Latest / Privacy Please / S6, E248 - Inside the Walls: Military's Stark Warning on Network Compromise

Transcript

S6, E248 - Inside the Walls: Military's Stark Warning on Network Compromise · Privacy Please

• 0:00
  Speaker 1: Alrighty then, ladies and gentlemen, welcome back to another episode of Privacy, please.
• 0:04
  Speaker 1: I'm Cameron Ivey, alongside Gabe Gumbs.
• 0:07
  Speaker 1: How you doing, gabe, how we doing.
• 0:09
  Speaker 2: I am good, I'm good, we are dead.
• 0:12
  Speaker 2: In the middle of it.
• 0:13
  Speaker 2: It's a couple of weeks before Black Hat and DEF CON, gearing up for that summer festival.
• 0:20
  Speaker 2: Yeah, hacker Summer Camp, hacker Summer Camp when's that?
• 0:34
  Speaker 2: Again, that's coming up um august, august.
• 0:35
  Speaker 2: So black, uh, defcon's august 7th starts at august 7th, but there's a bunch of things going on, right.
• 0:37
  Speaker 2: So you've got b-sides which starts the weekend prior, right, black hat, which I think, kicks off on the 5th.
• 0:43
  Speaker 2: I could be wrong about Black Hat, I don't remember, but DEF CON starts on the 7th.
• 0:50
  Speaker 1: I was pretty excited and I haven't been.
• 0:51
  Speaker 1: I don't think I've been to Black Hat one time, but I haven't been to any of those in a couple years now.
• 1:00
  Speaker 2: Yeah, something about not going to the desert in the middle of summer.
• 1:03
  Speaker 2: That's okay with me quite frequently, it's okay.
• 1:10
  Speaker 2: It's okay.
• 1:11
  Speaker 2: It's okay to miss one once in a while, Although it's a great time.
• 1:14
  Speaker 2: It's an awesome time.
• 1:15
  Speaker 2: I'm always good to catch up with friends and, you know, make some new ones in the security community.
• 1:20
  Speaker 2: It's always some amazing talks on display.
• 1:23
  Speaker 2: It's always a good time.
• 1:24
  Speaker 2: No complaints, except for the weather.
• 1:26
  Speaker 2: The weather be.
• 1:26
  Speaker 2: The complaint.
• 1:27
  Speaker 2: 120 night is.
• 1:29
  Speaker 2: We're not built for that as humans, quite frankly.
• 1:33
  Speaker 1: No, that sounds super uncomfortable.
• 1:35
  Speaker 2: Yes.
• 1:36
  Speaker 1: I was driving the other day I saw this guy on a scooter with like a black sweater hood, on jeans, walking in the middle of the day almost 100 degrees.
• 1:46
  Speaker 1: I'm just like I don't how, why, what are you?
• 1:49
  Speaker 1: What's?
• 1:50
  Speaker 2: happening Across the street.
• 1:51
  Speaker 2: Man Across the street Sounds like a Luigi's scenario, like I wouldn't be worried unless I'm the CEO of a large healthcare company, is it?
• 1:59
  Speaker 2: I don't know, we may have just lost a couple of subscribers on that one.
• 2:03
  Speaker 1: No, no, we got this.
• 2:04
  Speaker 1: So, gabe, I'm going to paint a picture for you and for, obviously, the audience, on what we're going to go into talking about today.
• 2:10
  Speaker 1: So imagine you're in charge of defending a fortress.
• 2:12
  Speaker 1: For years, you focused on strengthening the walls, locking the gates and watching the perimeter.
• 2:17
  Speaker 1: Then, one day, a stunning order comes down from the top.
• 2:20
  Speaker 1: Stop worrying about the walls.
• 2:22
  Speaker 1: Assume the enemy is already inside with you.
• 2:26
  Speaker 1: It's pretty powerful.
• 2:27
  Speaker 1: Yeah, there was a stark you pulled me into this about a stark warning that the issue to all US forces to operate under the assumption that their networks have been compromised.
