Hey, so bottom line, I've got about 30 minutes, and what I was going to do is share with a little bit more detail the... Somebody just clapped because you're like, 'Thank God he only has 30 minutes.' All right, I get that. Well, I was just going to talk about what we learned last year responding to 1,163 intrusions, and what I did is just went through how many cases did Mandiant start during the calendar year. So we're still working some of these. Realize that every time we respond to a breach, that matters unique, and that we try to figure out who did it. And there was a time in my career where I was law enforcement, I was in the Air Force, and just I was wired that way. That it makes sense that if you're responding to unacceptable network behavior or criminal activity or espionage, you want to know who did it, and you want to be able to catalog who did it. And we have a lot of fun doing it, probably more fun than our customers going through it.
So I'll tell you the conclusions, then I'm going to tell you the apex predator offense of 2022, and then just some of the key things we've learned in the boardroom. So stat we've tracked since the get-go, and I'm going to walk around just because it's fun. Oh wait, mic's on now. Good. I didn't wear a tie, so the mic's not going to work as well as it normally does. One of the things we've tracked since 1998 is how are organizations detecting incidents. And in 2012, 63% of the incidents we responded to, the incident notification came from external to the organization. In 2022, 1,163 investigations, it was 63% external again. If I go all the way back to right around 2004, it was over 95% of the incidents we responded to were external notification, but we had a very small set of problems that we were responding to at that time. And the reason I share that is a lot of times CISOs get dinged if they get external notification from the FBI or government organization that, 'Hey, you may have a compromise.' Senior leadership doesn't understand that the norm in our business sometimes is external notification, and that external notification comes from folks like Palo Alto Networks or CrowdStrike or Mandiant, or it comes from law enforcement. But a lot of companies do have what we call victim notification programs, and they've gotten better, which leads me to the next stat. Something else we've always tracked is called dwell time. That's a fancy way of saying from the moment someone's breached to the moment they know it, meaning incident declaration, how much time goes by. And in the early 2000s, one year we tracked it, and it was 742 days. And I felt that that's too long. If you've been breached and you didn't notice it for over two years, you're good to go. Just keep running your business, and it doesn't matter. And but it was 241 days in 2011, and we've gotten it down to a global dwell time of 16 days was the average. And we slice and dice dwell time by was it ransomware versus other type of investigation. We slice it by geography, and we slice it actually by detection, whether it's incident detection from the external side, third party, or internally. And what was interesting is it's going down regardless of type of investigation and whether internal or external, except for one. One category popped up from five days incident detection dwell time to nine days, and that was ransomware. So that a theory, I can be wrong, but when I looked at all the cases we responded to, 18% were ransomware compared to 23% were ransomware in 2021. So it's just around 200 or so cases of ransomware. Dwell time went up because I think whoever is breaking in and gaining access is not the same as whoever is actually running the ransom and trying to collect. And so that's the delta is in just the difference in parties and the recruitment. Insider investigations. I know John Ford's here. He runs our insider investigations. John, where are you by the way? He walked out probably once I took the stage. No, you stayed. Finally, this first time you've ever seen me present. I appreciate that. John runs our insider investigations, and it's going to be... I have a misleading stat because based on what I reviewed, it's under 1% of our cases, but that's because most people hire Mandiant when they've had a significant breach that's beyond the scale and scope of the team that they have internally, and it's usually not an insider. If you've been hacked and you know it, for the most part, I've seen insider detection be somebody putting something in a duffel bag, somebody being able to afford things that they shouldn't be able to afford, and really it's just the intuition of co-workers that usually is the notification for that. 27% of the time when we responded to breaches, there was more than one group in there, and that does matter. I remember early in my career when we responded to breaches, I always was wondering why people asked who did it, even though we were trying to figure it out. The CEO of the victim company be like, 'Who did this?' And I'd be like, 'I don't know, probably some Russian guy.' But over time, I recognized why it matters is the zone of potential outcomes. When you first know you have a breach, you're trying to figure out how bad could this get, and you can think of worst-case scenario, and you should plan for worst-case scenario. But by knowing the threat groups behind