Latest / Cybersecurity Perspectives / S1:E13 - Amazon disclosed thwarting more than 1,800 North Korean remote worker infiltration attempts in 2025, identified in part through a distinctive 110 millisecond keystroke input lag.

Transcript

S1:E13 - Amazon disclosed thwarting more than 1,800 North Korean remote worker infiltration attempts in 2025, identified in part through a distinctive 110 millisecond keystroke input lag. · Cybersecurity Perspectives

• 0:00
  SPEAKER_01: Cybersecurity moves fast.
• 0:02
  SPEAKER_01: Working in a space measured in minutes and seconds means we can't expect to keep pace by doing the same thing over and over.
• 0:08
  SPEAKER_01: The sharing of perspective across technologists, defenders, business, and professionals is key to unleashing internal capability.
• 0:16
  SPEAKER_01: Perspective comes from sharing experiences and ideas.
• 0:20
  SPEAKER_02: Welcome to Cybersecurity Perspectives.
• 0:24
  SPEAKER_02: Ladies and gentlemen, this is your co-host speaking, and we'd like to welcome and thank you for joining us on today's flight through cybersecurity perspectives.
• 0:32
  SPEAKER_02: Let's see, today's flight should take us through some cyber industry statistics.
• 0:36
  SPEAKER_02: It's looking to be a smooth one.
• 0:37
  SPEAKER_02: Final destination today is personal perspective, and uh we're looking at an expected flight time of I see 30 to 35 minutes.
• 0:44
  SPEAKER_02: Today's flight should be mostly clear with some possibilities of aha moments and uh maybe even an oh shit along the way.
• 0:50
  SPEAKER_02: So remember to stay buckled up.
• 0:52
  SPEAKER_02: Outside of that, sit back, relax, and thank you for joining us on cybersecurity perspectives.
• 0:56
  SPEAKER_02: I'm gonna hand it over to my co-host, Owen Vizidlo, for cross checks.
• 0:59
  SPEAKER_01: Owen?
• 0:59
  unknown: Sure.
• 1:00
  SPEAKER_01: Oh, nice.
• 1:00
  SPEAKER_01: Yeah, so the the flight attendant, right?
• 1:02
  SPEAKER_01: Um coming in here to land us, hopefully successfully.
• 1:05
  SPEAKER_01: No, I'm just kidding.
• 1:06
  SPEAKER_01: Uh that was actually good.
• 1:07
  SPEAKER_01: The flight attendant.
• 1:09
  SPEAKER_02: What are you talking about, flight attendant?
• 1:11
  SPEAKER_02: You're the co-pilot.
• 1:13
  SPEAKER_02: How do you even research this, dude?
• 1:15
  SPEAKER_02: Like that's right.
• 1:16
  SPEAKER_01: That's right.
• 1:16
  SPEAKER_01: Oh, I mean you only do one pilot.
• 1:18
  SPEAKER_01: That's right, but large organization here.
• 1:20
  SPEAKER_01: Um no, so that was a great introduction.
• 1:22
  SPEAKER_01: I think that that might be the good one to keep.
• 1:25
  SPEAKER_02: I don't know.
• 1:26
  SPEAKER_02: I I don't know if I could be if I could do like pilot flight intro every week.
• 1:30
  SPEAKER_02: That might be a bit much.
• 1:33
  SPEAKER_01: That's awesome.
• 1:34
  SPEAKER_01: The one thing though that I wanted to bring up um for the me this week was the uh recent um lawsuit with Meta for the 24 billion on privacy.
• 1:42
  SPEAKER_01: I always find privacy super interesting nowadays, right?
• 1:46
  SPEAKER_01: Like, is it really even a concern anymore?
• 1:49
  SPEAKER_01: Or like where does the end user or the consumer really, really care about it?
• 1:52
  SPEAKER_01: Right?
• 1:52
  SPEAKER_01: Has anyone stopped using Meta?
• 1:54
  SPEAKER_01: Um, and and then again, right?
• 1:56
  SPEAKER_01: Is that really a deterrent to people like Meta to hopefully take privacy a little more seriously?
• 2:01
  SPEAKER_01: But it kind of got me going, kind of got me away from like the technical aspects of of kind of cybersecurity, but more or less kind of these ethical moral principles, right, that we look at.
• 2:09
  SPEAKER_01: But just wanted to bring it to the group, see if it kind of sparked anything from you guys.
• 2:13
  SPEAKER_02: Dude, we're definitely gonna talk about this because it's something I think it's like 12% of their like annual revenue.
• 2:19
  SPEAKER_02: Like that's their fine.
• 2:20
  SPEAKER_02: Like it's some ridiculous amount of information, like some ridiculous fine.
• 2:24
  SPEAKER_02: Um, but I'll tell you what, before we get into it, let's introduce our guest because we have an awesome guest today.
• 2:31
  SPEAKER_02: I am pretty psyched.
• 2:33
  SPEAKER_02: If I'm in fact, if I'm being honest, if this talus thing doesn't work out, I'm gonna hit this guy up for a job, not only because of what he does, but where he works.
• 2:39
  SPEAKER_02: I'm really psyched about this one.
• 2:41
  SPEAKER_02: But this person started with a love for finance.
• 2:44
  SPEAKER_02: He had no intention of getting into technology, no intention of getting into cybersecurity.
• 2:48
  SPEAKER_02: He actually started in risk management in the banking sector and then got sucked into technology consulting through Deloitte, where he quickly transitioned his focus onto cybersecurity consulting.
