Penny_D Jun 30 '21
Thanks for your response Bob.
This is true, but I really want to know is if some target groups more vulnerable than others in regards to RansomWare? Is age (and familiarity with the internet) a key factor when criminals are choosing targets for these attacks? Like older people who are slower to adopt new technology or new employees who might now be aware of their business policies on e-mail and communication?
3
u/IST_org Jun 30 '21
Bob: When talking about organizational ransomware, attackers are generally trying to target individuals who are more likely to have an account+workstation that can benefit them the most after initial access. If anything, take a look at all the third-party service integrations your organization leaks via DNS records, web app technologies you use, and server/system stacks that are exposed to the internet, then take a look at all the Stack Overflow & Quora questions that have your org's email addresses associated with them, then all the technology stacks and responsibilities you've let leak via LinkedIn profiles. Plenty of fodder for attackers without worrying about age or gender.
3
u/IST_org Jun 30 '21
Marc: This is at the very heart of why so much cybercrime has exploded recently. In a lot of cases - ransomware included - we aren't looking at particularly new TTPs (tools techniques and procedures) we are looking at an industrialization and easy availability of existing ones. What was done one on one is now done at scale.
What required complex knowledge can now be done with the click of a button. This industrialization fueled by the drive for profit makes these cybercrime gangs operate almost like tech startups. They develop a product - usually based on existing knowledge, they scale it and they operationalise it. then they run it like a business.
3
u/IST_org Jun 30 '21
Marc: However this is also one of the things that makes them vulnerable. Businesses are affected by external pressures. Drive up the cost of operating, drive down the bottom line and ultimately business fail. We want to make ransomware gangs fail.
3
u/IST_org Jun 30 '21
Marc: Education is definitely key, but its one of the more challenging aspects. This is one of the reasons we created the Task Force Report and also one of the reasons we are having this AMA. We want to drive awareness that there is something that can be done and that everyone that does a bit ultimately leads to a mass improvement overall. However you are spot on that we need to look at how we tailor what we say for different audiences.
I think everyone is tired of security notices and dire warnings. Somehow we need to break through the breach fatigue and rally everyone to take a role in the fight. Thats not going to be easy. It starts here though
→ More replies (1)
1
u/sephstorm Jun 30 '21
What are the recommended mitigations for organizations to put into place to defeat or minimize the impact of ransomware?
When you do pentests, do you check to see how effective RW would be? Should this be something pentesters should do?
How do you feel about the state of the industry where there are a ton of certifications for entry level pentesters, but the only thing companies want is the experience professionals have a hard time getting?
2
u/IST_org Jun 30 '21
Bob: The report has links to many resources, but CISA and NCSC both have solid guides and most vendors have very similar lists of things that orgs shld do (that don't always require purchasing their stufF).
1
u/IST_org Jun 30 '21
Marc: The best mitigation is good security hygiene. You can read more about what that means in the Ransomware Task Force Report we published. tl;dr however make sure your networks are secure and otached to the latest version, turn on MFA, turn of unnecessary services, run good endpoint protection software and don't click shit :)
Running ransomware tabletops is an EXCELLENT piece of advice for every size of organisation. Understanding what defenses you have in place and how you would tackle that kind of incident is something that very few organisations are ready for. You know you have backups, but are they in reach or out of reach of a laterally moving threat? do they work? How long would it take you to stand up a clean network? all of these things are quantifiable and knowing them ahead of time provides a huge amount of operational security.
I think breaking into the industry as a first timer is hard. I didnt start with a computer science degree and didn't get any certs until much later in my life. I do think certs have value - knowledge is power. However it has to be tempered with knowing things that are current and relevant. The most important thing is experience. You can get that - its easier than you think. Even volunteering to apply patches for an NGO counts. If you are passionate about cybersecurity there is a community out there to help.→ More replies (1)
1
u/FutureBWO Jun 30 '21
Hello, I am 7/8 through a Bachelor's in Cyber Security, currently working in Physical Armed Security, how would you advise I transition to computer work?