it, we have a good roll-out of how to handle the PR, how much time you have, what sort of defense mechanisms are going to work best. And now we're showing up and we're diagnosing two or more groups pretty frequently. How folks are breaking in. This was unique to me in that 2022 shows a shift change, and what I mean is who was victim zero when we did forensics on the earliest evidence of compromise. How were the threat actors breaking in? And in the United States, 38% of the time when we responded to a breach, victim zero was an exploit, not a zero-day, but an exploit to break in. And the reason that matters is from 1993 to 1998 in my career when I was responding to breaches, it was always an exploit or just valid credentials and someone getting in. But it was 93 to 98 publicly available exploit Unix-based intrusions. 98 to 2002, we saw a shift change, more Windows servers getting popped, publicly available exploits, but phishing started and client-side based attack started for me right around 1998, 1999. By 2002, victim zero is a spearphish for the cases we're responding to, and that held serve as the number one victim zero. Spearphish is the way people are breaking in all the way to 2019, and then all of a sudden it pops up the exploits again. And my read on that is we got better at spearphishing, meaning defense of spearphishing, that we had email gateways that were stopping it, we had trained our end users, and people went towards vulnerabilities. 2020, might as well get right into zero-days then, because if you see 38% victim zero exploitation, by the way, it's still spearphishing in Europe, and then in Asia, in the several hundred intrusions we responded to in the Asia region, Asia Pacific, it was credentials from a prior compromise. I'm not sure why we have that as a category because that means there is a victim zero somewhere else on the network that we just never found. It just means the dwell time's a little longer, but valid credentials were the number one way we found victim zero in the Asia Pacific region. First time we had all three regions different victim zero. But let's go to some of the trends we've seen then. So now we're seeing exploitation as the number one way folks are breaking in. When we looked at zero-days since 1998 to about 2015, the average number of zero-days exploited in the wild was less than a dozen. It wasn't that frequent, and almost no zero-days were in the hands of the criminal element during that time frame of 98 to 2015, and virtually none were spray and pray other than things like, for those of you that have been doing this for a long time, the Nimda worm or Code Red and the directory traversal stuff from 1998 and 2000 and 2002. Those things were spray and pray attractive nuisances in many of the instances where they were executed. So not a lot of exploitation of zero-days till we get to 2019. We have a shattering year, 32 zero-days exploited in the wild. And the way we figured this out is we either found them because there was a time where Mandiant found more zero-days that we found them first, we found them second to whoever exploited it first, but we found more than any other company on the planet for about a decade. But that means we were just responding to zero-days where the vulnerability research was done in Russia, done in China, done in Iran, done in North Korea. That's where the zero-days emanated from. Right around 2016, we see the criminal element get them. 2019, we see 32 zero-days exploited in the wild, shattering the prior record by over 2x. Period. That's huge. And then we're like, wow, that'll never be beaten again. And in 2020, there was only 30 zero-days exploited in the wild, so it wasn't beaten. But then we had 81 zero-days in 2021, marquee year, and that blows away any prior year. What does that mean if you're sitting in this room? That means innovation is happening, meaning real vulnerability research is being done by the criminal element, and for those organizations that do cyber espionage, the nations are doing it. And then in this year, meaning 2022, we had 55 zero-days. So we're operating now totally different barometer of zero-days exploited in the wild, never before. We did go with our zero-days went to Project Zero at Google because Google bought our company about a year ago. I think it was six months ago. Feels like a year ago. And because we're working so hard, and basically when we look at what Project Zero does, they're actively trying to find zero-days in widely adopted technologies, and that makes sense to do that. And then they also have the Threat Analysis Group that had zero-days, and we had different numbers. But the way we did ours is we either saw it and responded to it and said, yeah, oh yeah, we can confirm that Fortinet zero-day, that's real, or that SonicWall zero-day, that's real, the Sophos zero-day that we saw, or the Citrix zero-day that we saw, or we have to trust a vendor that announces, hey, we're patching this vulnerability because it's been used in the wild, which I think is a valid... You can trust a vendor when they say, hey, we saw it in the wild, that they did see it in the wild because there's no advantage to admitting that. So going through all groups, those 55, what I noticed on those zero-days is first and foremost, China was the leading nation innovating zero-days by far. They