• 2:38
  Speaker 1: Let's dig into this.
• 2:40
  Speaker 2: So one of the more interesting things about that statement, of course, is and we've talked about it, I think, on this show more than a few times operating under the assumption of compromise.
• 2:49
  Speaker 2: In fact, right before this, right before we hit the record button, we were talking about the last time I gave a public talk, and it literally just reminds me the title of that talk was the bust out the old deck, and maybe we'll link it to this episode, but it was around the very notion of how we adopt the NIS zero trust principles, because the NIS zero trust principles literally begin with the assumption of compromise, and so, in one breath, they're not saying anything that you shouldn't be doing or they shouldn't have already been doing from an operational standpoint, but what they're actually saying here is no, no, no, no, no.
• 3:26
  Speaker 2: This is not a drill.
• 3:27
  Speaker 2: This is not a drill.
• 3:29
  Speaker 2: Assume that this network is freaking compromised that's a big deal.
• 3:37
  Speaker 1: And what were your first thoughts, besides just saying, oh shit, like what, like this is a big deal.
• 3:43
  Speaker 2: You can't shut the barn doors is the first thing that came to mind.
• 3:46
  Speaker 2: Like I do not know if you can uncompromise a network.
• 3:50
  Speaker 2: The thing with the assumption of compromise is you should assume that you also can't uncompromise the network.
• 3:55
  Speaker 2: So in one breath it will certainly accelerate the adoption of zero trust within critical infrastructure.
• 4:02
  Speaker 2: So that's a positive.
• 4:04
  Speaker 2: But the thing that worries me there, of course, is well, the networks should just be considered actually compromised.
• 4:12
  Speaker 1: Right, okay, so real quickly.
• 4:13
  Speaker 1: Most of our listeners should probably know this, but let's just play the fun role of Gabe.
• 4:20
  Speaker 1: What is zero trust and why is it the recommended solution that it's going to fall into?
• 4:25
  Speaker 2: It's a framework.
• 4:26
  Speaker 2: So, first and foremost, it is not something that is purely tangible.
• 4:31
  Speaker 2: It is not any one singular product.
• 4:34
  Speaker 2: So if anyone told you they have a zero trust that you can buy, be wary.
• 4:37
  Speaker 2: We warned you, we warned you, we warned you.
• 4:41
  Speaker 2: It is a framework under which one of the first, not one of, but the first tenant of zero trust is that network should be treated as though they already compromised.
• 4:49
  Speaker 2: And when you do so, it means that you need to do things like validate access upon every request.
• 4:56
  Speaker 2: So not just grant access and then allow access to always be given upon every request for an asset, revalidate access.
• 5:07
  Speaker 2: That's just one of the many things that zero trust encompasses.
• 5:10
  Speaker 2: It is a NIST framework, it is published by NIST I don't remember the number, unfortunately.
• 5:14
  Speaker 2: I guess I'm not that big of a zero trust geek.
• 5:18
  Speaker 1: Hey that's all right, that's all right, you don't know everything.
• 5:21
  Speaker 2: I could probably quickly look it up but it is a framework, and so a lot of vendors selling different security solutions will kind of operate under this banner that their technology will assist you in doing so.
• 5:32
  Speaker 2: That is a good thing.
• 5:35
  Speaker 2: Quite frankly, it's difficult to achieve zero trust without some help in some of those environments.
• 5:44
  Speaker 2: But again, the warning be there is no silver bullet for zero trust.
• 5:48
  Speaker 2: And it is not just technology, it is also protocols and procedures.
• 5:54
  Speaker 2: Right, there's quite a bit more to it.
• 5:58
  Speaker 1: Can you humor me a little bit on this?
• 6:00
  Speaker 1: The sophistication and patience of Salt Typhoon.
• 6:03
  Speaker 1: What exactly is that?
• 6:05
  Speaker 2: Salt Typhoon is a threat actor believed to be tied to the Chinese government.
