Latest / Cybersecurity Perspectives / S1:E9 - 27 seconds, The fastest e-crime breakout time on record in the 2026 CrowdStrike Global Threat Report.

Transcript

S1:E9 - 27 seconds, The fastest e-crime breakout time on record in the 2026 CrowdStrike Global Threat Report. · Cybersecurity Perspectives

0:00
SPEAKER_00: Cybersecurity moves fast.
0:02
SPEAKER_00: Working in a space measured in minutes and seconds means we can't expect to keep pace by doing the same thing over and over.
0:08
SPEAKER_00: The sharing of perspective across technologists, defenders, business, and professionals is key to unleashing internal capability.
0:16
SPEAKER_00: Perspective comes from sharing experiences and ideas.
0:20
SPEAKER_04: Welcome to Cybersecurity Perspectives.
0:24
SPEAKER_04: Oh, and I think you need to do the intro.
0:26
SPEAKER_04: I don't know if I could do it again.
0:28
SPEAKER_04: I'm all intro to Outman.
0:31
SPEAKER_00: Well, happy Friday episode Not Quite Sure, but welcome back to Cybersecurity Perspectives.
0:37
SPEAKER_04: Welcome back to Cybersecurity Perspectives.
0:40
SPEAKER_04: Oh man, you know, it it is a Friday.
0:42
SPEAKER_04: We're recording on a Friday uh here on the East Coast.
0:45
SPEAKER_04: We're getting into the later afternoon.
0:48
SPEAKER_04: And I am beat.
0:49
SPEAKER_04: I am absolutely destroyed.
0:51
SPEAKER_04: I don't know about you, man.
0:53
SPEAKER_00: Energy levels are kind of feeling like a long week, but man, I'll tell you, this episode really gets me going again.
0:59
SPEAKER_00: So currently feeling motivated, getting ready.
1:01
SPEAKER_00: Yeah, kind of can you write?
1:04
SPEAKER_04: I gotta get myself, I gotta get myself back.
1:06
SPEAKER_04: Let's go.
1:06
SPEAKER_04: Let's let that caffeine kick in.
1:08
SPEAKER_04: And well, here's here's the other here's the other good news.
1:10
SPEAKER_04: We do have another amazing guest with us today.
1:13
SPEAKER_04: And I'd like to take a second to introduce him.
1:16
SPEAKER_04: He's an educator, he's a mentor, and thank goodness for COVID, because now he's a technology professional.
1:21
SPEAKER_04: He also is a pickleball enthusiast.
1:24
SPEAKER_04: And the first person I've ever met from Mississippi, it is with my pleasure I'd like to introduce to the show Albert Galayas.
1:31
SPEAKER_04: Albert, welcome to the show.
1:32
SPEAKER_03: Thanks, man.
1:33
SPEAKER_04: What's up?
1:35
SPEAKER_04: Oh, well, now every day, my energy level's up.
1:38
SPEAKER_04: That's what's up right now.
1:39
SPEAKER_04: Right.
1:39
SPEAKER_04: Exactly.
1:40
SPEAKER_04: I got I got the endorphins going now.
1:42
SPEAKER_04: Owen, this is why Owen's such a great partner.
1:44
SPEAKER_04: He like, he balances me, right?
1:46
SPEAKER_04: When I'm down, he's up.
1:47
SPEAKER_04: When he's down, I'm up.
1:48
SPEAKER_04: Like that's how we got to keep things going.
1:51
SPEAKER_04: Absolutely.
1:52
SPEAKER_04: Amazing.
1:53
SPEAKER_04: So, Albert, why don't you take a take a second and let the listeners know kind of your story?
1:58
SPEAKER_03: Yeah, man.
1:59
SPEAKER_03: Uh, so uh been in technology, well, not you know, been in education my entire career.
2:06
SPEAKER_03: Uh started as a teacher, uh, was in the classroom for a couple of years, and I loved it.
2:12
SPEAKER_03: And then from there, I went on to become an instructional technologist.
2:17
SPEAKER_03: Uh, so I became the teacher that taught other teachers how to use technology in the classroom.
2:23
SPEAKER_03: Um, and that is sort of the the position that had got me involved with the technology department.
2:29
SPEAKER_03: So that's where I met network administrators and systems administrators and the crazy stuff they were doing.
2:35
SPEAKER_03: And I just kept asking questions like what is Active Directory?
2:40
SPEAKER_03: Let's start with that, you know?
2:43
SPEAKER_03: Oh yeah.
2:44
SPEAKER_03: And then uh from there, uh became assistant principal for middle school, and then COVID happened.
2:51
SPEAKER_03: And you know, that was a crazy time for everybody, and and that that created the pathway for me to become the technology director for uh my organization.
3:02
SPEAKER_03: And I've been doing that ever since.
3:04
SPEAKER_04: And it's been now I bet you know what Active Directory is, inside and out, and every policy and every every OU and everything that in between, right?
3:13
SPEAKER_04: I I I I feel pretty good about it now.
3:18
SPEAKER_04: That's amazing.
3:19
SPEAKER_04: I got a question for you.
3:20
SPEAKER_04: You know, like we we interact with a couple of education folks.
3:23
SPEAKER_04: We have some education clients.
3:25
SPEAKER_04: And by the way, to the education folks that are listening out there, like y'all are amazing.
3:30
SPEAKER_04: Like, I have to say, like what you guys do with the amount of resources you have is dumbfounding.
3:36
SPEAKER_04: And the vast majority of like technologists outside of the space have no idea.
3:41
SPEAKER_04: Like the amount of automation y'all lean into, what you get done for what our small enterprise networks is amazing.
3:47
SPEAKER_04: So, see, now I can tell you my energy level is up because now I'm giving out shout outs like that.
3:53
SPEAKER_04: A question for you.
3:54
SPEAKER_04: So you you started with instructional technology, that was your entrance into tech, and now you're running tech.
