Latest / The HIDDEN Podcast by Babble / Episode 7: Who’s Watching the Phones and Laptops?
Transcript
- Lynn Murape: Joining me in the virtual studio today is Callum Archer. Thanks for being here, Callum. Welcome to the HIDDEN™ Podcast, where we simplify cyber security and all things tech for those of you who, like need it to be explained without all the So if you've ever wondered why you still feel vulnerable even though you've bought all the fancy tools, come to the right place. ⁓ your host, Lynn Murape and job is to take one of our resident experts and help them translate their cyber expertise into plain This means having practical conversations That's a wrap on today's episode of the HIDDEN™ podcast. If this episode gave you an aha moment that helped you untangle something that's been bugging you, subscribe and share it with a friend who's in the same boat. And if you're wondering where you stand across the six HIDDEN™ layers, our cyber security snapshot in the description below. a lot less painful than a breach. Until next time, don't let your risks stay HIDDEN™. Callum: Yeah, no problem. Lynn Murape: Awesome. So before we dive in, do you mind telling our friends listening or watching out there a little bit about yourself in terms of what you do and where you live? Callum: Yep, so I live in Reading in the UK. I'm the Solution Lead for Cyber Security at Babble. So my main role and responsibility is to support our and customers with their cyber security journey, making sure they've got all the tools, all the information they need to stay safe out Lynn Murape: usually built around Babble's HIDDEN™ cyber security framework, which we break down in the show. Or sometimes we'll take a hot topic in the tech industry, like a major breach or a new legislation, and we'll explain how we help you stay ahead. Basically, this podcast exists so that you can sleep well at night, preferably not during the podcast. Awesome. And what would you say you like most about what you do? Callum: I really like solving problems. A lot of the times customers come to us knowing what to do, what to talk about and I love the of supporting customers and ⁓ helping feel secure in whatever it is that they do. ⁓ Lynn Murape: Nice, making you one of the most perfect guests for this episode. So without further ado, today we're unpacking the two part question, which is how quickly would you know if a device was compromised and more importantly, how would you act? So diving right in, Callum, why are endpoints still one of the most targeted attack surfaces? Callum: Yeah, I think it's a great question. would have to say from my perspective, endpoints or laptops, tablets and devices ⁓ never been used more. ⁓ living in an ⁓ digital world and ⁓ way that people work, they travel all over the world and they've never had more devices. ⁓ allows ⁓ to work freely, ⁓ wherever they want, but also creates a number of security challenges. I for me, endpoints have always been particularly targeted because there are so many of them and you know with cyber security it's a numbers game. attackers or adversaries are looking for an entry point you know an organisation there might be over a hundred, hundred and fifty, two hundred different little key holes for to try and break into and when we look under the hood ⁓ why from a technical perspective this still an issue. ⁓ Within our SMB customers, we still see massive and inconsistencies in between the policies and practices in play, and also, importantly, some of the vulnerabilities that are on these devices. I still see examples of, unpatched or out-of-date operating We still see security policies not lining with... ⁓ what corporate or kind of, you know, head of companies are wanting to achieve. And ⁓ if, let's say, of our customers did have best in class software, robust security policies, ⁓ one of major challenges I see is what I would call alert fatigue. So ⁓ often our are reliant on, ⁓ one person ⁓ keeping lights on, keeping up with innovation, making sure that... their internal customers in the day-to-day users are able to access what they work. And oftentimes, we see... massive examples of what I would call alert fatigue where if I've got 500 600 alerts to look at on top of my day job how am I supposed to prioritise and know what's real and what is going to be the biggest threat to my business? So, yeah in summary you know endpoint security is still absolutely at the forefront of what our customers should care about you know and I think there's a long way for us to go collectively to keep secure. Lynn Murape: Thanks for sharing, Callum. That really sets the tone and basically highlights the importance of having this conversation in the first place. So, you know, you had touched on the sentiment around these known exploits remaining open for months in a lot these environments. So