• 2:57
  SPEAKER_02: He then made his way through a startup as a CISO, and he's joining us today as the CIO for a university in San Juan, Puerto Rico, known as Sagrado.
• 3:05
  SPEAKER_02: Welcome, Raul Rosado.
• 3:07
  SPEAKER_02: Ro, welcome to the show.
• 3:08
  SPEAKER_02: Thank you.
• 3:09
  SPEAKER_02: Thank you for having me.
• 3:10
  SPEAKER_02: Yeah, of course.
• 3:11
  SPEAKER_02: Well, listen, I mean, I I don't think I did your your career and your stature enough justice with the introduction.
• 3:16
  SPEAKER_02: Tell us a little bit about yourself and a little bit about your story.
• 3:19
  SPEAKER_00: No, definitely.
• 3:20
  SPEAKER_00: Like you said, uh, I started in the banking sector.
• 3:23
  SPEAKER_00: Um, I I at first I didn't want to get into the finest part, but yeah, I started going to, you know, the risk management, then looking at data, building data warehouses, and then it went from there.
• 3:35
  SPEAKER_00: I got sucked into, you know, the from data warehouses into ERP implementations.
• 3:41
  SPEAKER_00: Uh then we started even doing Ground Stripe implementations and all that kind of stuff, and even building a SOC at the banking sector.
• 3:49
  SPEAKER_00: And then after that, yeah, it it was natural for me to just go into cybersecurity as well.
• 3:55
  SPEAKER_02: Yeah.
• 3:55
  SPEAKER_02: You're dating yourself with CrowdTreck implementations, right?
• 3:58
  SPEAKER_02: That that must have been back in the day, early in your career.
• 4:00
  SPEAKER_00: Yeah, it was uh it was when back when ChatGPT wasn't even in even in the radar, the thing that everybody wanted to implement, and they weren't even talking about AI.
• 4:11
  SPEAKER_00: They were just saying, oh, it's behavioral analysis and all that kind of stuff.
• 4:15
  SPEAKER_00: And that's that was the the the the when they when they were the new kids in bar.
• 4:20
  SPEAKER_02: Right, right.
• 4:21
  SPEAKER_02: Yeah, totally makes sense.
• 4:23
  SPEAKER_02: So I mean, look, Owen, you brought up an incredibly interesting topic, and I agree, right?
• 4:27
  SPEAKER_02: I've ranted a bunch of times about privacy, but like it looks like people are finally advocating for for people's privacy, even if the people aren't advocating for it themselves, right?
• 4:38
  SPEAKER_01: Yeah, I mean that's that's how I see it.
• 4:40
  SPEAKER_01: Um, it it is always refreshing to see that again, there is some form of, I don't want to call it oversight, but uh the at least the ability to step up to um you know the organizations like Meta.
• 4:52
  SPEAKER_01: Um, while whether it does actually do much, not necessarily sure.
• 4:55
  SPEAKER_01: And again, appeals will keep going, but um, to your point, at least there are some forms of anchors of what I would say, right, those moral and ethical principles that I think are just becoming even more important um as we kind of dive into this, you know, AI world that we kind of are are working towards.
• 5:10
  SPEAKER_02: I know it.
• 5:11
  SPEAKER_02: I know it.
• 5:11
  SPEAKER_02: Rule, what's your take on this, man?
• 5:13
  SPEAKER_02: Like if if you know if you were back in your startup scenario and you had got hit with a fine, a regulatory fine for 12% of your revenue, like what would that mean for you?
• 5:23
  SPEAKER_00: Yeah, no, definitely.
• 5:25
  SPEAKER_00: That would be a big hit.
• 5:26
  SPEAKER_00: Uh the thing is that obviously this is part of also not just privacy, it's just ethical practices, because you have been seeing meta being hit a lot about this.
• 5:37
  SPEAKER_00: Uh if I were in a in a startup, obviously there would be a lot of reflex happening there.
• 5:42
  SPEAKER_00: And uh it's a risk-reward kind of thing.
• 5:44
  SPEAKER_00: Uh, because at the end of the day, they're doing it because obviously they they they got revenue from practices that they're doing.
• 5:51
  SPEAKER_00: But the ethical part is very important here because um meta has been hit not just with this one, uh, for following the the years before they got hit by a couple more.
• 6:02
  SPEAKER_00: And this all narrows down to a thing that it's happening a lot uh with not just meta, a lot of companies there that they're doing a lot of research with user data.
• 6:15
  SPEAKER_00: And this is where obviously in the universities they call it RVs.
• 6:19
  SPEAKER_00: Sometimes um companies still do have to, but they're not required to.
• 6:24
  SPEAKER_00: So that is uh the the kind of thing where when I say RV, it's the institutional reviewing board, and those bodies uh exist because they need to review if people are being treated well, uh if their data is being uh respected, and you know, uh subjects are are are are are being there, and studies are being there, uh data is being processed, and uh companies are not following it, obviously, because they're not required to, but that's the main question that is happening now.
• 6:59
  SPEAKER_00: Uh, and it's something that universities even bring it up to their students.
• 7:03
  SPEAKER_00: Should META and other this other companies have this kind of oversight that universities have over research or not?
• 7:10
  SPEAKER_00: And that's one of the big things that that that is the uh you know gonna be the key discussion points when we're discussing about research and you know hand handling data of individuals.