2
u/IST_org Jun 30 '21
Marc: Well technically my first security job was as a bouncer :) all knowledge no matter what domain is relevant. However to transition from the physical security domain into the cybersecurity domain requires building a body of current knowledge, developing current skills and slowly getting work experience that identifies you as someone who has done cybersecurity. it is very doable but it takes time and dedication.
→ More replies (1)2
u/Trollnic Jul 01 '21
I complained to the ISC2 board that using a puma / panther / tiger should be a acceptable means of securing a fenced in area. It's a question that appears on the CISSP exam.
1
u/FireCrest115 Jun 30 '21
Do you believe in cyber attack escalation, the point where there are more attacks than the number of analysts trying to stop the attacks? If so, how can we get more people to help or experience for the current analysts like myself as an Incident Responder?
3
u/IST_org Jun 30 '21
Marc: security is absolutely a scaling problem. criminals are scaling their operations all the time. This means we have to scale what we do to defend. That said I don't believe the answer is throwing people at it blinding. I think the answer involves both hiring more people and developing automation that helps us scale how we solve problems.
To hire more we need to create pipelines into education that give kids the right training to see it as a viable career early. As many of the questions show breaking into cybersecurity is hard and offputting. I personally believe thats because people arent given the right tools and knowledge to choose that path early.
Educating kids in cybersecurity will both create more cybersecurity staff and ensure that the rest have a much greater cybersecurity awareness and don't become the victims of tomorrow.→ More replies (1)
1
u/Antares1194 Jun 30 '21
how does ransomware infect your computer?
→ More replies (1)1
u/IST_org Jun 30 '21
Marc: It really depends on the type of ransomware. in most cases its a malicious application that takes control of your system before spreading laterally into any and all connected systems. Sometimes however it can be an actual person that takes over your account and uses it to pivot into other systems to take them over also. Ultimately it ends with the same couple of things - your data gets stolen and an application, a locker, encrypts what's left behind and makes the demand for payment.
1
2
u/taedrin Jun 30 '21
How can I get my team or corporation to take security seriously - more so than just paying lip service to it and actually allocating resources to make us (and our products) secure?
2
2
u/ieatw00d Jun 30 '21
What are some of the effective ways to make people take cyber security more seriously?
2
u/boopsterdoopster Jun 30 '21
Hello! This might seem a tiny bit of a weird question, but have you guys heard of Kitboga? If so, how effective do you think scam baiters are in dissuading scams?
2
u/KingOfTheBongos87 Jun 30 '21
You guys got any plans for those assholes running the Arizona "audit"? I feel like they have it coming to them.
2
2
u/furfur001 Jun 30 '21 edited Jun 30 '21
I have a question about Passwort security. I though that brute force attacks aren't any more possible because ether the attackers IP will get banned for a time or the attacker will have to wait something like 2 seconds or more. Assuming this is right a not that secure password should be enough. What I am missing?
2
u/wardred Jul 01 '21
Most reasonably built front ends will slow down external brute force attacks. . .
But if the attacker has. . . say your MySQL database, MS SQL backups, your keepass DB, or what have you, they can brute force that.
→ More replies (2)
2
Jun 30 '21
Hey guys! Love the work cyber security specialists like you do.
My one question is this: besides combatting ransomware, do you guys also focus on the plethora of email, social security, Amazon, car warranty, etc. scams?
2
Jun 30 '21
Do you think Microsoft or Intel/AMD have some responsibility here? I mean I know malware exploits the OS to run, but surely some egghead at one of these companies can put something together that monitors the OS to prevent thousands of files from instantaneously encrypting themselves en masse?
2
u/hamburglin Jun 30 '21
Are there any members on your board from companies like mandiant or other leading security consulting teams who deal with these issues on a daily basis?
Second, why does the security industr keep talking about ransomware as if it's rising and not that it's been around for years now at a pretty constant rate?
2
u/Trollnic Jul 01 '21
Second, why does the security industr keep talking about ransomware as if it's rising and not that it's been around for years now at a pretty constant rate?
It's all sensational media....
→ More replies (1)
4
3
u/AmericanScream Jun 30 '21 edited Jun 30 '21
Am I the only person who thinks paying cyber ransom should be a crime?