what happens when an endpoint ⁓ remains vulnerable or undetected? Callum: Yeah, I think this is a massive challenge that we're seeing and actually you look into the recently, I think touching some the kind scariest and exploits that we've Claude have really taken the and Anthropic into ⁓ highlighting some potential massive issues unpatched devices and known vulnerabilities. AI is really this problem and if we... collectively don't get ahead of this, could see ⁓ real world scenarios where overnight there's 150 vulnerabilities that we didn't know about that have now all been exploited and ⁓ critical infrastructure to down, for schools to be able to teach children, and for SMBs not to operate. So, getting ahead of these exploits is massively critical to on the front foot in cyber security and to increase your posture. ⁓ So I you know, in the modern day, it's really a two-pronged approach really. I think ⁓ first all, practical steps that you can implement is increased monitoring and visibility. So, you ⁓ correlating of your data and telemetry around your environment into a single source, a security, incident management tool. of the major ones we work with internally with our customers is Microsoft Sentinel. And really allows you to have a source of truth for what's going on in your environment. And with the right resource and ⁓ specialised expertise, allows you really aggregate that data and get the most out of it. To make sure that there are those alerts that you don't know about, there are those known kind of exploits, you can kind of try to stay on the front foot with it. Secondly, I think let's start with what you do know. If there is patches that you know need to be done or you are self aware that you're not 100%, taking practical steps, investing in getting those patches up and really tightening the screws on your infrastructure is probably something that I'd recommend while we detect that. Lynn Murape: Yeah. Love that great tips shared and I appreciated that mention of Anthropic, more specifically Claude as well it reminded me of a previous conversation I had with Mark O'Dell and James Gaskell in episodes around scattershot attacks and just how AI is automating these cyber threats well so that was great to note. And also that last point that you mentioned particularly around Microsoft Sentinel could- I'm assuming, correct me if I'm wrong, be a nice workaround to just start to target that alert fatigue for those businesses that don't necessarily have a fully-fledged IT team. Yeah, awesome. right. So, Callum, what is lateral movement and how does it happen ⁓ a device has been compromised? Callum: Yeah, absolutely. Yeah, that's a great question. So I think for me in cyber security terms, lateral movement is when an adversary will move from one part of your environment to another. So some real world examples of what that means if we're sticking with the endpoint theme is, let's say an adversary is on my laptop. What they'll look to do next is move to something like your 365 environment to try and provide better access to get what they're after. It might be that they're moving onto a secondary endpoint that they're going to try and get as many of your endpoints under their control. to shut them down as possible. It might be that they're going to try and move on to your email platforms to send, you know, internal communications to try and get access. from someone more senior or with better access in your environment. So, a massive, massive problem. And I think for me, what happens when in to stop containment, is speed. You to quickly be able to detect and ⁓ isolate ⁓ where the adversary has come in from to, limit damage. It's almost like putting a force field around them, right? So, they've into your house, but they can't move. They're stuck where they are. And then from there, it's really about damage containment. Lynn Murape: Okay, thanks for clearing that up. So gears now to, antivirus versus modern endpoint response. Many businesses still think that equals protection. why is that misconception now outdated? Callum: Yeah, it's a really good question. I was speaking to a customer yesterday around this very topic. Antivirus was the answer to the great question of security in 2016, 2017, 2018. The way that these traditional tools work is they have a list of what is good and they have a list of what is bad. And that is how they are architecturally blocking threats. So, this is great and was great when we could keep up with the amount of attacks. But where we started to see issues with this is when adversaries became more advanced. it's actually moved forward a couple of steps even since then. And we're seeing ⁓ intelligence really accelerate the need for change in this space. But us, for a few years now, traditional antivirus hasn't been enough because the change in