Latest / Masters in Business / Security, Bookmarked: Gaming (Sponsored Content)
Transcript
- 0:02Speaker 1: Really.
- 0:02Speaker 2: It started relatively innocently. You have an engineer who's looking
- 0:06Speaker 2: at the server and looking at files on the server.
- 0:08Speaker 3: This is a story about a cyber attack on a
- 0:10Speaker 3: video game studio. As a software engineer was hard at
- 0:13Speaker 3: work on the company's next big game. He saw one
- 0:16Speaker 3: of his files had been moved by an impostor in
- 0:18Speaker 3: their network.
- 0:19Speaker 2: So immediately reaches out to the head of it, the
- 0:21Speaker 2: main IT guy, and says, who is this? Who owns
- 0:24Speaker 2: this account?
- 0:25Speaker 3: The main IT guy was the super admin, so he
- 0:28Speaker 3: knew right away that something was wrong and this wasn't
- 0:31Speaker 3: a normal account.
- 0:32Speaker 2: So actually what he did just shut down all the accounts,
- 0:35Speaker 2: killed all sessions, locked everybody out, required a password change
- 0:39Speaker 2: while he could dig into this because he immediately was
- 0:42Speaker 2: pretty freaked out about what was happening. And what they
- 0:45Speaker 2: realized was someone had come in and made a number
- 0:49Speaker 2: of accounts as super admin and had been poking around
- 0:54Speaker 2: and looking at everything and even exfltrading information.
- 0:57Speaker 3: They had no idea how long it's had been going on,
- 1:00Speaker 3: how much data had been extracted, or what else was
- 1:02Speaker 3: looking in their network.
- 1:04Speaker 2: They started digging into it, and they found locker software,
- 1:07Speaker 2: so ransomware software that would encrypt, and it was on
- 1:10Speaker 2: the server and it was ready to be deployed, but
- 1:12Speaker 2: it hadn't been deployed.
- 1:14Speaker 3: Catching the ransomware didn't mean the company was safe. They
- 1:17Speaker 3: still had to investigate all of their files and their
- 1:20Speaker 3: accounts searching for any other signs of attack. And worst
- 1:23Speaker 3: of all, they had to stop working on the new game.
- 1:26Speaker 2: Those minutes count and those days count. So every day
- 1:30Speaker 2: you can't have your employees behind keyboard is our days
- 1:33Speaker 2: that are going to be delayed. This is making it
- 1:35Speaker 2: even worse. And this Iiquy kind of becomes a hero
- 1:39Speaker 2: of the story because it was a really a courageous
- 1:42Speaker 2: call that he made to do this, knowing what it
- 1:44Speaker 2: was going to cost the company. They probably would have
- 1:46Speaker 2: had to be a huge.
- 1:47Speaker 3: Ransom from Bloomberg Media Studios and Chrome Enterprise. This is
- 1:58Speaker 3: Security Bookmarked. I'm your host, Kate Fazzini. I've been a
- 2:05Speaker 3: cybersecurity professional and journalist for more than twenty years, and
- 2:09Speaker 3: on this podcast, I'm talking with leaders in gaming, finance,
- 2:12Speaker 3: and manufacturing about what security looks like in a workplace
- 2:16Speaker 3: that's moved to the cloud. The video game industry is
- 2:20Speaker 3: a massive business, bringing in over three hundred billion dollars
- 2:24Speaker 3: per year. That's nearly ten times the size of Hollywood's
- 2:27Speaker 3: global box office revenue. But as the gaming business keeps growing,
- 2:32Speaker 3: more and more teams are accessing key systems and data
- 2:35Speaker 3: so they can do their jobs, and that means we've
- 2:37Speaker 3: seen a rise in account takeovers. So today I'm speaking
- 2:41Speaker 3: with Adam Murray.
- 2:42Speaker 2: I am the chief Information security officer at Arctic Wolf.
