S1, E4: Identity Matters w/ Dmitri Alperovitch, Co-Founder + Chairman, Silverado Policy Accelerator

Well, I coined this phrase almost 15 years ago now that we don't have a cyber problem, we have a China, Russia, Iran, North Korea problem. And it's not that all the attacks we're seeing are coming from those countries, but the majority are not just from the nation states themselves but also from the criminal groups and the ecosystems that have been developed in those countries. Because the reality is those are the countries that are our adversaries that wish to do us harm, or at a minimum, as a low bar, don't necessarily want to help us. So when there are criminal groups operating in those countries, unlike in other places, criminals exist everywhere in America, in the UK, Europe, etc., they typically get found, they typically get prosecuted. That does not happen in those countries. So you have so much badness that's coming out of those places unfortunately, ranging from espionage. You have a number of those countries, obviously China leading, that are really stealing everything that's not bolted down, from trade secrets, from intellectual property, and not just stealing it but giving it to their competitors, to your competitors I should say, to their domestic industries. They're now becoming behemoths and dominating markets like electric vehicles and batteries and all sorts of technologies. In Russia in particular, you have this criminal ecosystem that's been developed over two dozen years where threats like ransomware and extortion attacks are just going through the roof. So now as a company, you not only have to worry about your data being stolen, you have to worry about business continuity, disaster recovery from lockup of your data, from locking up of your systems, from wiper malware destroying you. So the threats are just getting more and more dire and sophisticated.

Well, the reality is that everyone's on the front line of this fight, and geopolitical events are affecting everyone. Just one example: when the Russians invaded Ukraine in February of 2022, the very first attack was not actually a kinetic attack against Ukraine, was not tanks rolling across the border or missiles striking Ukrainian military installations. It was a cyber attack against an American company, Viasat, that was providing satellite terminals to Ukrainians, and the Russians wanted to destroy them, to brick them, so that they could disable Ukrainian communications. And as a result, not only did they brick the terminals in Ukraine, there was actually collateral damage affecting lots of other customers of Viasat and the company itself. So these are the types of things that I think most people don't appreciate: that even if you're safely here thinking that this conflict halfway around the world doesn't affect you, it is. And the reality is that, as I'm sure your listeners know, everyone has limited resources, limited budgets, limited number of people, and it's about how do we make do with what we've got in a most efficient manner, because the number of actors is exploding. And this is where automation systems like AI are absolutely essential to help you get the most bang for your buck out of your investments.

Absolutely. And you know, cyber is such an interesting study. It's a science, like others, but like many others, you're dealing with a human opponent, a sentient human being. You can think of other sciences like medical science or space where someone goes in and has an ambition to solve a particular disease, Alzheimer's or type of cancer, and hopefully one day in our lifetime they may do that. I'm rooting for the Alzheimer's thing because I'm getting to the point that's looming. But you're seeing progress being made, and one day you can imagine where this disease is solved and the person whoever solves it is retiring sipping piña coladas. Unfortunately, for our industry in cyber security, that is never going to happen. We're never going to be done because as long as there are bad people out there that wish to do us harm, that wish to make money and so forth, we're going to be dealing with this issue. And any technology that gets invented, either on the defensive side or offensive side, just contributes to this cat and mouse game. And unfortunately, AI is one of those. It is going to be absolutely revolutionary, I believe, to the defensive sector, being able to aggregate so much data, process it, being able to empower people that are on the front lines defending their networks to be much more efficient, much smarter at their jobs. Absolutely going to be critical. But on the other hand, of course, that same technology is going to be incredibly helpful in making the adversaries more productive, and in particular in areas of social engineering and stealing of identity systems. As you well know, you're going to have attacks that you're already starting to see using generative AI technologies to craft really good social engineering emails, using deepfakes to do really good voice and even video impersonations of people to try to steal their identities, to use those identities to accomplish their objectives within the network.