• 7:22
  SPEAKER_02: That's a super interesting perspective.
• 7:24
  SPEAKER_02: And also thank you for clarifying the IRB, because I had no idea what that was.
• 7:28
  SPEAKER_02: And I was totally gonna fake it.
• 7:30
  SPEAKER_02: I was gonna be like, oh yeah, IRB, yeah, 100%.
• 7:32
  SPEAKER_02: But no, like like the the interesting thing is like if for universities, like I like that makes a ton of sense, right?
• 7:40
  SPEAKER_02: Like if I'm thinking through this live with you, having an institutional review board to talk about the ethical application of data and the research and like that makes sense, but that's also because the mission of university is altruistic.
• 7:50
  SPEAKER_02: There's a reason for them to act ethically.
• 7:53
  SPEAKER_02: I don't know how an organization would be able to do that, right?
• 7:57
  SPEAKER_02: Like if Meta instituted their own IRB, I suspect they would check it off every time.
• 8:01
  SPEAKER_02: Yep, good job.
• 8:02
  SPEAKER_02: Absolutely.
• 8:03
  SPEAKER_02: This is great.
• 8:04
  SPEAKER_02: The greater good is perfect, right?
• 8:05
  SPEAKER_02: And then if you think about the other side, do you do an external reviewer that has the IRB?
• 8:10
  SPEAKER_02: But then, of course, there's the concern of things like, oh, well, they're targeting us, or there's backlash, or they're using it as a weapon.
• 8:17
  SPEAKER_02: I don't know.
• 8:17
  SPEAKER_02: It's a super interesting, it's a it's like the idea is the same, but the application is completely different depending on like the industry and the dynamic.
• 8:25
  SPEAKER_00: Actually, and that that is a good point that you're mentioning it, because the thing is that companies don't need to have it, but in the case of Meta, they even have to implement it.
• 8:35
  SPEAKER_00: I don't remember the the date exactly, but that's one of the things that um they they instituted uh um an IRV uh well, some sort of like they call it that universities do.
• 8:46
  SPEAKER_00: Uh, but they they had to implement it uh as a response to um, well, years back when it was just called Facebook, uh, they were doing um an analysis on on the emotions of their users, and they were showing certain videos and and content to those users uh based uh based on their mood and the time of day, and because they wanted to see how they can uh control the responses of the users.
• 9:17
  SPEAKER_00: Uh the thing is that they put it in the disclosure, but nobody agreed those.
• 9:22
  SPEAKER_00: And one of the things that everybody was claiming was like, hey, we were part of a study that we didn't even agree.
• 9:28
  SPEAKER_00: And one of the things there is what was they were just saying, hey, it was it wasn't the user agreement.
• 9:33
  SPEAKER_00: You guys shouldn't be saying anything, but then it came to the to the part of saying, hey, what you were guys were doing was ethical or not.
• 9:41
  SPEAKER_00: Uh it was there was a lot of backlash uh to Facebook.
• 9:45
  SPEAKER_00: And that's when they had to, I believe it was 2016 that they had they had that issue and they had to implement the research ethics board, which basically it's just IRB that they that they have.
• 9:57
  SPEAKER_00: And other companies are looking at this, but the thing is that it's it's mostly ethical because nobody's required it now to to go.
• 10:04
  SPEAKER_02: Right, right.
• 10:06
  SPEAKER_02: Yeah.
• 10:07
  SPEAKER_02: No, I I vividly remember that study where they were they were effectively trying to change like the emotion, the emotions of whole areas.
• 10:14
  SPEAKER_02: Like, could they change the entire like sentiment of an of an area?
• 10:18
  SPEAKER_02: Um, it's crazy, man.
• 10:20
  SPEAKER_02: Like, I don't know.
• 10:21
  SPEAKER_02: You get if you get me down this road of social media and how evil social media is, like, I don't think we're gonna have time to pick a card.
• 10:28
  SPEAKER_02: As far as I'm concerned, social media is the bane of society.
• 10:32
  SPEAKER_02: And I, you know, I try to be neutral on these things, but I'm not gonna be neutral on this one, man.
• 10:36
  SPEAKER_02: Like, if I could wave a wand and get rid of social media, I would get rid of it all today.
• 10:40
  SPEAKER_00: Well, that's the basis of cybersecurity nowadays.
• 10:43
  SPEAKER_00: So social engineering is a big part, and social media plays a big role.
• 10:47
  SPEAKER_02: That's how I know that you were a CISO.
• 10:49
  SPEAKER_02: You can bring it right back to so right back to cybersecurity.
• 10:52
  SPEAKER_02: You got that that executive skill.
• 10:54
  SPEAKER_02: I love it.
• 10:55
  SPEAKER_02: I don't know.
• 10:55
  SPEAKER_02: And what do you think?
• 10:56
  SPEAKER_02: Is it time?
• 10:56
  SPEAKER_02: Is it time to pick?
• 10:57
  SPEAKER_02: Are we at that?
• 10:59
  SPEAKER_01: I think so, right?
• 11:00
  SPEAKER_01: Let's put Raul on the the student side and uh he's got to pick a card now.
• 11:03
  SPEAKER_02: That's it.
• 11:04
  SPEAKER_02: Yeah, you you get multiple choice questions here, Raul.
• 11:06
  SPEAKER_02: So so just a quick reminder of how this works is we have three stacks of cards, A labeled A, B, and C, and those cards have statistics that are pulled from multiple industry reports, you know, at the Google's report, Verizons, we have CrowdStrike in there, uh, we have the World Economic Forum.