4:00
SPEAKER_04: Did like what what was that transition like for you?
4:03
SPEAKER_04: Like, if if you're thinking about like the teaching versus the doing, like how did that feel and what's that like today?
4:09
SPEAKER_03: So I can tell you, um, when the when the offer came open, I felt out completely unprepared.
4:19
SPEAKER_03: Uh like, you know, it was just looking at this huge mountain in front of me.
4:25
SPEAKER_03: So it's one thing to go from teaching someone how to use a learning management system um or messing around with the student information system, but it's a whole different animal when you're talking about now infrastructure and keeping everyone safe.
4:41
SPEAKER_03: It was just one of those situations where I kind of I kind of knew from my school administration experience that I would have to surround myself by a team of people I could trust along the way.
4:52
SPEAKER_03: And that's what I did.
4:53
SPEAKER_03: I surrounded myself with uh a good team, like I have an excellent team of people that I get to work with, but then also uh I get to work with great vendors.
5:03
SPEAKER_03: They have been instrumental in you know helping me navigate some of the questions I've had out there.
5:11
SPEAKER_03: Um bring them along.
5:13
SPEAKER_03: I mean, like I I tell people all the time, like the people I get to work with, although they're not my employees, I'm like, I see them like employees, like I'll call them all day, every day.
5:22
SPEAKER_03: But they're they're that's what they're there for, you know.
5:24
SPEAKER_03: So definitely a shout out to all the vendors we get to work with.
5:28
SPEAKER_03: Um but but that transition, man, it was just you have to humble yourself and be willing to learn every single day.
5:39
SPEAKER_03: I mean, that's the key to it.
5:41
SPEAKER_03: Never stop reading about it.
5:42
SPEAKER_03: Um, and then I remember joining Discord groups with uh, I think it was a a black hat Discord group of just and system administrators and just learning what's out there and see what I am dealing with, and um just asking questions and learning and and getting pointed to the right directions, and and and that's really the um that was the path right there.
6:13
SPEAKER_03: Uh yeah, just surround yourself with people and resources.
6:18
SPEAKER_03: Uh nothing will prepare you for the job except surrounding yourself with the right resources and the right people.
6:24
SPEAKER_00: I love that mentality.
6:25
SPEAKER_00: I think that's one of the characteristics that I look at or look for in great leaders, right?
6:30
SPEAKER_00: Um, it's the humbleness to say, I'm not gonna have all the answers, I don't have all the knowledge.
6:35
SPEAKER_00: And that's what I love about just kind of some of the sports background that I've always loved to grow up and do is the best teams are creating the pieces that you need rather than just replicating what you may want in your mind, right?
6:48
SPEAKER_00: Like that's amazing.
6:49
SPEAKER_00: Absolutely.
6:50
SPEAKER_04: I I I also love how you brought up curiosity.
6:53
SPEAKER_04: Like as a technologist, the speed at which these things move, it reminds me of a story.
6:58
SPEAKER_04: I remember my very first job out of college.
7:01
SPEAKER_04: Uh by the way, I graduated college with political science and philosophy.
7:04
SPEAKER_04: So I had no idea what I wanted to do, right?
7:06
SPEAKER_04: No tech degrees, nothing like that.
7:08
SPEAKER_04: But my first, like I remember sitting at my kitchen table, figuring out what I like, what I want to do, and I land on technology.
7:14
SPEAKER_04: So my very first technology job out of college, I'm working for this consulting company in Midtown Manhattan.
7:21
SPEAKER_04: And uh I remember talking to at the time, the senior administrator, which of course, looking back now, that guy was like 28, right?
7:29
SPEAKER_04: So I was like 22.
7:30
SPEAKER_04: He's like so wise.
7:32
SPEAKER_04: And he gave me some advice that I that stays with me to this day, decades later.
7:36
SPEAKER_04: He said, the best system administrators are curious, they're power hungry, and they're lazy.
7:43
SPEAKER_04: They're gonna figure out every problem, they're gonna lock down the network as much as they can, and they are gonna automate everything.
7:49
SPEAKER_04: If you can curate those three skills, you're gonna be the best system administrator on the planet.
7:54
SPEAKER_04: And like it to this day, when I meet fellow technologists, right, at every in every industry at every point of their career, that inherent curiosity is always something that bubbles way its way up to the top.
8:07
SPEAKER_04: They have to figure out how things work, they have to tinker.
8:10
SPEAKER_04: Right.
8:10
SPEAKER_03: So it's funny you said that because so Wednesday, you know, we have uh we go to church, and then uh, but all day long I've been working on automating this one thing for our ticket system, which is to enrich it with a Google Sheet with some of our data that we want in our ticket system, just to make it easy for our guys to just pick up and go.
8:31
SPEAKER_03: So I'm working on that all day long.
8:33
SPEAKER_03: I get home, we go to church, we come home at eight o'clock, and then at nine o'clock, I sit down, and my wife is like, What do you do?
8:41
SPEAKER_03: She's like, I I've got to solve this problem.
8:43
SPEAKER_03: Like, I've worked on it all day.
8:46
SPEAKER_03: I I need one hour, I can fix it.
8:49
SPEAKER_03: And then I spend that time, and when I was done, I'll relieve just oh, it's automated.
8:54
SPEAKER_03: I don't have to think about it anymore.
8:56
SPEAKER_03: So I love it.
8:58
SPEAKER_03: Gotta be some passion in there for sure.
9:00
SPEAKER_04: That's amazing.
9:01
SPEAKER_04: It's it's funny, like something similar just happened.
9:04
SPEAKER_04: I was at I was at dinner with the family this this past week.
9:07
SPEAKER_04: And, you know, one of my one of my nephews, he he was working on, you know, like how you go to a restaurant and you get the placemat, it's the kids' menu.
9:14
SPEAKER_04: They give you crayons and there's mazes and games on it for the kids, right?