• 6:11
  Speaker 2: That is, the threat actor believed responsible behind this breach of the network.
• 6:18
  Speaker 1: Well, they're a well-sourced cyber espionage group with links to the Chinese state.
• 6:22
  Speaker 1: Yeah, their ability to remain in a network for almost a year without detection points to a high level of sophistication and patience.
• 6:31
  Speaker 2: Hence the reason I don't know that one can ever trust that network ever again.
• 6:34
  Speaker 2: A year is a long time to bury yourself in.
• 6:40
  Speaker 1: Yeah, I mean.
• 6:41
  Speaker 1: Obviously the biggest worry is their focus on stealing data that can be used for future, potentially more damaging attacks on critical national infrastructure.
• 6:50
  Speaker 1: Yeah, yeah, it's not good.
• 6:54
  Speaker 2: No, it's not good.
• 6:55
  Speaker 2: It's not good, it's not good at all Not good.
• 6:57
  Speaker 1: So what's being done?
• 6:58
  Speaker 1: What do you know that's being done so far?
• 7:00
  Speaker 1: What do you think the this warning?
• 7:02
  Speaker 2: being issued.
• 7:02
  Speaker 2: I don't know of anything being done.
• 7:03
  Speaker 2: Well, like, who would handle this?
• 7:05
  Speaker 2: Do you think the this warning being issued?
• 7:06
  Speaker 2: I don't know of anything being that well, like, who, like, who would handle this, you think?
• 7:08
  Speaker 2: Like?
• 7:08
  Speaker 2: That's also a great question, you know.
• 7:08
  Speaker 2: I'm honestly not certain I know the answer to that, but we've got some foods in the intelligence community.
• 7:13
  Speaker 2: We should probably snag on the show to talk about that.
• 7:15
  Speaker 2: Um, I don't know who picks up the ball from there.
• 7:18
  Speaker 2: Really, I could I could throw out all kinds of wild guesses, but they, they might just be that are wild guesses.
• 7:23
  Speaker 2: Yeah, I don't actually know.
• 7:25
  Speaker 2: I know this much, though, that we should all certainly heed that warning and operate under the same tenets though, yeah, which I guess is just a long-winded way of saying hello, everybody, wake up Please.
• 7:37
  Speaker 2: If you haven't already started adopting zero trust, do so.
• 7:39
  Speaker 2: Do so now.
• 7:40
  Speaker 2: Everyone should adopt?
• 7:46
  Speaker 1: Yeah, because to that point there's broader implications that go beyond national security and privacy.
• 7:48
  Speaker 1: So beyond military networks, salt typhoon.
• 7:51
  Speaker 1: Also targeted telecommunication yeah, just like at&t, verizon all compromised record like basically been accused of at&t and verizon was accused of recording private conversations of senior US political figures.
• 8:09
  Speaker 1: There you go they.
• 8:13
  Speaker 1: Targeted critical infrastructure like energy and transportation highlights the potential of widespread, so probably stuff like Uber, I would imagine.
• 8:21
  Speaker 2: Yeah.
• 8:23
  Speaker 1: And Lyft and all those type of.
• 8:24
  Speaker 1: There's so much information on that, so this is really big and it's it's saying that this is also a pattern, gabe, this is not just a one off of that.
• 8:45
  Speaker 2: No, not at all, and it will continue to be.
• 8:46
  Speaker 1: You know, cyber warfare is the new warfare.
• 8:47
  Speaker 1: Yes, conventional warfare still exists, but it is the new war, yeah.
• 8:49
  Speaker 1: So yeah, this is super interesting, but maybe we'll dig into this a little bit later.
• 8:52
  Speaker 1: If anybody has any questions or knows more about this stuff, we'd love to have you on or just shoot us a message.
• 8:59
  Speaker 1: But yeah, we'll see you guys next week.
• 9:00
  Speaker 1: Gabe, thanks for the chat Right on, right on Next week.
• 9:03
  Speaker 1: It is Sounds good.
• 9:04
  Speaker 1: See you guys.