• 11:20
  SPEAKER_02: There's a ton of different things that have we've just pulled these statistics from, and we have no idea what you're gonna pick.
• 11:25
  SPEAKER_02: So, whatever you pick, that's our topic for the episode.
• 11:27
  SPEAKER_02: Good, bad, or indifferent.
• 11:28
  SPEAKER_02: So let's say it was gonna be A, card B, or card C?
• 11:32
  SPEAKER_00: So I would pick card B.
• 11:34
  SPEAKER_02: Card B.
• 11:34
  SPEAKER_02: Card B.
• 11:35
  SPEAKER_02: Little the deck.
• 11:36
  SPEAKER_02: We're gonna do our own research and see like where guests pick more often and see if there's a reason for that.
• 11:41
  SPEAKER_01: Oh, definitely B, by the way, giving that away.
• 11:43
  SPEAKER_01: Now we just gotta do all the science behind it.
• 11:45
  SPEAKER_01: Um, all right.
• 11:46
  SPEAKER_01: So the title of this particular stat is Nation State Activity in Geopolitics.
• 11:52
  SPEAKER_01: Okay.
• 11:53
  SPEAKER_01: According to the 2026 Verizon Data Breach Investigations Report, Amazon disclosed thwarting more than 1,800 North Korean remote worker infiltration attempts in 2025.
• 12:07
  SPEAKER_01: Identified in part through a distinctive 110 millisecond keystroke input lag.
• 12:15
  SPEAKER_01: All right, so again, Amazon disclosed thwarting more than 1,800 North Korean remote worker infiltration attempts in 2025, identified in part through a distinctive 110 millisecond keystroke input lag.
• 12:35
  SPEAKER_01: Which year was this?
• 12:37
  SPEAKER_01: 2025.
• 12:39
  SPEAKER_00: Yeah.
• 12:40
  SPEAKER_00: It's gotta be way more now.
• 12:44
  SPEAKER_00: So so yeah, uh my my my key thing here is that this thing what what does reveal is that cyber is growing at an exponential rate.
• 12:55
  SPEAKER_00: And the thing is that um, you know, advanced APTs, advanced for they have uh a way of well using more resources, and this is why everybody needs to stay on top of that.
• 13:13
  SPEAKER_00: Because the thing is that obviously with AI and most automations nowadays, it's that's why I say it's gotta be more.
• 13:21
  SPEAKER_00: Uh and I say uh the ATs because well, these countries, and this is why uh it's uh in everyone in my everyone's watch list, is that these countries are always behind the some organizations, if not all, that are constantly heating uh all companies are around it, uh not just Amazon, in fact, even universities.
• 13:47
  SPEAKER_00: Uh universities have a lot of resources, and I know me like financial ones, mostly technology and well classrooms and everything.
• 13:55
  SPEAKER_00: And why is it important for universities?
• 13:59
  SPEAKER_00: And this is why I'm bringing it back, because uh universities have a technology infrastructure, and they're trying to target all of inf all of the infrastructure, not just because they want to hit um just uh you know vulnerabilities for financial exploits.
• 14:15
  SPEAKER_00: They also want to hit for controlling these resources to have maybe zombie computers, then they can attack other univers uh other universities or other institutions in the area, and you know, working their own uh how do you say like uh like their own attack vectors uh in the in their own way.
• 14:38
  SPEAKER_00: So in this regard, I would say that yeah, the the this means that um computers will be you know the the the mostly the most hit ones.
• 14:52
  SPEAKER_00: And this has a lot of things, like I mentioned complete.
• 14:57
  SPEAKER_00: Uh I mentioned the AI part as well, because AI now does it itself, uh, and not just AI, just the autonomous systems, and we're gonna have maybe even agents now trying to do this as well.
• 15:11
  SPEAKER_00: So nobody's gonna be behind the behind the keystrokes and all that kind of stuff that they're mentioning there.
• 15:16
  SPEAKER_00: Yes, it will happen, but uh systems nowadays just attacking.
• 15:22
  SPEAKER_00: This reminds another Kubersky uh cyber map that everybody always tries to put when they want to show off like a this how cyber the the cyber attacks are happening as of now.
• 15:34
  SPEAKER_02: You're 100% right.
• 15:35
  SPEAKER_02: There's a ton to unpack with the statistic, right?
• 15:38
  SPEAKER_02: So we're we already pegged on APTs.
• 15:40
  SPEAKER_02: We're talking about nation states, right?
• 15:43
  SPEAKER_02: We're talking about what I what I would say is a genius way of hacking to secure a form of resource and/or finances, which is why hack a company when you can just get them to hire you, right?
• 15:54
  SPEAKER_02: Like North Korea led the way with this.
• 15:55
  SPEAKER_02: And if I if I remember correctly, the first company to catch it, or one of the first companies to catch it, at least it's closed it publicly, but snow before.
• 16:02
  SPEAKER_02: So just thinking about how this fundamentally shifts the mission of cybersecurity, it's crazy, crazy interesting.
• 16:08
  SPEAKER_02: And let's also not forget about how interesting it was that the way that Amazon caught them, right?
• 16:12
  SPEAKER_02: By by effectively fingerprinting those keystrokes.
• 16:15
  SPEAKER_02: So there's a this is a great, this was a great poll.
• 16:18
  SPEAKER_02: You did a good job, bro.