win. Second, we saw 18 against Microsoft products, 10 against Google products, 9 against Apple. It's always those three every year. They're going to lead the way because they're pervasive and everywhere. Fine. But then we had tucked away in the corner a whole bunch that were done on network devices. There was two for SonicWall, there was two for Fortinet in the FortiOS, there's one for Sophos, I believe. There was two for Trend Micro security company. There was... I'm forgetting them. So I look at Elvis, how many others were there? Steve, have you memorized them? But the bottom line is, where did they come from? They were mostly, the exploits were developed and weaponized in China. And what's interesting is by attacking this infrastructure of network devices, you're avoiding EDR on offense. So it's a smart move. If you can break into a company by doing a zero-day on their firewall infrastructure, you can probably maintain persistent access to that organization for a long time. To wrap up the zero-days, we could do other findings, but what that really means is the blocking and tackling of patch management, attack surface management, vulnerability management still matters quite a bit. If you're in the defense industrial base, you are still seeing the best apex attackers in cyberspace, in my opinion. And then I think it actually comes down to notch after that for a lot of the other types of breaches that we're seeing. So the defense industrial base and certain government organizations still see the apex attacks, the top 1%. So I wanted to share with you, I get to read our forensic reports and can't possibly... 1,163 forensic reports. So I send an email about every quarter, send me the investigative reports of the neatest cases we've worked, and I'll read those. And so I read a whole bunch this year, but one case that I read blew away the others for sophistication. And we didn't have it as a finding necessarily in our M-Trends report from last week. So I wanted to share that case with you. It's perpetrated from a group out of China. It's a cyber espionage group out of China. We can't tell exactly what building they're in, but the way we first detected them breaking into a defense industrial base company is approximately 16 firewalls rebooted one day at a company. And I can tell you this, if you ever have your network architecture reboot, either there was a tsunami, a power outage of some kind, or something bad happened when all of these machines rebooted. 16 firewalls rebooted. There's a checksum error with certain files that were on the operating system. That's called bad. The problem is that the file that had a checksum mismatch was inaccessible to customers of Fortinet because there was a Fortinet firewall that got shut down. So what do you have to do as a customer when you know there's a checksum mismatch on the file? You can't access it to review it. You box the appliances up and ship them out to the company, and you sit around for six weeks wondering if they're looking at the darn things. All right, but basically that was incident detection for a Fortinet zero-day on the firewalls. When we responded and we're looking into it, we see that the Fortinet firewalls, the only systems they're accessing are the VMware ESXi hypervisors. That's interesting. Nothing else. No Windows machines in between. Straight from firewall to the hypervisor. But we don't see secure shell happening. So we're actually like, so how did they gain access to this thing? We're still doing the forensics to sort that out. But what we saw when looking at the hypervisor is a malware framework developed by somebody that allowed the holy grail of when you compromise a virtual server like this, they had a malware framework that could write from the hypervisor to the guest image, from guest image to guest image, and from guest image to hypervisor. It's the perfect tool for hacking virtualized environments and stealing data. And that's what this breach is all about. When responding to this breach, how do you collect evidence? We can't access the files that are the backdoors on the firewalls, and we had to reverse, and it took months to reverse the malware framework that's sitting on the hypervisor. But to me, that breach cost more than maybe even doing the SolarWinds implant because you had to develop a malware framework that takes significant advantage of proprietary features of VMware. You had to develop zero days for Fortinet that did the same thing, understood the FortiOS, which is really a Unix/Linux derivative, but you had to know how it worked, where to put your code, and how to do things, and shows quite a bit of R&D reserved for defense industrial base. So they were the apex attacker, and that gets you to think. And by now, if you're out there, you're like, what would I do if somebody hacked my firewalls with a zero day and then got to my hypervisor with code that doesn't trigger any AV? Nobody runs AV on Linux machines anyway. And then the way they were accessing the guest images triggered none of the capabilities on that host to flag it as evil. It did flag the activity, so we see a lot of the commands run and the processes spawned, and primarily is the makecab command, make cabinet files to compress and exfiltrate data. So when you think about that, for those folks that are worried about that top 1% of cyber espionage, if