- 2:45Speaker 2: We are a managed detection and response company SAC as
- 2:48Speaker 2: a service and a concierge model, so that we make
- 2:51Speaker 2: sure that we're not only providing them security today, but
- 2:53Speaker 2: also make sure that we take them on a security
- 2:55Speaker 2: journey to improve their security over time.
- 2:58Speaker 3: I'm going to unpack add a story about helping a
- 3:01Speaker 3: game studio survive a ransomware attack to understand the account
- 3:04Speaker 3: security risks that all companies need to get control of.
- 3:08Speaker 3: Then I'll chat with David Adrian, security product manager for Chrome,
- 3:11Speaker 3: about why phishing attacks are so difficult to stop and
- 3:14Speaker 3: why this doesn't have to be the case. In twenty
- 3:22Speaker 3: twenty three, ransomware attacks in the gaming industry were up
- 3:25Speaker 3: more than thirty percent year over year, and they can
- 3:28Speaker 3: freeze at game studio's entire operation causing major delays. In
- 3:33Speaker 3: this story from Adam, the game studio caught the ransomware
- 3:36Speaker 3: threat early, but then they realized the attacker had also
- 3:39Speaker 3: stolen their intellectual property, including details about new releases, videos
- 3:43Speaker 3: and images that they weren't ready to share with the world.
- 3:46Speaker 2: We call it double extortion, where I've sealed up your code, right,
- 3:49Speaker 2: and then not only am I saying pay me the
- 3:51Speaker 2: ransom where you don't have access to it, I'm saying
- 3:53Speaker 2: I will release this to the world unless you pay me.
- 3:57Speaker 2: So I would say video game companies are likely to
- 3:59Speaker 2: be targeted by these ransomware groups mainly because video games
- 4:04Speaker 2: are likely to pay the ransom if you're able to
- 4:05Speaker 2: successfully lock up their code and get their backups and
- 4:08Speaker 2: lock up their backups as well.
- 4:10Speaker 3: And then finally, once they put out all the fires,
- 4:13Speaker 3: they could figure out how did this attacker get access
- 4:16Speaker 3: in the first place.
- 4:18Speaker 2: There was actually a phishing message as at all you know,
- 4:21Speaker 2: very often is it was. It was a phishing message
- 4:23Speaker 2: to this it individual, to this person, the.
- 4:26Speaker 3: Very person who had caught the intruder and pulled the alarm, and.
- 4:31Speaker 2: You know, he clicked on the link and it take
- 4:33Speaker 2: him to a web page, then a log and prompt
- 4:35Speaker 2: to come up. He put in his credentials. They did
- 4:37Speaker 2: not have MFA, so the attacker was able to get
- 4:40Speaker 2: those credentials, then log in and quickly make other accounts
- 4:44Speaker 2: and get off of that it person's account so they
- 4:46Speaker 2: wouldn't notice. Social engineering works and it worked really well
- 4:50Speaker 2: and it's why attackers use it so often. There are
- 4:52Speaker 2: lots of other protections they could have had in place,
- 4:54Speaker 2: but yeah, that was how the attackers got in, and
- 4:57Speaker 2: then we're using the other accounts to worm their way
- 5:00Speaker 2: through all of the servers and the whole environment.
- 5:04Speaker 3: Later in the episode, i'll share my conversation with David
- 5:07Speaker 3: Adrian at Chrome about how leaders can defend their companies
- 5:10Speaker 3: against phishing. But first Adam and I are going to
- 5:12Speaker 3: unpack what this one breach shows about the cybersecurity risks
- 5:16Speaker 3: that gaming companies face and what they can do to
- 5:18Speaker 3: be more resilient to attacks.
- 5:21Speaker 2: Video games is a large industry and so they're all
- 5:24Speaker 2: kinds of companies involved, and depending on the size and
- 5:27Speaker 2: the type of game, you'll have very different levels of security,
- 5:32Speaker 2: and that security will be leveraged at these different problems
- 5:35Speaker 2: at different levels. Let me give you an example, with
- 5:38Speaker 2: the rise of online gaming, so massive multiplayer online games,
- 5:42Speaker 2: there is a huge incentive for these companies to prevent cheating.