• 16:19
  SPEAKER_02: Like this is an excellent, an excellent statistic to select for this one.
• 16:22
  SPEAKER_02: All right.
• 16:23
  SPEAKER_02: So let's start at the top, right?
• 16:24
  SPEAKER_02: So North Korea, heavily, heavily sanctioned nation, needed to figure out ways to do things like fund their nuclear program.
• 16:31
  SPEAKER_02: So they started putting people to work, right?
• 16:34
  SPEAKER_02: And like that's why they are always at the forefront of you know this kind of, hey, why hack a company when they can just hire us?
• 16:41
  SPEAKER_02: All right, because it actually shifts to one of the hardest things, in my opinion, that's insider threat.
• 16:46
  SPEAKER_02: Right.
• 16:47
  SPEAKER_02: That's what this is.
• 16:48
  SPEAKER_02: Like we hire someone, you're gonna give them a laptop, you're gonna give them access, you're gonna you're gonna allow them to search your network from inside, they become a trusted individual.
• 16:58
  SPEAKER_02: Like this whole concept of zero trust is like this came out of, well, look, you can't just pretend that everything on the inside of your network is okay, because it's not, right?
• 17:07
  SPEAKER_02: And to your point, when you have resources like a nation state to be able to throw, you know, an army of people at attempting to just gain access to all these organizations, not only to collect the paychecks, because that's a big piece of it, but also to collect the research and the data and the information like you were talking about through universities.
• 17:24
  SPEAKER_02: Like this is this is a perfect storm in my mind.
• 17:26
  SPEAKER_02: And it's something that's pretty wild, pretty serious.
• 17:29
  SPEAKER_00: I would say that there's not just uh North Korea, other states as well, that what they're doing.
• 17:34
  SPEAKER_00: And this was in the news recently that Iran uh as well, other other companies that went into Google, and some of the people were just getting tech out of Google and sending it back to to the to the nation states.
• 17:47
  SPEAKER_00: So uh that that's why now looking at the at the political aspects, it's very interesting now because we were just focusing on this, on the on the cyber criminals, not just now uh basically governments just try to get in and and attacking uh and attacking companies with strategies that most likely would be used on other governments as well.
• 18:11
  SPEAKER_00: And now we as technology leaders now need to start thinking like, hey, what what if I get an attack like that?
• 18:17
  SPEAKER_00: How can I uh prevent it?
• 18:19
  SPEAKER_00: And basically, like you said, it's not preventing because they may be already in.
• 18:24
  SPEAKER_00: So it's it's that how can we mitigate those kind of things?
• 18:28
  SPEAKER_02: Yeah, a hundred percent.
• 18:29
  SPEAKER_02: And like, here's here's the thing I'll tell you.
• 18:32
  SPEAKER_02: I remember probably 10 years ago, maybe more now, maybe 10, 12 years ago, sitting in a conference room with a CISO at an organization I was working with, and the this person at that time, this is when Iran was like really kind of like stepping up, and like there was a ton of chatter on the cyber Intel channels about Iranian attacks and and attempts to infiltrate and all these types of things.
• 18:53
  SPEAKER_02: And this CISO was like, Well, what are we doing about Iran?
• 18:56
  SPEAKER_02: I remember laughing.
• 18:57
  SPEAKER_02: Like I remember being like, Well, what are you talking about?
• 19:01
  SPEAKER_02: Like, this is you're you're talking about statecraft, right?
• 19:04
  SPEAKER_02: You're talking about nation state to nation state activity.
• 19:06
  SPEAKER_02: Like they're not sitting there in front of their whiteboard in Iran and being like, Yeah, we're gonna hit this company.
• 19:12
  SPEAKER_02: Like, that doesn't make any sense.
• 19:14
  SPEAKER_02: And I I still defend, I still maintain, but at the time, over a decade ago, it didn't make any sense.
• 19:20
  SPEAKER_02: Like that wasn't a thing, right?
• 19:21
  SPEAKER_02: Like, and if it was, it was super targeted for super specific reasons.
• 19:25
  SPEAKER_02: Like we know that you know the Chinese government is notorious, unapologetically notorious for, you know, targeting organizations specifically to like uh specifically the steel research and development, right?
• 19:36
  SPEAKER_02: So that was definitely an issue.
• 19:37
  SPEAKER_02: But like in these cases, like statecraft typically stayed with statecraft and it wasn't about private industry.
• 19:43
  SPEAKER_02: But role, I think you're I think you're spot on that shifted.
• 19:46
  SPEAKER_02: Like that perspective has changed for me.
• 19:48
  SPEAKER_02: And I think that every organization, including smaller organizations, have to be aware of this and they have to worry about this because of how intertwined we're becoming, especially technically.
• 19:57
  SPEAKER_02: Right.
• 19:58
  SPEAKER_02: If you're thinking about all of our different organizations, if you're thinking about the supply chain, if you're thinking about like how organizations get into larger targets for whatever their mission might be, like you start small and you pivot in and you pivot in and you pivot in.
• 20:11
  SPEAKER_02: So, like, yeah, now I do think North Korea is a problem for small organizations.
• 20:16
  SPEAKER_02: I think Iran is a problem for you know, small organizations, China is a problem for small organizations.
• 20:20
  SPEAKER_02: It's no longer the Fortune 50 that have to worry about that anymore, or the defense contractors that used to be have to be all over it.