you're working at Raytheon, Boeing, Lockheed Martin, you are going to see those apex attackers that want to access certain programs, and you're fair game for espionage. So they're going to go into a building somewhere in China and try to hack you. You have to get great at what I call that stage two intrusion detection. So I'm going to go into the number one ways to detect the apex attacker after they circumvent safeguards, because there is no patch for a zero day, by the way, that's going to work against your infrastructure. And what you're hoping to do next is detect a stage two. First and foremost, I went to our team, and we are always attacked. Everybody seems like every ransomware hacker wants to break into Mandiant, and some nation states have. We had the SVR break into us in 2020, the foreign intelligence service from Russia, and I consider them an apex attacker. Very frustrating to deal with them. So we got used to stage two detection. I'd recommend for all of you, the number one way to get big bang for the buck for stage two detection is great identity security. If you're Active Directory, damn it, have something that can learn what's normal, your authentication processes, and determine anomalies for that. Do great identity security because anybody who pops you with a zero day, the next thing you're going to do is get credentials, period. And you want to detect that lateral movement. The second thing, and this was hard for us to do when we developed custom scripts to do it, so I'm going to try to create a real nerdy 10-minute class on, so how do you monitor PowerShell? 32% of every intrusion we responded to, there were scripts being uploaded by the attacker using valid credentials and PowerShell. So to be able to detect rogue PowerShell scripts is critical. You have to turn on module logging. You have to inspect the scripts being done. That'll be a stage two detection as well. And I think if you do those two things, I'd give you a third. If you multi-factor off everything, man, that's annoying for anyone who does red teaming. It's really annoying to deal with multi-factor. It's probably the biggest bang for the buck to figure out how to put some speed bumps in the way of the attackers. And then I can tell you this, there's no easy way to know if you multi-factor off to everything. A lot of companies were off for assessments. You just have to do the work and verify that things are multi-factored. I've lived through redoing an identity architecture after a breach, and the one thing I did learn is, quite frankly, manual testing of your identity architecture absolutely matters. I think CISOs believe what they say, but you have to verify that. So those are probably the three things that you can do to create the most impact for those apex attackers. During the year, I ran into a lot of CISOs. I was going to share with you probably the top three things. It was hard to come up with, and I think at RSA I had 16 different things I talked to CISOs about during the year, and that's way too many for today. And you could do a whole presentation on it going around and looking at what we talked about with them. No matter what, you have to talk threats with CISOs. They want to know what's up with Taiwan. What do you think's going to happen there? Ukraine. What are we seeing from Russia and Ukraine? What are the emerging threats that you're worried about? And I can tell you this, there's a time in our careers where we cared about network security, endpoint security, then identity security, then everybody raised to the cloud, and we had to care about the control plane and how we're provisioning, accessing in the cloud, and we had to get visibility there. Now we have to care about software security, supply chain security, and API security. Those things kept bubbling up to the top, and those are actually hard things to take care of. They really are. And so some of the steps you might want to take if you are an organization that does custom development and see how many APIs you have available and reachable on the internet. And then, of course, you need to know your software dependencies. If you make software, we are customers of both Snyk and Legit Security. We look at all our software from both a static inspection of it as well as dynamic inspection of it. We do source code review of it. We have red teams look at it, and you do all that, but it's real complicated because all of us make software now. It depends on another company that makes software that depends on another company to make software. So these are the things that, that was one that came up, and those are the threats. In regards to Ukraine, I can just cut through it very quickly. We are doing 24x7 monitoring for over 30 organizations in Ukraine. We were there since 2010, and Mandiant's always been in Ukraine because we want to be where the hot zones are. We're in South Korea to see North Korea because it's the immediate threat. We were in Kyiv so that we could see the Russian threat with the gloves off. We're in IDF. We want to watch in the Middle East. We're in the United States to see the best cyber espionage out of China and probably Russia. And we did not see anything new and novel there. And I hate saying that because the last time I was speaking, there was the person responding to the breaches in Ukraine from the Ukrainian