9:17
SPEAKER_04: So on this particular placemat, it was a game and it was like the word scramble where you have a word, it mixes it up, and you have to figure out what the word is.
9:25
SPEAKER_04: I'm looking at this thing, and and like you know, my my nephew's like, Hey, Uncle Paul, can you help me figure this one out?
9:30
SPEAKER_04: I can't figure it out.
9:31
SPEAKER_04: And I'm looking at this thing, I'm staring at it.
9:33
SPEAKER_04: And then the food comes and I can't stop thinking about it.
9:35
SPEAKER_04: And I'm like, I gotta, I gotta figure this out.
9:37
SPEAKER_04: And then the food is, and I'm looking at it, I'm staring at it, I'm looking at it.
9:40
SPEAKER_04: So finally, my brother-in-law is like, dude, what are you doing?
9:43
SPEAKER_04: I'm like, I have to figure out this word.
9:45
SPEAKER_04: I cannot leave this restaurant until I figure out this word.
9:48
SPEAKER_04: And this guy says, Well, dude, just take a picture of it with AI.
9:50
SPEAKER_04: AI will figure it out.
9:52
SPEAKER_04: And I'm like, you are missing the point of using your brain.
9:55
SPEAKER_04: Like, I cannot use AI.
9:57
SPEAKER_04: I have to figure out what this word was.
9:59
SPEAKER_04: I did figure out two of the three words.
10:02
SPEAKER_04: The last one is gone in the eons.
10:04
SPEAKER_04: It's, it's, it's forever, will it be unknown?
10:06
SPEAKER_04: Unless I go back to the restaurant and figure it out.
10:08
SPEAKER_04: But like, again, it's that same kind of like, I have to get this thing done.
10:12
SPEAKER_04: And like that truly resonates with me of like, you know, this is this is who we are, right?
10:17
SPEAKER_04: Culturally, as cyber professionals, as technologists, like we got to know how things are working.
10:23
SPEAKER_04: We have to know what happened.
10:25
SPEAKER_04: We have to run things to ground and solve those problems.
10:28
SPEAKER_02: Absolutely.
10:29
SPEAKER_02: Absolutely.
10:30
SPEAKER_02: Amazing.
10:31
SPEAKER_00: What do you think, Owen?
10:34
SPEAKER_00: I don't know.
10:34
SPEAKER_00: I think this is a great time.
10:35
SPEAKER_00: Albert, you ready to maybe pick a card?
10:38
SPEAKER_00: Is it time?
10:39
SPEAKER_00: Go ahead.
10:40
SPEAKER_03: So, this is the part.
10:41
SPEAKER_03: I listened to the podcast and suddenly I was like, oh my gosh, what if I get that card?
10:46
SPEAKER_04: So well, we don't repeat cards.
10:50
SPEAKER_04: That would make for a very boring podcast.
10:52
SPEAKER_04: But we uh yeah, we're gonna we're gonna pick a random card.
10:55
SPEAKER_04: I don't know what the card, like we wrote these things months ago.
10:58
SPEAKER_04: We have no idea what they are.
11:00
SPEAKER_04: And uh it's up to you, man.
11:01
SPEAKER_04: Card A, card B, or card C?
11:04
SPEAKER_04: Which direction are you going?
11:05
SPEAKER_00: I'll give a little bit of detail behind this though.
11:07
SPEAKER_00: Albert, the the B pile is the lowest pile thus far.
11:10
SPEAKER_00: So that means that's been the most popular.
11:12
SPEAKER_00: Not trying to suade your answer.
11:14
SPEAKER_00: You could be like me, kind of like when I took standardized tests, C's get degrees, right?
11:17
SPEAKER_00: So just all up to you.
11:20
SPEAKER_03: Let's see what you got.
11:21
SPEAKER_03: I must all right, all right.
11:22
SPEAKER_03: You know what?
11:24
SPEAKER_03: Let's let's go for A today.
11:26
SPEAKER_04: Let's go for Wow, hey, that's amazing.
11:30
SPEAKER_04: You know what?
11:30
SPEAKER_04: That's this tells me a lot about you, Albert.
11:33
SPEAKER_04: Like I'm I'm gonna start to like psychoanalyze you over the course of this episode now.
11:36
SPEAKER_04: All right, what do we got for A?
11:38
SPEAKER_00: Well, well, first and foremost, thank you for selecting A, because this is by far the shortest one I get to read.
11:42
SPEAKER_00: So poof, I'm already off to a great start.
11:45
SPEAKER_00: All right, so the the topic of this particular stat is e-crime, comma speed.
11:52
SPEAKER_00: According to the 2026 CrowdStrike Global Threat Report, 27 seconds fastest e-crime breakout time on record.
12:02
SPEAKER_00: So, as or no, according to the 2026 CrowdStrike Global Threat Report, the fastest e-crime breakout time on record is 27 seconds.
12:13
SPEAKER_00: Wow.
12:13
SPEAKER_00: What is that?
12:14
SPEAKER_04: This one is terrifying, right?
12:17
SPEAKER_04: Like, so for those of you listening who aren't familiar with the term of breakout time, let me just explain this to the to the listeners out there.
12:25
SPEAKER_04: What a breakout time is, it's the amount of time that's measured from when an attacker gets on the very first computer and how long it takes them to get to the next computer.
12:35
SPEAKER_04: That's the breakout.
12:36
SPEAKER_04: So they get into a network with that very first link click or that very first whatever, kind of how they got on there, social engineering, whatever.
12:44
SPEAKER_04: And then the amount of time they take to move to the next system in the network is breakout.
12:49
SPEAKER_04: So what CrowdStrike is saying, what they've measured here today, is that in 2026, of all of the breakouts that they measured over the course of that entire year in their report, the fastest one they saw was 27 seconds.
13:05
SPEAKER_02: That's wild.
13:07
SPEAKER_02: That is wild.
13:09
SPEAKER_04: You know, like this is one of those stats where you you think about it and you're like, oh man, this is terrifying.