• 20:28
  SPEAKER_00: And that like you're mentioning, it's not just uh the Fortune 500 companies, because uh maybe you're a company that either by your revenue or by your fingerprint on tech, you're gonna get targeted.
• 20:40
  SPEAKER_00: So that that that's why there's different types of targets and you know, these criminal organizations, but also the these APTs, they do tend to attack and they stay stay silent for a way.
• 20:53
  SPEAKER_00: Uh so they don't they don't monetize uh as typical hackers, they just gain access, they remain silent, uh, and then you start seeing them months or years later that you start seeing, oh, these guys were in.
• 21:09
  SPEAKER_00: And those are the things that we need to start being aware of, uh knowing that it's happening.
• 21:15
  SPEAKER_00: And yeah, uh it's like you said, not just the Fortune 500 companies, because the thing is that uh there's you start to you need to start thinking, what do I have uh that they might want?
• 21:29
  SPEAKER_00: Uh either it's technology, resources, financial, obviously, but but yeah, that but that's that that's that's it's it.
• 21:38
  SPEAKER_00: Uh the they they always want to, you know, the financial because it's like the like when you're attacking a bunch of people just to get microtransactions.
• 21:48
  SPEAKER_00: So maybe for a company that says, Oh, I got hit, maybe somebody sold a hundred thousand dollars, maybe it doesn't sound big for a for a Fortune five hundred company.
• 22:00
  SPEAKER_00: Or maybe uh just uh uh tech startup or something like that.
• 22:04
  SPEAKER_00: But what if a hundred of those companies were hit?
• 22:09
  SPEAKER_00: Then they made the quota.
• 22:11
  SPEAKER_01: But that's I think that was the big shift too, is the notion of now this water's becoming vastly different path down a hill, right?
• 22:17
  SPEAKER_01: Yeah, so I can go hit, you know, 12 K12s, knowing that their budgets are public, knowing that they do have insurance and knowing that, hey, they will probably pay out, right?
• 22:25
  SPEAKER_01: So yeah, I think people are just becoming a lot more aware of that.
• 22:28
  SPEAKER_01: But that goes back to the one of the things that pointed out or poked out for me on this one was I believe it was originally identified the the 110 milliseconds was basically a trigger out of normalcy.
• 22:37
  SPEAKER_01: Hey, what is normal in our environment?
• 22:39
  SPEAKER_01: And Raoul, that goes back to your point.
• 22:40
  SPEAKER_01: As this becomes more system-based, I think it becomes really important to say, hey, we've got to have a decent understanding of what normal looks like in this environment because the third party aspect, right?
• 22:49
  SPEAKER_01: We're putting more ri reliance on going back to our issue before privacy.
• 22:53
  SPEAKER_01: Like, do we really trust the notion of this AI agent being brought in by a third party and which it will be limited in what's access to, so on and so forth, right?
• 22:59
  SPEAKER_01: We don't have to go down that path.
• 23:00
  SPEAKER_01: But I think you're absolutely right.
• 23:02
  SPEAKER_01: Um, and it goes back to those things of control, right?
• 23:04
  SPEAKER_01: That's one of the themes I think that you'll probably hear, at least out of my voice a lot.
• 23:08
  SPEAKER_01: Um, but what are those little things that we can kind of control in this environment?
• 23:11
  SPEAKER_01: Because it's gonna get crazy.
• 23:12
  SPEAKER_01: You just talked about how this has become obsolete, right?
• 23:15
  SPEAKER_01: And it's only been two years.
• 23:17
  SPEAKER_00: You know, and and what you say is the is the most uh thing there about you know know knowing your environment.
• 23:25
  SPEAKER_00: And this goes back to the fundamentals, like knowing what matters, knowing that there's gonna be a uh uh failure or uh or an incident, and then making sure that everybody can react to it.
• 23:38
  SPEAKER_00: Because uh basically, if you don't know your environment, you're not gonna detect it.
• 23:44
  SPEAKER_00: And this um APTs, they they stay there for a while, and like I was mentioning about staying silent, and they didn't do it on purpose because they don't want you to know that they're they're there because when they are going to attack, they want to get you when you are least expecting it.
• 24:02
  SPEAKER_01: Well, information's power on their end too, right?
• 24:04
  SPEAKER_01: Like as much as we want to know our our they our infrastructure, they want to know it too, to your point.
• 24:09
  SPEAKER_01: And like, I don't know, I've never been on the other side, but I can just imagine once they do get that point of opportunity to start to pivot and explore, like again, that's got to give them like the notion of like, yeah, right, just on the same side as when we were defending, right?
• 24:21
  SPEAKER_01: And and stopping things.
• 24:22
  SPEAKER_01: You're like, oh, I know who this is.
• 24:23
  SPEAKER_01: All right, cut off.
• 24:24
  SPEAKER_01: Good.
• 24:24
  SPEAKER_01: So it's just I I can understand like their their objective, while malicious, right?
• 24:30
  SPEAKER_01: They're thinking about it the same way.
• 24:32
  SPEAKER_01: How do we do this in which we can't be caught?
• 24:34
  SPEAKER_01: So again, it is a game at the end of the day.
• 24:36
  SPEAKER_02: Yeah.
• 24:37
  SPEAKER_02: And and there's something that we talked about that, yeah, I think we glossed over a little bit that actually scares me, like if I'm being honest.
• 24:43
  SPEAKER_02: And it's this concept of this shift where we basically just all agreed and we just all established that nation state actors are a problem for everyone, right?
• 24:52
  SPEAKER_02: The the playing field is opened up.