army right next to me. And I was like, we didn't see anything new and novel. And I got 30 looks, and he was bigger than I was. But the reality is, I remember we were thinking, hey, this is a war. When you do war planning, you always have two to three zero days on your shelf, and you're thinking, is now the time to use them, bring them out, and do something that meets an objective? We just didn't see it. China was the number one innovator in 2022 on offense. What we did see is what I call a lot of blunt force trauma attacks, destroy every machine in Ukraine you can based on the reach of the credentials you can compromise. So it's ongoing and every day. But another lesson learned is you can be resilient if you just brace for it every single day. And we'll see if determination wanes, but that's the fastest threat brief you can get on Ukraine. CISOs want to retain, recruit, train, and change culture at their organizations. And one of the biggest bangs for the buck that we've always seen, and I get to meet a lot of CISOs when they're doing their 90 days, first 90 days, I need to assess what I've got, how good are we, and what do I need to do for the program. Big believer in purple teams to do all of it because if a purple team works against your organization, it'll be a cultural change if they're successful. By the way, if a purple team's successful and your company doesn't care, probably not a great place to do cybersecurity. That's the reality because that's got to move the needle as long as the purple team does something realistic and you can expect to see it at some point in time. But it trains, it keeps people from steady state operations. They get an exercise or they get to actually do what they want to do in regards to respond and detect things. And these purple teams can take under four hours if you want to make it all under a certain clock time frame. Helps you recruit, helps you train, helps you change culture. Other things that came up: cyber insurance, quantum computing still comes up. I mean, I could talk about that, but it's not here yet. And realize this: quantum is mostly about encryption and decryption. You got to lose all your data first before someone's going to decrypt it. And in almost every case we're ever responding to, if the data is encrypted, the attackers aren't accessing your data and stealing your ciphertext. They're actually accessing your data the same way you do with valid credentials, so that everything's in plain text. So it's, we got a long way to go. Secure identity to secure your data, quite frankly. Zero trust journey is a big one, and I point everybody to the CISA document that was published within the last year because everybody had a different definition on zero trust. And by the way, it's just a new term for things we've said in security our whole careers, like least privilege. But they broke it down into six different categories, and I've steered everybody to this maturity model that CISA has for zero trust so that people can do that. AI comes up, and I think that was the theme of RSA. There's a lot of companies. Microsoft's talking about AI. Google's talking about AI. We are at the first inning on how this is going to impact both productivity. Just go to the beach all day so that your AI can email your boss that you're working hard. We're not there yet, but someday. But in regards to security, it will be a shift change for security. I do think going to be able to automate things that were complex, like identity security. What's the J Smith account being used by John Smith versus J Smith account being used by somebody else at the company can be something that you can learn and instantiate over time. But it's the first inning of that, and you're going to see every company try to put guardrails on it and try to release it. The analogy I've used to describe what I've seen in AI, I hate using this example, but I started it, so I'm going to do it anyway. I have a Tesla, shame on me, but I have a Tesla, and I remember the day it updated the self-drive, and I was on the 280 in California, and I didn't believe it could do it, so I just gripped the wheel the whole way home. And the very next day, I think I was doing email while it drove me. It was amazing how fast I'd learned to trust the capabilities. I think the same thing is going to happen with AI. We're going to use it. We're going to be like, this is really weird. It doesn't work all the time. And fast forward a certain amount of time, maybe a year, maybe two years, our trust for it for certain tasks will be exceptionally high, and maybe even higher than the humans that used to do those tasks. But it's coming, period. It really is. And in many ways, it's a good thing. But in regards to security, there are certain problems it's uniquely capable of solving, I think better than humans are, and we'll flesh those out. Cloud security pops up. Deep fakes pop up. Nobody likes to be lied to. There's a lot of companies trying to figure out, can we tell something real from something fake? We'll keep working at supply chain. I already talked about. I would say a big change between 21 and 22 is 2021, everybody cared about ransomware and ransomware assessments. I felt like that was the challenge in 2021. And 2022, it seems like that most people already did that. The one thing that's been left out of ransomware