That's absolutely right. And you know, this is already happening. There are companies out there that focus on these phishing exercises. I don't even know why we're doing this anymore because everyone is going to fall for it. And the spidey sense that you might have from a misspelling or something doesn't look right, that's gone. These things are so realistic and they're leveraging the background that they have on you to make sure it's as targeted as possible. Obviously this has been used for ad targeting and it's been used for sales as well, but particularly by the bad guys, this is creating a huge problem. And you know, I serve on something called the Cyber Safety Review Board, which is a US government created board, created by President Biden's executive order, that's sort of modeled on the NTSB, National Transportation Safety Board, where we review major incidents in cyberspace. And one of the reviews we've done was on this group called Lapsus$, which is a really interesting case study that we wanted to look at because unlike other criminal groups, these were teenagers. And by the way, unlike what I just said about the four major threat actors that we face out there, this is the exception to that rule because most of these teenagers are in Western countries, in America and UK and Brazil, etc. And they're being recruited because they're teenagers, because they can basically hack the legal system as juveniles. They get arrested, they are out the next day back to their criminal activities. And we wanted to look at it because this group and others that affiliate with it has been incredibly successful in compromising pretty much every major company out there. All the big technology companies are spending hundreds of millions, sometimes billions of dollars on security. These guys are compromising them with no technical skills. They're not creating advanced zero days, they're not creating malware. What they're doing is social engineering, and often over the phone. They'll call up this company, they will say, 'I'm an employee, I've lost my password, can you please reset it?' And then they bypass two-factor authentication typically because of SIM swapping, where they'll clone a phone number by working with traditional organized crime groups like MS-13 gangs that will threaten or bribe people inside telcos to clone your phone number. And once they have that identity, they can VPN in, they can access the resources. And if people are not tracking how those identities are used within the enterprise, you can have source code stolen, you have crown jewels stolen, all without any technical skills whatsoever. And we wanted to look at that because we said if teenagers can do this with no technical skills against every major company we have in the United States, boy, we have an issue when the major threat actors, nation states and others, figure this out. Now traditionally, they've been limited because the use of English may not have been as good by the North Koreans or whomever, and being able to call someone up without an accent triggering some concerns has always been a limiting factor. Well, AI changes all that. They don't have to be a perfect English speaker to do this at scale. And this is, I think, the tsunami that's coming.

I think there are two elements to this. First of all, traditionally we thought about breaches as someone gets in, someone steals your identity, let's say, and it's sort of game over. Well, it shouldn't be thought of that way because that's actually only step one for an adversary and probably the easiest step that they can take, because you can always with a well-crafted phishing email or good phone call social engineering, you're almost guaranteed to succeed. But just because you have someone's identity as an example doesn't mean that you've actually accomplished anything, because you still need to use that identity to get to the resources you need, to steal data, to destroy data, whatever your objective may be as an attacker. And that's actually where the hard stuff is, because that identity may not have enough privileges for you to get what you need. You may have stolen it from a low-level employee and you want the CIO-level privileges. So you have to figure that out. It's going to take time, it's going to take effort. And if the defenders are watching for the use of those identities, for the use of those assets, and they're fast enough to respond and kick you out, then they don't succeed. It does not actually happen until something bad occurs. And that speed of action is so essential. And so many of our resources are kind of spent on that first line of defense of how do I stop this from happening in the first place, which you should do and you should try to stop as much as possible, but know that something is going to get in. And have resiliency in your processes, in your systems, in your technologies to identify when bad things are occurring and stop it before it gets to be a real problem, such as your data taken. And the second piece of this is the destructive attacks that are becoming more and more prevalent, both with ransomware and with nation state driven destructive attacks. And that's about how do you rebuild quickly. And that's one of the things that I think we can learn a lot from the Ukrainians. I spent a lot of time with them over the last couple years, going to Kyiv, talking to them about all aspects of the conflict including cyber. And what's interesting is that because they've been targeted so much by the Russians going back to 2014, they have incredible processes. They don't always succeed in defense, sometimes networks get destroyed, but they can rebuild that network literally within hours. It is incredible because they've got the images ready to go, sometimes new systems to roll in, networks being rebuilt, they've got the backups offline so they can't be impacted. And I think we can learn a lot from that, and we need to practice that because boy, if this is the first time you're thinking about how to recover from a destructive attack like this, it's going to take you a long time.