attacks. We've seen an ⁓ rise ransomware or malware free attacks where we're looking at behaviour, impersonation attacks to break in. ⁓ if someone is just pretending to be someone and there's no, the term is payload, there's no software can be detected, ⁓ ultimately antivirus becomes useless. And this created the need for extended detection and proactive that are built into software layer of what we're doing. So this has really seen rise into endpoint detection and response tools that allow to practically search and what we would call threat hunt these adversaries. Essentially the biggest that I've seen in that space ⁓ having a purely defensive approach ⁓ allow you to go and proactive, to go and search, to go and hunt and to go and contain as I was mentioning before. ⁓ And is really seen, a seismic in how we are able to go and contain that lateral movement. And yeah. I see that as a positive. Lynn Murape: Okay, definitely a positive. But that you had said jumped out at me around free attacks, if I that right. What are those exactly? Callum: So ⁓ a malware free attack is where adversary is trying to break into your environment, they're trying to extort you ⁓ in ⁓ a non-traditional way. So back the day, ⁓ we see ⁓ someone downloads file, that file malware in it, ⁓ and from there, they'll look to down your systems, ⁓ exploit you for money, ⁓ until pay them, they'll keep offline, they'll encrypt your systems. They'll shut things down and that is typically traditionally how adversaries have ⁓ the techniques that they use. ⁓ they to realise a few ago some of these groups that this is maybe an archaic way of working from their perspective. The endpoint tools caught up. They've got a good list of they work, the pieces of software that they use, and ultimately that isn't going to get them ⁓ they need to do as hackers and adversaries. So malware-free now ⁓ would to any technique or ⁓ mission one of these adversaries that doesn't that traditional piece of malware, malicious software. So ⁓ common examples this the real world would be a phishing attack. So someone gets an email, say pretending to be Babble's Chief Revenue Officer we need this information, we need to buy you gift cards and that's how typically gain entry, gain trust and from there they'll look to, get the information they without having to, shut anything down. ⁓ So these behaviour-based attacks ⁓ or, malware-free attacks are way more common and this is why as partners to our customers, we've had to be a lot more agile and proactive around how we look at these threats because simply if we don't change, we won't be able to keep up and our customers will have to pay the price. ⁓ Lynn Murape: We definitely do not want that. So thank you for that explanation, Callum. And as you were speaking, it reminded me of the third episode on human risk, which, of course, forms of the HIDDEN framework. So do that out if you want to dive a little bit deeper into these behaviour based attacks as well. But bringing back endpoint protection. Let's talk about inconsistent device standards, you briefly touched on at the beginning of this conversation. Callum, what risks that create? ⁓ Callum: The way that I kind read that question that you put to me is, what are devices, are kept, ⁓ and what will and won't customers accept in regards to those policies? So I think a really good example of this, ⁓ and where we've definitely seen be caught out, is around how our customers can police ⁓ and... kind of protect personal devices. So for example, if you've got contractors coming into the business that want to use their own personal phone and laptops, will you allow them to access? What asks you have them around, you know, latest operating system, ⁓ another big one that we see ⁓ actually on your endpoints, ⁓ browser and services as well, as is common way we see exploits come in. So, ultimately, using that example, can have a fantastic corporate policy around endpoints and laptops where you have latest OS updated, you've got your endpoint agents installed, fine. if you allow ⁓ anyone to come your network and use a personal device that is working alongside you, essentially your device posture and security scoring will be massively reduced to whatever level of control put on personal devices. Because one of the things that I always really try and hit home to our customers is it doesn't matter what the strongest part of your security is it will always be the weakest part that lets you down and that will be exploited. So if you have inconsistent device standards you do leave yourself at risk to you know be exploited and have that back to bite you. ⁓ Lynn Murape: Definitely. you that you know companies are still for the most part the ones that deal with are putting more of a focus on protecting their laptops and desktops more than their mobile devices whether