- 5:47Speaker 2: So you have these video game companies and they're spending
- 5:49Speaker 2: millions of dollars and using the latest cutting edge technology
- 5:53Speaker 2: AI to detect and defeat cheating on their games and
- 5:57Speaker 2: their online games. They're leveraging all of this great technology
- 6:01Speaker 2: to do that, and then on their corporate side, they
- 6:03Speaker 2: don't have MFA to protect their main accounts. It is
- 6:06Speaker 2: understandable that they focus on the anti cheating because that
- 6:10Speaker 2: directly goes to their bottom line because if they're cheating,
- 6:14Speaker 2: then players are going to go elsewhere, and there are
- 6:16Speaker 2: other game companies that would love for that to happen.
- 6:18Speaker 2: So it makes sense while they do this, But you
- 6:20Speaker 2: have to understand you could have a breach that costs
- 6:21Speaker 2: you millions, tens of millions of dollars.
- 6:23Speaker 3: You've said that companies shouldn't treat data breaches or ransomware
- 6:26Speaker 3: attacks as part of the cost of doing business. Tell
- 6:29Speaker 3: me a little bit more about that.
- 6:31Speaker 2: I mean, I guess if you're a business, everything is
- 6:32Speaker 2: the cost of doing business, right Like, everything is going
- 6:35Speaker 2: to your bottom line. But what I mean, is there
- 6:36Speaker 2: are things you can do today that will greatly lower
- 6:40Speaker 2: the likelihood that you will have a breach. And you know,
- 6:42Speaker 2: my whole job is to prevent breaches, So I think
- 6:44Speaker 2: they're terrible. We should all leverage security against them. But
- 6:48Speaker 2: it might be seen as you know, a risk worth
- 6:49Speaker 2: taking or a cost of doing business, or maybe we
- 6:51Speaker 2: won't get hit with an attack, and you know, maybe
- 6:55Speaker 2: I want to spend money on making my render look
- 6:57Speaker 2: that much better and the graphics look that much better,
- 7:00Speaker 2: And I just don't see how security is hitting that.
- 7:02Speaker 2: It's the similar thing many companies do, and then when
- 7:04Speaker 2: they get breached, they really regret it. Because if you've
- 7:07Speaker 2: been developing a game for three years, an attacker comes
- 7:10Speaker 2: in and they're able to deny you access to all
- 7:12Speaker 2: of your information, your source code, your art assets, all
- 7:14Speaker 2: of that, and get your backups. You are in a
- 7:16Speaker 2: world of hurt. That is a very bad position to
- 7:19Speaker 2: be in, and the likelihood that you're going to pay
- 7:20Speaker 2: the ransom is very high. I don't recommend that, obviously,
- 7:23Speaker 2: my stance is not to pay ransoms, but.
- 7:26Speaker 3: Yeah, it's almost I can't imagine not paying it in
- 7:28Speaker 3: that because if your whole entire company is at stake.
- 7:31Speaker 3: It's the entire lifeblood of your company, the reason for
- 7:35Speaker 3: its existence basically exactly.
- 7:37Speaker 2: It is literally your entire business. And so then you're
- 7:40Speaker 2: going to want to start thinking as an organization and
- 7:42Speaker 2: you try to say where are attackers being successful.
- 7:44Speaker 3: So when you think of enterprise security for game studios,
- 7:47Speaker 3: what are the most critical threats that you're watching out for.