13:16
SPEAKER_04: Like this is the dark side of cybersecurity, right?
13:19
SPEAKER_04: Like we have to now think about like these are the things we're up against, right?
13:23
SPEAKER_04: And in this particular case, what we're up against is speed.
13:26
unknown: Right.
13:26
SPEAKER_04: So if I'm if I'm just dissecting this one for just a second here, like there's clearly some things that go into this.
13:33
SPEAKER_04: So we can temper this a little.
13:34
SPEAKER_04: Like, and and I think it's important to disclose, like, this is not every single breakout.
13:39
SPEAKER_04: This is not every single breach or every single attacker.
13:43
SPEAKER_04: This is the fastest one that was observed.
13:46
SPEAKER_04: So there was clearly some issues, right?
13:48
SPEAKER_04: That was clearly not a very well-configured network.
13:51
SPEAKER_04: Clearly, there like whoever they got onto, like there was local admin, there was like probably re credit credential reuse.
13:58
SPEAKER_04: They probably hadn't done things like, you know, like updated or disabled, you know, the kind of like some of the different credentials that might have been stored on the on the system or whatever else.
14:06
SPEAKER_04: I'm certain the attacker probably had some automation, so we're likely sophisticated as well.
14:11
SPEAKER_04: So in this case, like what this stat tells me is like there was clearly a perfect storm here, or at least that's what I'd like to believe.
14:17
SPEAKER_04: But like that doesn't make it less scary for us as cyber professionals and technologists.
14:22
SPEAKER_03: Right.
14:22
SPEAKER_03: That's sort of as soon as you said that, does the speed I'm thinking cyber hygiene, like what was it?
14:28
SPEAKER_03: You know, a lot of time I try to keep things as basic as possible, you know.
14:35
SPEAKER_03: Um I try not to focus so much on the obscure things out there and focus on the on the on the pillars of things that we all know we should be doing, you know, per se.
14:46
SPEAKER_03: Um so I I hear that, that speed, and I and immediately I'm thinking, well, you know, there's there's all these uh configurations that could be in place, there's all these uh layers that could be in place where any of these things in place.
15:00
SPEAKER_03: And I I can honestly see in an environment where there's uh absolutely no governance where you could see that level of speed.
15:11
SPEAKER_03: Um like absolutely.
15:13
SPEAKER_03: I could see where a priority of where the lack of priority of resources can create that perfect storm.
15:23
SPEAKER_04: Yeah.
15:24
SPEAKER_04: I honestly like you're you're spot on.
15:26
SPEAKER_04: Oh, and what are your thoughts here?
15:27
SPEAKER_04: Like, what's your initial impression on this particular staff?
15:30
SPEAKER_00: Yeah, no, I I mean it it's definitely the notion of I would say that the movement within, I would say, an organization's network seems to be having it at a quicker clip, right?
15:42
SPEAKER_00: And and Albert, to your point, you know, kind of why why is that, right?
15:45
SPEAKER_00: Are there things in our environment that aren't managed or aren't understood or known about, or the controls don't reside within that particular asset?
15:53
SPEAKER_00: But I mean, I was kind of going back to this notion of the the colleagues back in the security operations centers, right?
16:00
SPEAKER_00: Like 27 seconds, I don't think I can even get a uh an alert out of my queue in 27 seconds.
16:06
SPEAKER_00: Like now they're already pivoting across the network.
16:08
SPEAKER_00: Like, oof, I mean, that's super duper quick, right?
16:12
SPEAKER_00: So just an initial thought is you know, the the defensive action, right?
16:17
SPEAKER_00: How quickly can I respond?
16:19
SPEAKER_00: And, you know, do we have to get ahead of that?
16:21
SPEAKER_00: Or is that not how we should be looking at it?
16:23
SPEAKER_03: The when when I'm thinking uh I kind of go back to and I had this discuss, sort of this discussion with somebody this morning, it it not particularly about this one topic, but uh AI in general and how it's gonna come in on the on the um on the threaters, the threat actor side, basically, and how they're gonna be using that against us, you know.
16:46
SPEAKER_03: And they were saying, you know, they're they're gonna be able to move so fast, we're not gonna be able to stop them.
16:51
SPEAKER_03: I mean, just just basically the the doomsday scenario.
16:54
SPEAKER_03: So if we're thinking 27 seconds now, a year from now, two years from now, what is that speed gonna be like when you have agensic AI just the unleash on an organization?
17:06
SPEAKER_03: So one thing I told Lemmy says, you know, I'm also hopeful for the blue team side though, because if they have that capability, then surely I hope that somebody comes up with a solution where we get to have our own agency blue team, you know, working for us at machine speed looking at these things.
17:29
SPEAKER_03: 100%.
17:31
SPEAKER_03: So so it's a bit out there, but when I hear speed, I I'm thinking there's there's a couple of things that need to be in place.
17:40
SPEAKER_03: I would say uh, you know, I I mean I've shared this before where if I have it, you know, I a lot of times when I'm talking with my team, we're always going back to the CIS group one controls.
17:55
SPEAKER_03: Let's be let's be really good at these.
17:58
SPEAKER_03: You know, we we're not gonna be great at everything.
18:00
SPEAKER_03: We don't have the resources to buy everything, but we can be really good at this one thing right here.
18:05
SPEAKER_03: So let's focus on that.
18:07
SPEAKER_03: So that's that's one layer for an organization to look at.
18:12
SPEAKER_03: But then the next layer to that is gonna be I I would say I'm a late adopter to some stuff, and I'm a late adopter to like to the agentic AI that's been out there.
18:24
SPEAKER_03: It's been out for a year now, but I've just kind of like been observing it.
18:28
SPEAKER_04: Well, it hasn't hasn't, right?
18:29
SPEAKER_04: Like it's developing, you know.