they're corporate owned or BYOD? ⁓ Callum: think really dependent on the customers that we speak to. Often, if we a customer that ⁓ is more familiar with... endpoint security for laptops, they might not have necessarily the same protection on mobiles, but I think the point is valid. If mobiles are a part of your business and are important to the way that you work, ⁓ then you don't that protection on there. You don't invest in tooling, don't invest in security, you don't have MDM, you don't ⁓ roll things out securely Intune. ⁓ Ultimately, that is a endpoint and inconsistent device standards. And, based on what I've just it doesn't matter really. What I can tell you, it doesn't matter to an adversary if it's a laptop, if it's an iPad, if it's a mobile. If it is a weak link, they will exploit it. So it's really, really important that you work with someone, whether it's internally, whether it's a company like Babble, that understands those risks so we can give you practical steps to reduce that security issue. Lynn Murape: for that, Callum. So spoken about where these gaps typically exist. Now let's talk about what good looks like as far as endpoint protection is concerned. So Callum, would you say are your non-negotiables for endpoint protection today? Callum: Yeah, it's a great question. So, up to date and ⁓ next antivirus products are an essential. work with many here, there's many available in the market, so I won't name names, but people that have the ability to hunt using software that that capability. That New World kind of flavour of software that allows for behaviour contextualised based threat hunting and blocking is critical me. From an internal perspective, having the capability that allows you to monitor proactively these alerts using something like a SIEM or Sentinel. And if it isn't a non-negotiable now, I can you this time next year it will be, having 24 by 7 coverage ⁓ to monitor and respond to these threats as well. You will be caught out some point if you don't have this in, it's a matter if anymore, it's a matter of when. ⁓ So yeah, I'd say for me, really, really the non-negotiable that I see. ⁓ Lynn Murape: Okay, great, thanks for that. as know, HIDDEN is all about giving that and ways measuring one's cyber security posture, right? And obviously shining a light on where these gaps are. ⁓ So in opinion, metrics actually demonstrate ⁓ endpoint maturity? ⁓ Callum: Yeah, I think there's a few bits we can look at. We work with a lot of Microsoft customers, whether that is for endpoint security or, a wider investment to look in collaboration tools. A good starting point for me, if you fall into that category, is reviewing your Microsoft Secure Score. So this is, a set of guidelines and principles set out by Microsoft that will give you a baseline understanding of where your security posture is today. So, looking into that, looking into how your policies are configured, best practice guides, would be great way of seeing metrics, right? You see a score, you see how it's benchmarked against your peers, and it you actionable insights to go and kind of prepare remediate those actions. I think secondly for in cyber security, it wasn't before, it certainly is now, name the game is speed. And the way that we measure that speed is with two different metrics. It's MTTR and MTTD, and that means mean time to detect and mean time to respond. Essentially what that's looking out for is we detect an adversary, faster they can do something wrong and can we respond to that adversary before they can break out? Those are the two metrics that of the CISOs I speak to know, all of the IT security professionals know ⁓ it's a constant battle because that number is coming down daily. think fastest one and this is maybe a good statistic to end on, working with a of technology partners in the we get some really strong intelligence around how fast these attacks are going. quickest adversary that seen break in to steal information and break out again was 27 seconds and that was using AI. So ⁓ my question and closing to customers is, do you think you could respond to incident in 27 seconds? ⁓ And if you can't, ⁓ you probably to revisit your strategy. Lynn Murape: Wow, yeah, that is definitely a mind boggling statistic and it segues nicely into the last question that I have for you, which is ⁓ one's personal laptop or phone were compromised right now, ⁓ would be the first step to contain the threat? Callum: Report straight away. Yeah. If you're not an IT security don't do it yourself. Go and report straight away and let professionals do it. ⁓ Yeah. ⁓ Lynn Murape: Yeah, perfect. That brings us to the end of this discussion on endpoint protection. Is there anything else that you would add before we officially close this out? Awesome, it's a pleasure to have you. Callum: No, thank you for having me.