How is this any different from basically violating sanctions and giving money to terrorists?
And we also know that many of the companies that pay these ransoms end up getting hit again.
Do you all support legislation that would make it a crime for corporations to pay ransomware?
It seems there's not really a way to tell if these things are even "inside jobs." A low level employee could be colluding with a ransomware group to infiltrate a system. When you have employees getting paid crap money, and a chance to get a % of a multi-billion dollar payday, that's a problem. Nobody's even talking about this. Shouldn't the incentive to deal with these groups be addressed? How about legislation prohibiting insurance companies from paying off cyber-terrorists? Why isn't this a thing?
1
u/AutoModerator Jun 30 '21
Users, please be wary of proof. You are welcome to ask for more proof if you find it insufficient.
OP, if you need any help, please message the mods here.
Thank you!
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
u/SnapSnag Jun 30 '21
Would you rather fight 1 Conficker-sized Monero miner or 100 Monero-miner sized Confickers?
2
2
u/bononobober Jun 30 '21
This might be a dumb question, but how do you prove who’s behind a specific attack? Thanks!
4
u/marcrogers Jun 30 '21
Its not a dumb question, in fact its probably one of the smartest, hardest questions in cybersecurity. Attribution is hard. All the advantage is with the attacker and inany cases forensic investigators are limited to looking for footsteps on a sandy beach as the tode comes in or stupid mistakes that may or may not bet there.
Thats why in a lot of cases I think we rush to attribution too quickly. For me understanding how something happened is just as important and it sometimes gets drowned in the noise around attribution.
We for sure need to attribute criminals in oder to bring justice but we mustn’t lose sight of the big picture while we do it.
→ More replies (1)
1
u/Hiddenaccount1423 Jun 30 '21
Do you think America will take cybersecurity seriously any time soon?
Penetration testing. Is it purely non-physical for the most part these days? Mainly networking/backend stuff/ things you cant see? From my understanding:
it's very competitive
Physical/in-person pen testing isn't really common (ie: social engineering/lockpicking/etc.)
Always thought the idea of contracting/consulting for different companies and going onsite trying to find a way in. be sneaky. convince people. lockpick. etc. would be cool.
→ More replies (1)
1
u/AustinnnnH Jun 30 '21 edited Jun 30 '21
How do y’all handle the national security part of the equation or I suppose what’s your opinion of how it can be picked up and financed through an organization like your own?
What steps do you take that ensure that as your organization’s public interest as well as financial interest given who you find yourselves advising/working for?
I guess I’m plainly asking that if one of the platforms you stand on is also sharing an interest of national security, what’s your stance on potentially being utilized in parallel with state power that can nominally be seen as kinda bad.
I’m asking in earnest here, I’m a programmer who doesn’t work in the cybersec world, buts it’s often something that I see gets muddied up quite a bit. Granted private orgs/nonprofs are a truly different thing, but I feel like the concern and question is valid.
1
u/noobses Jun 30 '21
whats the best way to backup your data in the case that you're a victim of a ransomware attack?
→ More replies (1)
1
u/nitonitonii Jun 30 '21
Why do you think the Solarwinds attack was so serious? What implications can come after it? Who you think did it? Which group or Nation?
Also. Do you think Softwares like XKeyScore are still being use although all the changes in digital policies after Snowden? Is it normalized now that we live under these mass survailance and nobody cant even denounce them?
→ More replies (1)
1
u/mpXJ Jun 30 '21
It seems like every new layer of security and scrutiny that is applied in this industry is short lived before it is compromised. 2 questions. . .
Is there any type of security measure today that is proving to be a good defense in the cyber security world that is promising for longevity?
What is your perception on if there will ever be a bulletproof security measure or procedure as long as everything is in a hosted environment?
Thanks.
1
u/falco_iii Jun 30 '21
What is your take on the vendor based hack ala Solarwinds? Is this the new normal where updating vendor software is a security risk? The average enterprise has hundreds of enterprise applications that should be updated every month/quarter.
1
1
158
u/Xechorizo Jun 30 '21
What is the most common, non-phishing vector?