18:31
SPEAKER_03: Yeah, like I'm looking at it and I'm hearing the news, and and I'm I'm playing with some of the models and I'm seeing what it's capable of doing, but as I'm seeing some of these models, like I'm playing around with uh I think it's uh Quinn 3.827 B is one that is pretty pretty equivalent to uh I want to say Chat GPT 5.6, so it's pretty capable.
18:54
SPEAKER_03: Um and I'm get I'm getting the ideas of what would it look like if it properly contained, uh you know, well configured, what would an agent like this look like if it was here increasing our capabilities and hopefully working at looking at these threat actors traversing at that kind of speed.
19:18
SPEAKER_03: So I hope that in a couple of years we we get to also be able to stop these things at that speed, too.
19:27
SPEAKER_04: Yeah, no, look that you you've said a ton, and there is a bunch of things to double click on.
19:32
SPEAKER_04: Before we do, though, I will say we have a new stat, and that stat is 16 minutes and 40 seconds.
19:37
SPEAKER_04: That's the average time it takes to bring up AI in a cybersecurity discussion because that is that is dominated our conversation.
19:45
SPEAKER_04: And look, it's nothing for like it's just it's such an interesting topic, and it and honestly, it's changing the game.
19:51
SPEAKER_04: Like this is this is like what we talk about.
19:54
SPEAKER_04: But you know what?
19:55
SPEAKER_04: Like, I I there's a ton you've said, Albert, and I I want we got to talk about all of it.
19:59
SPEAKER_04: Because honestly, like you've talked about CIS, love that framework.
20:03
SPEAKER_04: You've talked about this concept of red team, blue team, and this kind of agent versus agent, and like how do we get that working, right?
20:10
SPEAKER_04: I like to talk about like the old comic book for Madden magazine, Spy versus Spy.
20:14
SPEAKER_04: That's what this is.
20:15
SPEAKER_04: I know I know I'm I know I'm dating myself, but that's okay.
20:17
SPEAKER_04: Like, I used to love the spy versus spy comics.
20:20
SPEAKER_04: But like I want to bring it back to something that I think we kind of glossed over, but it's unbelievably important.
20:25
SPEAKER_04: And you had talked about for initial reactions, you talk about this concept of hygiene.
20:30
SPEAKER_04: Like, how do you maintain network hygiene?
20:33
SPEAKER_04: And like that already is in is immediately emerging for me as like a key element of this episode, right?
20:41
SPEAKER_04: Because like we we understand what the problem was.
20:43
SPEAKER_04: The problem is whoever this network, whoever this network, whose ever network this was, what was the way to say that?
20:50
SPEAKER_04: How do you possess a network?
20:52
SPEAKER_04: Whosever network this was, I think that's the right way to say it.
20:55
SPEAKER_04: Like, that's a bad day.
20:57
SPEAKER_04: 27 seconds, someone clicked something, tacker got on there, moved to the next, moved to the next endpoint.
21:02
SPEAKER_04: But the thing is, like, immediately like the brain starts to work on solving the problem.
21:06
SPEAKER_04: How do I solve that problem?
21:08
SPEAKER_04: And you talk hygiene, right?
21:10
SPEAKER_04: So there's a ton that goes into that.
21:11
SPEAKER_04: And then you follow this up with governance, which is also the right way to think about this.
21:15
SPEAKER_04: Are the proper, are the built-in accounts disabled?
21:18
SPEAKER_04: Hygiene.
21:19
SPEAKER_04: Are the are the are the domain admin accounts separated?
21:23
SPEAKER_04: Do you have access segmentation implemented so that someone can't pivot, you know, based on just logical separation and how access is provisioned?
21:31
SPEAKER_04: Hygiene.
21:32
SPEAKER_04: Are you making sure that accounts are being rotated, that KRBTGT passwords are being rotated?
21:38
SPEAKER_04: Like all the little tricks that come with maintaining hygiene and then doing that over time, which is that governance element.
21:44
SPEAKER_04: Like these are the things that are easy to overlook because every day it's a new thing, right?
21:49
SPEAKER_04: Oh, I gotta make sure this, I've got to implement this, I gotta finish this POC, like whatever's on the on the plate for the day.
21:55
SPEAKER_04: But going back and making sure that your house is clean and that you're key.
22:00
SPEAKER_04: Keeping it clean is unbelievably understated, I think, in today's in today's modern works.
22:05
SPEAKER_03: There was a there's a colleague of mine, uh, he's uh uh ethical hacker.
22:11
SPEAKER_03: Um and and when I was getting on board with this whole with with technology as a technology director, uh I I kept asking him qu I know he got tired of me asking him so many questions.
22:24
SPEAKER_03: But he said something to me that that has stuck with me, and I'm sure you guys have heard it plenty of times, but he said, a threat actor will follow the path of least resistance every single time.
22:39
SPEAKER_03: So, you know, where it is where you're focusing so much on chasing the obscure, they're going for the obvious things.
22:49
SPEAKER_03: Right.
22:49
SPEAKER_03: You know, and sometimes, you know, you'll you know, we'll go to conferences or you know, we'll go to meetings and we'll have all these conversations of things that are happening out there, and we're all talking about the obscure things that are happening.
23:01
SPEAKER_03: But then we go back to talking about just the basic things, you know.
23:05
SPEAKER_03: So it's almost like we have, you know, I think an organization can fall into the trap of like putting the controls in place, but then are you testing are you testing them often?
23:17
SPEAKER_03: Are you making sure that they're still staying up to speed, you know, because change happens constantly.
23:24
SPEAKER_03: So, so you know, that's that's how I approach it is the obscure is gonna be out there, but you know, there's only so much time in a day.
23:34
SPEAKER_03: Let me be good at these things right here.
23:37
SPEAKER_03: And it's gonna be the I I tell it's the group one controls.
23:40
SPEAKER_03: If I'm gonna preach, it's gonna be about those things right there.
23:43
SPEAKER_04: I love where your head is at.