• 24:54
  SPEAKER_02: It's no longer just statecraft where it's state actor to state actor, it's also state actor to private industry or private organization or university or nonprofit or whatever that is.
• 25:03
  SPEAKER_02: And like that in and of itself is scary, but the reason why is because of the motivation, right?
• 25:08
  SPEAKER_02: So, Raul, you had talked about what are the motivations?
• 25:11
  SPEAKER_02: There's data theft, there's persistence, but there's financial motivation, right?
• 25:15
  SPEAKER_02: But the thing is states are not necessarily driven by financial.
• 25:20
  SPEAKER_02: Yes, we started this conversation with North Korea.
• 25:22
  SPEAKER_02: North Korea definitely is funding its nuclear programs through things like stealing Bitcoin, as well as through actually like the workforce that's that's gathering you know revenue to fund these things to circumvent the sanctions.
• 25:34
  SPEAKER_02: But the thing is like by far and away, or like organizations like Iran, like parts of what North Korea are doing, like China, like you know, any Russia, any of these adversarial nations, they're not driven by finances.
• 25:46
  SPEAKER_02: They're not driven by financial benefit.
• 25:48
  SPEAKER_02: They're driven by whatever that mission is.
• 25:50
  SPEAKER_02: And that makes me super uncomfortable.
• 25:53
  SPEAKER_02: The reason why is because I tell our customers, I tell everyone I can tell, like regularly, as much as I can.
• 25:58
  SPEAKER_02: Your goal is not to be the most defensible.
• 26:00
  SPEAKER_02: That's impossible.
• 26:02
  SPEAKER_02: Your goal is to be annoying enough to get the attacker to move on, right?
• 26:05
  SPEAKER_02: But that only works if the attacker is motivated by volume and by finance, right?
• 26:10
  SPEAKER_02: So that works really well for crime syndicates.
• 26:12
  SPEAKER_02: Like, oh yeah, this one's too hard.
• 26:13
  SPEAKER_02: I'm gonna move on.
• 26:14
  SPEAKER_02: Let's go to an easier target.
• 26:15
  SPEAKER_02: Let's find someone who I can get into, no problem.
• 26:18
  SPEAKER_02: But that's not how state actors think.
• 26:20
  SPEAKER_02: State actors have a mission and they're gonna be persistent and they're gonna continue to focus on that thing until that until they finish that mission.
• 26:27
  SPEAKER_02: And like that's a fundamental shift that I think we as IT and cyber professionals have to consider as we're building our defenses and as we're strengthening the controls that Owen talked about.
• 26:38
  SPEAKER_00: And the thing is that everybody right now, it's just building uh either by a by a framework or and that and they're not there and people are not see are not thinking of this kind of threats when when we are designing an information security program, or as a matter of fact, just renewing uh cybersecurity uh uh insurance.
• 26:59
  SPEAKER_00: Uh because the thing is that when you're going for that, you're just checking the box.
• 27:04
  SPEAKER_00: But the thing is that nobody's asking you about, well, what if they're in?
• 27:07
  SPEAKER_00: Uh, what is data is being explosive?
• 27:11
  SPEAKER_00: And you know, those those kind of things are people start thinking it when when it happens.
• 27:18
  SPEAKER_00: And yeah, it's it's it's something that everybody needs to prepare in that regard because the thing is that it's gonna knock on their door.
• 27:27
  SPEAKER_00: And and yeah, you you you can't be just asking the question, why us?
• 27:32
  SPEAKER_00: It's it's mostly no no, it's it's not why why why you or anybody else.
• 27:36
  SPEAKER_00: It's just that this time the these nation states are gonna target everyone because eventually they'll have something, and like you were mentioning, it's not just a financial.
• 27:47
  SPEAKER_00: Um data right now is the one of the most valuable assets.
• 27:51
  SPEAKER_00: And once they start gathering more data, the more data they have.
• 27:55
  SPEAKER_00: And the thing is that nowadays data is almost limitless, so uh unlimited.
• 28:01
  SPEAKER_00: So we don't we don't have uh this kind of thing where we're saying, oh, we got all the data we need.
• 28:06
  SPEAKER_00: That never happens.
• 28:08
  SPEAKER_00: So that's why they stay in and they keep extra trading data, I guess.
• 28:12
  SPEAKER_00: That's that's their nature, and they're gonna keep going.
• 28:15
  SPEAKER_02: That's right.
• 28:16
  SPEAKER_02: The nature of the threat actor.
• 28:18
  SPEAKER_02: That would be a that would be a cool conversation, right?
• 28:20
  SPEAKER_02: Let's just like let's just build what is the natural state of threat actors, right?
• 28:24
  SPEAKER_02: And like see, see if we can use that textbook anything.
• 28:27
  SPEAKER_02: Listen, guys, this is this half hour has flown by.
• 28:30
  SPEAKER_02: Like, this has been a really, really easy conversation for me.
• 28:34
  SPEAKER_02: I looked up, I was like, oh my God, we're like, we're we're at the end of the episode.
• 28:38
  SPEAKER_02: So listen, let's let's wrap this up a bit.
• 28:41
  SPEAKER_02: I want to go around, like, what did this episode mean for you, Raoul?
• 28:44
  SPEAKER_02: If you were to think about like your reflections on this, what has this got you thinking about?
• 28:48
  SPEAKER_02: When you hang up with us and you gotta start, you gotta start writing in your journal, what are you writing about?