assessments, meaning how big is your blast zone should somebody break in and run ransomware? What credentials do you have that are shared and network admin and can be pervasive if some ransomware actor use those credentials? The one thing I haven't seen too many companies do is actually practice red lever events. Can we actually operate our business if the Miami office went down? Or in reality, it's almost like a disaster recovery type of exercise because ransomware has the same impact on your network as a hurricane might. Quite, it just renders the geography usually unusable. So most people don't do the red lever events of can we come off the internet if we need to? Can we operate off the internet if we need to? Can we operate our business without certain things? And I can keep going today. I have no idea how much time I have left because I never saw the clock. Four minutes. Nice. And I just happen to have a four-minute topic. And am I supposed to take questions? Do I? No. Yes. No. There's mics in here, so let's do that because I was going to wrap. I'll give you one last thing. Every single board that we're talking to, bar no exception, is doing tabletop exercises. What I'd recommend if you've done them or if you need to do one, I do like the idea of maybe one a year for a while. They can be even just an hour long. Pick the exact scenario you really don't want to deal with and make it simulate. It becomes a reality. You get the biggest bang for the buck on how who gets involved from the board, what the board wants to know, how much they even understand, and then even internally as operating management, you start seeing who the real players are going to be when you simulate the rest. Right. So that's what I'm seeing companies do. They really are picking scenarios like we lost client data, we the assembly line shut down, whatever it is, and it creates the most value for you. So I'll leave you with that. And if there's any questions, we've got three minutes. So turn on the mic. Yeah, I can repeat it if the... If I... He said thank you for the talk. Yes, so my question is regarding the quantum security, quantum computer threat that is coming in. In terms of the quantum threat, the view of the industry has been that nation states are collecting the data today that can be encrypted data, that can be sensitive data, whatever. And then the general consensus also is if the quantum computer does get developed, it may or may not be public domain at least in the first time. So if the data is being collected and we will never know if the first quantum computer comes in, how do we view the state of the security in that kind of a scenario? I just got to live in a nation where you trust the government. No, the bottom line is it's a great question because I do think first off in the United States, quantum is not going to be of the sole purview of a government. You can tell already Google's working on it. Other organizations are working on it in other nations. What I've seen, which is interesting, that goes in line with that, is every modern nation over time in the cyber domain thinks offense, thinks about exploit development, thinks about how to operate in the cyber domain. There are nations that learn that to monitor their own citizens. And so I think quantum computing will be used by some governments to monitor their own citizens, by other governments for national security reasons, but it's also going to be used by the private sector clearly because of the processing compute being just exponentially so far greater than today. You combine the processing needs of AI with quantum computing. Every remark I have after this is almost vicious. At some point, computer security and cybersecurity is going to be like defending us from the robots before they take over. But we're not there yet. So I don't have a fair answer for you yet. But I do know the quantum's probably 2030. That's when I think you're going to see real quantum computing in small places, and then maybe it's ubiquitous by 2035. Perfect. Thank you. I'm getting yanked. One more question. Yes, one more. Sorry. Yeah. Oh, I don't know. Can you guys hear me? It's a little high. Thank you. Thank you so much for being here. Somebody that's an innovation person in cybersecurity and your incredible career, what are you think are going to be the big problems that if somebody solves it's going to help a lot in cybersecurity and the technologies and or where will you invest? Where do you see that you will get very excited about if you saw somebody doing something? Too long an answer probably. I'll catch you offline. The bottom line is there's going to be AI is going to be a big thing. What you're going to see is unique and specialized companies that have the data to train models and to train AI, and those unique companies will have tremendous value in the future. And then I'll just leave you with this thought in cybersecurity: any, it's not going to exist anytime soon. It's beyond one company. Its attribution matters until there's risk and repercussions to offense. The number one thing I always say in the cyber domain is we need to know who did it, period, so that we can hold nations accountable for the things we're seeing out there. Not the question you asked, but if somebody made the who-done-it technology, I'd buy that. So thank you very much for your time.