23:45
SPEAKER_04: And honestly, if this whole like education thing doesn't work out, you're gonna talk to us at Talas, right?
23:50
SPEAKER_04: Because you're thinking about this stuff the right way.
23:52
SPEAKER_04: Like this is like the things you're saying are things that we've been saying forever.
23:56
SPEAKER_04: And like one of the things I I say, I may have said it on another episode, but guess what, listener?
24:00
SPEAKER_04: I'm gonna say it again.
24:01
SPEAKER_04: Um, is that you know, we we tell our clients, and it's not like I when I say this, I kind of get eye rolls or or in some cases like weird looks.
24:10
SPEAKER_04: But I say, listen, like, you don't want to have the most defended network.
24:15
SPEAKER_04: You don't want it to be perfect, or you don't need to spend time making it 100%.
24:19
SPEAKER_04: You need to make it annoying enough that the attacker is going to move on, right?
24:23
SPEAKER_04: And like this plays into that concept you're just talking about, which is this path of least resistance, right?
24:28
SPEAKER_04: Now, if we bring this back to the statistic, there was no resistance.
24:32
SPEAKER_04: 27 seconds is like push a button and go, right?
24:35
SPEAKER_04: There's clearly some automation there.
24:37
SPEAKER_04: Like things were every every domino was in place, but like, you know, to your point, like an attacker is going to find what is that next thing that they can hop to simply.
24:47
SPEAKER_04: And if you can put the proper layers of control in place, right?
24:50
SPEAKER_04: If you can set up defense in depth so that if one thing fails, the next thing backs it up.
24:55
SPEAKER_04: And if that thing fails, the next thing backs it up, eventually the attackers, at least the vast majority of commodity attacks, are gonna move on.
25:02
SPEAKER_04: They're gonna move on.
25:03
SPEAKER_04: And that's the goal is get them to move on, right?
25:06
SPEAKER_04: Find an easier target, find that computer they're gonna hit and be able to move into the next thing in 27 seconds.
25:12
SPEAKER_04: Um, and again, like I say that and I get like weird looks, but honestly, that that truly is the tactic for the map vast majority of businesses that are out there.
25:20
SPEAKER_03: That's correct.
25:20
SPEAKER_03: That is correct.
25:21
SPEAKER_03: And I think, you know, I I'll say probably the thing that has paid the most dividends for us.
25:28
SPEAKER_03: And you know, it's one of those things that you read about and you hear about, but until you implement it with fidelity, you don't see it.
25:36
SPEAKER_03: But it's uh security awareness training for our folks.
25:40
SPEAKER_03: I think they have you know, we have some uh we have some email filtering solutions in place, but even the things that get past that, the fact that they are more aware of what to look for, and they'll come up to me and be like, this this doesn't look right, you know.
26:00
SPEAKER_03: Um, and and then I'll do my own investigations and find out you're right, it's not any web it it got past our filter, like you know.
26:08
SPEAKER_03: So I I would say for an organization, you know, it train train your folks.
26:16
SPEAKER_03: I mean, absolutely train them.
26:18
SPEAKER_03: They they are they can be uh I won't say this.
26:23
SPEAKER_03: Uh then we'll have to edit this.
26:25
SPEAKER_03: They will they will they are uh the ones that are trained properly are the ones that are definitely gonna be very resourceful because they're gonna keep their eyes open on things that come through.
26:37
SPEAKER_03: They may not even click on some of the stuff you send them.
26:40
SPEAKER_03: So, you know, they become very vigilant about it.
26:42
SPEAKER_03: They'll click that link to that calendar because it I I don't know, Mr.
26:46
SPEAKER_03: You know, Mr.
26:47
SPEAKER_03: G.
26:48
SPEAKER_04: That's that's right.
26:50
SPEAKER_04: That's right.
26:50
SPEAKER_04: And look, I I think everyone knows, like, especially now, in fact, I think we're in the middle of of experiencing a shift.
26:57
SPEAKER_04: Like, the end users are the target, right?
26:59
SPEAKER_04: Like the end users are the target.
27:01
SPEAKER_04: They like there's a reason why phishing keeps topping the charts.
27:04
SPEAKER_04: Now, the reason I said that we're experiencing a shift is because with the AI agents you were talking about, with like the advent of, you know, kind of like the automation of intelligent automated pen testing, right?
27:17
SPEAKER_04: Like, I think there's a new resurgent that's targeting vulnerabilities.
27:21
SPEAKER_04: Like that's my prediction.
27:22
SPEAKER_04: I don't think it's happened yet, but like we've already seen in the last year, we've seen massive increase in zero-day vulnerabilities being detected by some of these front, you know, frontier models that are doing that review.
27:34
SPEAKER_04: We're seeing the automation of what's out there, the commodity automation of things and the intelligence behind it to try this, then that, then this, and modify this and modify that, as opposed to just a dumb script.
27:47
SPEAKER_04: So I think that even though today users are definitely the target, we're gonna start to see that shift into kind of the the space of the AI-enabled attacks and and targeting vulnerabilities.
28:00
SPEAKER_03: Yeah.
28:00
SPEAKER_03: And then based on what I've I've been reading out there, I think uh, you know, even some of the situations that we've read about uh AI getting out of its own containers and and doing whatnot in a controlled environment, you know, it I keep thinking, I'm like, man, if it's if that capability is there already, you know, when it gets into the hand of the wrong person and they can just automate it, turn it into a service, you know, that's gonna be catastrophic.
28:29
SPEAKER_03: But I I will also say that should cause organizations to really start looking at their posture, just their basic postures to be ready for these things.
28:42
SPEAKER_03: Because I think that's gonna be the key thing.
28:45
SPEAKER_03: Yes, you're gonna have people calling you left and right, offering solutions, and and some of them will be will be right for some of those organizations, but I'll I'll say it, you know, a lot of times before I bring a tool into the fold, I'll look at where we stand so far with all our other controls.