• 28:53
  SPEAKER_00: So basically, yeah.
• 28:54
  SPEAKER_00: Um, it's it goes down to well, two things.
• 28:58
  SPEAKER_00: Going back to the fundamentals, like every conversation.
• 29:02
  SPEAKER_00: Um, everything goes back into going into cybersecurity, you know, as part of the normal conversation of any business.
• 29:11
  SPEAKER_00: Because cybersecurity needs to be embedded into the design of the business.
• 29:16
  SPEAKER_00: That's not not just the technology, like everything around it, like we're mentioning social engineering, from the people, the technology, the processes, cybersecurity needs to be there uh from that.
• 29:29
  SPEAKER_00: And the other thing that I would say is obviously that um cybersecurity, it's isn't about how many attacks you stop, it's mostly how well your organization can operate when something goes wrong.
• 29:43
  SPEAKER_00: Because that's gonna always happen.
• 29:46
  SPEAKER_00: Uh even if it's uh uh APT or just a hacker down the stream.
• 29:52
  SPEAKER_00: Uh there's something gonna happen, and the thing is how you respond to it because of resilience and it's it it it it's what's gonna set set you apart from it.
• 30:02
  SPEAKER_00: So I would say I I would say that yeah, it it goes to that example of how well you you are prepared, but not prepared to prevent it is mostly on that response as well.
• 30:14
  SPEAKER_02: I love it.
• 30:15
  SPEAKER_02: What are you thinking, Owen?
• 30:17
  SPEAKER_01: Yeah, no, honestly, that's uh it's a great segue into I think the overall topic of what we talked about today is kind of just that notion of being prepared.
• 30:24
  SPEAKER_01: And it kind of reminded me of a little bit of a different topic, but of going back to this notion of muscle memory, right?
• 30:29
  SPEAKER_01: Uh Raoul, I think you brought this up of you know, taking time to know your own inventory and to know what's inside the house.
• 30:34
  SPEAKER_01: And as we start to think about how do we properly defend that, is where is our opportunity to build that muscle memory?
• 30:40
  SPEAKER_01: Um, right.
• 30:41
  SPEAKER_01: Because, you know, you're kind of highlighting the same things here, but we we don't want to have this ability to truly like think we want our bodies to start taking over because we've kind of thought about this or practice enough where we don't have to worry about that, right?
• 30:53
  SPEAKER_01: Um, I think there was some recent um uh theatrical star um that was talking about doing Broadway and you know, what about remembering your lines?
• 31:02
  SPEAKER_01: How do you do these cues?
• 31:04
  SPEAKER_01: And just the notion of the the response was practice, right?
• 31:07
  SPEAKER_01: Uh at a certain point, I feel like I'm not gonna do it, but then you know the curtains come up, the music starts playing, I see the cues, and my body reacts.
• 31:13
  SPEAKER_01: Um, so I think that's a really good point, Roel, is you know, let's not always try to compete, but let's try to think about our responses and how do we do that appropriately?
• 31:21
  SPEAKER_02: Yeah, solid.
• 31:23
  SPEAKER_02: This this episode really made me rethink kind of this this concept of a threat model.
• 31:28
  SPEAKER_02: Like this, like this one changed me a little bit because like, you know, I I keep going back to this concept of all right, well, like, all right, do does for example, does Talas need to worry about, you know, North Korean actors?
• 31:40
  SPEAKER_02: And like, and you know, on my on the surface, I'm like, nah, of course not.
• 31:44
  SPEAKER_02: But the reality is we do, and we have to worry about all of it.
• 31:46
  SPEAKER_02: Like, and I think that if we, a small organization with five folks, have to worry about these things, like that means it's really up to everybody now.
• 31:54
  SPEAKER_02: And like there's no longer this kind of security by obscurity that a lot of organizations lean into, right?
• 32:00
  SPEAKER_02: Hey, I'm I'm not a target.
• 32:02
  SPEAKER_02: It's not for me, I don't have to worry about it, right?
• 32:04
  SPEAKER_02: The reality is if you're part of a larger ecosystem, if you're part of a supply chain, and I don't necessarily mean like physical supply, I mean like digital supply chain.
• 32:13
  SPEAKER_02: Like if you provide services to an organization, you have access, you have some persistent connection, an API, a VPN, uh, even just you know the ability to know, right?
• 32:22
  SPEAKER_02: We see business email compromise all the time.
• 32:24
  SPEAKER_02: The reality is this ecosystem has expanded, which means our threat models have expanded as well.
• 32:30
  SPEAKER_02: And that means that I'm gonna spend most of this weekend probably sitting under my covers crying a little because I have realized how much how much has changed in the last couple of years.
• 32:39
  SPEAKER_02: So listen, guys, amazing, amazing conversation.
• 32:43
  SPEAKER_02: Roel, thank you so much for taking the time to meet with us.
• 32:45
  SPEAKER_02: We really appreciate you being here, man.
• 32:47
  SPEAKER_02: Um I appreciate it for inviting me.
• 32:49
  SPEAKER_02: Yeah, of course.
• 32:49
  SPEAKER_02: All right.
• 32:50
  SPEAKER_02: Well, listeners, thank you all for listening.
• 32:52
  SPEAKER_02: We appreciate you.
• 32:53
  SPEAKER_02: Be well, stay safe.
• 32:54
  SPEAKER_02: We'll talk to you all soon.
• 32:55
  SPEAKER_02: Bye bye.