29:05
SPEAKER_03: So I I think it's gonna I think it's gonna you're right, it's gonna shift the culture for everyone when you start seeing more uh AI led uh attacks.
29:18
SPEAKER_03: I think you're gonna have to really start looking at your own posture and saying, well, are we doing all these other things before we start saying yes to these tools?
29:27
SPEAKER_03: You know, are we patching our stuff consistently?
29:30
SPEAKER_03: That's that's a basic one.
29:32
SPEAKER_03: You know, are we making sure that we're disabling accounts for users that are no longer here?
29:36
SPEAKER_03: You know, that type of stuff.
29:38
SPEAKER_03: It's like, you know, do we need to have these systems in place to ensure that those are not, you know, vectors into the network, you know?
29:47
SPEAKER_03: So yeah.
29:49
SPEAKER_00: I think one of the final topics, I think, at least for me on this one is it's super interesting what you just talked about, right?
29:54
SPEAKER_00: Is it's extremely difficult for the humans to maintain the speed and accuracy of our controls, right?
30:01
SPEAKER_00: And then throw on top of that the attacker speed.
30:04
SPEAKER_00: So I think, Albert, you're right, right?
30:05
SPEAKER_00: Where where do we actually get control?
30:07
SPEAKER_00: Is it slowing down in these instances?
30:09
SPEAKER_00: And we've talked about this in the past, but truly know your inventory, right?
30:13
SPEAKER_00: Truly know how to control those things, truly have your channels or your ports open in which they should be.
30:17
SPEAKER_00: But that's where as long as you have your baseline or your foundation really well documented and visually understood, that's when you can start to identify this fast movement or these outlayers, right?
30:29
SPEAKER_00: And deviate that.
30:30
SPEAKER_00: I think it's I think it's when everything you've been talking about on this episode so far, Albert, is if you don't have your house in order or you know all of at least the assets and the controls that you have at your disposal, that's where this becomes so untenable, right?
30:46
SPEAKER_00: That's where 27 seconds now be might as well just be zero seconds because you're just gonna be going down this rabbit hole in which you don't know where to look, right?
30:54
SPEAKER_00: And that's what I think the attackers want.
30:55
SPEAKER_00: They want you to be thrown into this kind of chaotic scenario where you're just doing whack-a-mole.
31:02
SPEAKER_00: That's what they hope you do.
31:04
unknown: Right.
31:06
SPEAKER_00: Right?
31:06
unknown: Correct.
31:08
SPEAKER_03: Yeah, because you gotta think they're they're looking, they're looking into they're looking into one way into your organization.
31:16
SPEAKER_03: And so that that means that we would have had to spend a lot of time already securing the entire perimeter.
31:25
SPEAKER_03: You know, they're looking for one path in.
31:28
SPEAKER_03: You are in charge of defending the entire perimeter, that is every single entry point.
31:36
SPEAKER_03: Sorry, Albert.
31:38
SPEAKER_04: Now I think now I think you're hacking my stuff here because you keep bringing up these points I've said before.
31:42
SPEAKER_04: Like, you read my email, man, like what's going on here?
31:44
SPEAKER_04: Like, get me fired up.
31:46
SPEAKER_03: Like I said, I mean, it's just one of those things, you know.
31:48
SPEAKER_03: I kept asking questions, like, what does the job entail now?
31:51
SPEAKER_03: Like, you know, they're looking for one way in.
31:54
SPEAKER_03: You're looking at every single thing.
31:56
SPEAKER_03: So look, here's here's a good example uh of changes that we brought in early on when I got here.
32:04
SPEAKER_03: Uh, the way we purchased devices, you know, it used to be that devices would be purchased, they would arrive at one of our locations, and hopefully somebody would have it configured properly before it hit the network.
32:19
SPEAKER_03: Well, within hopefully, right?
32:22
SPEAKER_03: Hopefully.
32:22
SPEAKER_03: That's the strategy.
32:23
SPEAKER_04: Okay.
32:24
SPEAKER_03: So within a month of just sort of investigating how things are done and working with people, you know, I said, hey, let's come up with a new solution.
32:32
SPEAKER_03: Ship them to this office, we'll configure it, and then we'll send it out.
32:38
SPEAKER_03: You know, so that's again thinking holistically about the entire network.
32:44
SPEAKER_03: I mean, you're gonna have to shift things around.
32:47
SPEAKER_03: You know, it seems insignificant, you know, uh to some people, but from the from this seat, I'm looking at everything.
32:55
SPEAKER_03: It's I'm looking at that's a that's an entry point that we never got to touch, and it's going to join the network eventually.
33:05
SPEAKER_03: So you're constantly thinking that I have to defend every single thing.
33:10
SPEAKER_03: So, what are all the processes from the other departments that I need to integrate myself in, you know?
33:16
SPEAKER_04: Albert, you got me fired up.
33:18
SPEAKER_04: We're gonna probably make this like a four-part series because like we're gonna talk.
33:21
SPEAKER_04: I think we're gonna keep talking for a couple hours here.
33:23
SPEAKER_04: Um, no, but look, uh honestly, like I this is this is where I think like we we you've said a bunch of profound things.
33:30
SPEAKER_04: And the thing is, like, for those listening, like this is it.
33:34
SPEAKER_04: Like, like the things he's saying is this is where this is where it starts, right?
33:39
SPEAKER_04: Like, focus, like the basics.
33:42
SPEAKER_04: Like, you know, don't worry about the$150,000 product that just came out that everyone is clamoring to get.
33:49
SPEAKER_04: Like, take care of your hygiene.
33:51
SPEAKER_04: Like, make sure things are right, like make sure things are clean.
33:54
SPEAKER_04: So listen, let's let's let's take a second, let's like recover here, let's regroup and and let's what are the final thoughts here?
34:01
SPEAKER_04: Like, if we're if we're recapping this this episode, like oh and Albert, like what are the things you're leaving with?
34:08
SPEAKER_04: What are your perspective shifts?
34:09
SPEAKER_04: Like, what do you want the listeners to to kind of take from this?
34:14
SPEAKER_03: Man, I think I'm gonna go back to to what I've been saying.
34:18
SPEAKER_03: Fo focus on the on the on the practical, everyday processes that make the business run and and get good about keeping those things clean.
34:28
SPEAKER_03: Um don't don't spend so much time on the obscure.
34:34
SPEAKER_03: Look at your uh look at your basic things all around you.
34:37
SPEAKER_03: I mean the the way I see it is if an an auditor was to walk in into my room and say, hey, can we can we test this, you know, group one controller?
34:47
SPEAKER_03: You know, that I think about it that way.
34:49
SPEAKER_03: You know, is that it will that be, you know, will they show up correct?
34:53
SPEAKER_03: So that's that's what I would say.
34:56
SPEAKER_03: And I think that's the that's what's gonna slow down that 27 seconds to hopefully make it an hour for them, you know.
35:03
SPEAKER_04: Yeah, there you go.
35:04
SPEAKER_04: Right.
35:04
SPEAKER_04: Push them back just so you can get some time to review the alerts, right?
35:06
SPEAKER_04: Yeah, exactly.
35:08
SPEAKER_04: Yeah, I think I think for me, like reflecting on this episode, it it actually is kind of poetic, right?
35:15
SPEAKER_04: Like, you know, talesecurity, we we pride ourselves on trying to make things as simple as possible.
35:20
SPEAKER_04: I mean, it's in our mission, right?
35:21
SPEAKER_04: Simplify, organized, and strengthen cybersecurity.
35:24
SPEAKER_04: Like those are the words that we live and die by every single day.
35:27
SPEAKER_04: And I think like what really has resonated with me in this episode in this discussion is this concept of simplicity.
35:35
SPEAKER_04: It doesn't have to be crazy, doesn't have to be exciting, doesn't have to be the most cutting edge.
35:41
SPEAKER_04: Basics.
35:41
SPEAKER_04: Stick to the basics.
35:43
SPEAKER_04: Make sure that you have hygiene, make sure that you're turning things off that you don't need, make sure you understand the the assets you have on the network.
35:51
SPEAKER_04: Make sure that you can you can maintain that information through simple things like governance.
35:56
SPEAKER_04: Like for me, this is kind of this this call back to keep it simple.
36:03
SPEAKER_02: Keep it simple and focus on just the things that you can control and know about today.
36:12
SPEAKER_00: No, for sure.
36:12
SPEAKER_00: Yeah, I think I think the one thing for me um is Albert, you kind of you kind of bounced around these topics, but I think right, slow down and truly just know who you are and what you have, right?
36:26
SPEAKER_00: And like you were saying before, try not to define everything, but at least define a certain percentage of what you have in terms of capability and what you have in terms of your network assets, right?
36:36
SPEAKER_00: From a business usage perspective.
36:38
SPEAKER_00: And then at least have that really well known and understood by your cyber uh team, right?
36:44
SPEAKER_00: That way we can start to minimize where we're going to look.
36:48
SPEAKER_00: Um, again, I'm not trying to stay speeds for speed with the attackers.
36:52
SPEAKER_00: What I want to know is I hope to know my network better than they articulate their network once they learn it, right?
36:58
SPEAKER_00: Um, so that that's that's hopefully the goal.
37:00
SPEAKER_00: I think that's where we have some ownership.
37:01
SPEAKER_00: Um, but lastly, is let's not be afraid of the speed, right?
37:06
SPEAKER_00: I think that's how we can kind of get scared and fear-mongered.
37:09
SPEAKER_00: Um, but let's bring it back to the things that we can control and kind of operate at our own speed.
37:14
SPEAKER_00: Absolutely.
37:15
SPEAKER_04: Gentlemen, this was an awesome, awesome episode.
37:18
SPEAKER_04: I'm reeling.
37:19
SPEAKER_04: There's like stuff I didn't get to.
37:20
SPEAKER_04: I have notes in front of me.
37:21
SPEAKER_04: I didn't get to like go back and talk about.
37:23
SPEAKER_00: So we'll I've got one major note, Paul.
37:25
SPEAKER_00: What?
37:26
SPEAKER_00: And Albert, next time you come back on, I think we're really going to push ourselves here.
37:29
SPEAKER_00: We're going to get through more than one topic, one of these episodes, I promise.
37:34
SPEAKER_04: I'm going to put I'm going to put that in my goals for 2027, right?
37:38
SPEAKER_04: Can we not lean into just one?
37:40
SPEAKER_04: Owen has been dying to get to like two and three cards, and I keep messing it up.
37:44
SPEAKER_04: I keep like digging into these things.
37:46
SPEAKER_04: I can't turn my brain off.
37:48
SPEAKER_04: But this is long form.
37:51
SPEAKER_03: Let's do the let's do the Joe Rogan long form here.
37:53
SPEAKER_03: Let's do the three-hour podcast.
37:55
SPEAKER_04: Yeah, only if we can come to Mississippi and sit in that fancy room with you, all right?
38:01
SPEAKER_04: Exactly.
38:02
SPEAKER_04: Amazing.
38:02
SPEAKER_04: Well, listen, gentlemen, this has been an incredible time.
38:05
SPEAKER_04: Albert, thank you so much for taking the time to chat with us.
38:07
SPEAKER_04: We really appreciate it.
38:08
SPEAKER_03: Absolutely, man.
38:09
SPEAKER_03: I appreciate y'all.
38:10
SPEAKER_03: Thank you.
38:11
SPEAKER_04: Thank you.
38:12
SPEAKER_04: All right.
38:12
SPEAKER_04: Listeners, be well.
38:13
SPEAKER_04: Stay safe.
38:14
SPEAKER_04: We will talk to y'all soon.
38:15
SPEAKER_04: Take care.
38:16
SPEAKER_03: Bye bye.