- 7:49Speaker 2: You know, there are many threat or attack reports that
- 7:52Speaker 2: come out or data breach reports that come out each year,
- 7:55Speaker 2: artic Wolf as one as well, and if you look
- 7:57Speaker 2: at these, you'll see the primarily attackers are success full
- 8:00Speaker 2: in doing basically one of two things. Either attacking accounts
- 8:04Speaker 2: so you can think user name, password, MFA, attacking that
- 8:07Speaker 2: and getting access through that, or attacking vulnerabilities, so looking
- 8:11Speaker 2: at the code, looking at the configuration of cloud software,
- 8:14Speaker 2: SaaS software, whatever it is, and being able to exploit
- 8:17Speaker 2: those vulnerabilities and get in. So if you can really
- 8:19Speaker 2: look at this and say, how do I protect identities
- 8:22Speaker 2: at my company and how do I make sure that
- 8:24Speaker 2: we're patching and updating and not introducing vulnerabilities and misconfigurations.
- 8:28Speaker 2: If you can do those things to the right level,
- 8:30Speaker 2: you're going to protect your company and you certainly won't
- 8:32Speaker 2: be the low hanging fruit where attackers will try to
- 8:35Speaker 2: attack you.
- 8:35Speaker 3: What are some other ways that the companies can be resilient.
- 8:38Speaker 2: If you want to get really technical, we can talk
- 8:40Speaker 2: about shift left. In other words, you want to create
- 8:43Speaker 2: games and systems that are secure, so you want to
- 8:45Speaker 2: make sure you're baking security in from the very beginning,
- 8:48Speaker 2: so when you're still like whiteboarding the design of what
- 8:51Speaker 2: you're trying to do in the game, add a threat
- 8:52Speaker 2: model to that process from the very beginning, thinking about
- 8:56Speaker 2: how could somebody take advantage of this, how could it
- 8:59Speaker 2: go wrong? And by the way, you can also add
- 9:01Speaker 2: anti cheat in there at the beginning too and help
- 9:03Speaker 2: solve that problem at the very beginning, so you're not
- 9:05Speaker 2: trying to tack it on at the end. And then
- 9:07Speaker 2: when you have your detection and prevention methodologies out there,
- 9:10Speaker 2: they're going to be much more effective because the underlying
- 9:12Speaker 2: system itself is resistant to attack and resistant to cheating.
- 9:16Speaker 3: Game developers are obviously digital first. When you think about
- 9:20Speaker 3: the day to day work and collaboration that goes on
- 9:22Speaker 3: behind the scenes at the enterprise level, I'm interested in
- 9:26Speaker 3: how do workers collaborate. You're in an industry where you're
- 9:29Speaker 3: working with people who are specialists and extraordinarily talented, but
- 9:33Speaker 3: maybe like at one thing, and that guy lives in Aspen,
- 9:37Speaker 3: and then you know the other guy lives in the
- 9:39Speaker 3: forests of Oregon, and you've got to connect all of
- 9:42Speaker 3: these teams in different areas. How do you handle collaboration
- 9:46Speaker 3: across environments like that.
- 9:47Speaker 2: Yeah, so it's an interesting question in security. We've been
- 9:50Speaker 2: doing this for a long time, collaborating across time zones,
- 9:54Speaker 2: using various tools, different SaaS, apps or other applications to
- 9:58Speaker 2: collaborate and communicate. That means a lot of very sensitive
- 10:01Speaker 2: information as being passed through these suites of software. And
- 10:05Speaker 2: so if you can think of one thing, like the browser,
- 10:07Speaker 2: so much work happens right in the browser, and many
- 10:12Speaker 2: companies just don't think of the security of that particular
- 10:16Speaker 2: piece of software. If we dig into that a little bit,
- 10:19Speaker 2: you know, are you hardening that piece of software. Are
- 10:22Speaker 2: you making sure that everyone's using the same browser so
- 10:24Speaker 2: you can have the same type of security across the
- 10:26Speaker 2: entire organization. Are you making sure they're not sinking personal
- 10:30Speaker 2: accounts that can bring in different extensions that they're using
- 10:33Speaker 2: at home that do backups or copy and now you
- 10:35Speaker 2: have information going places you weren't thinking of. So really
- 10:38Speaker 2: making sure that each one of those pieces of software
- 10:40Speaker 2: is secured, especially the browser, is a really important consideration,
- 10:44Speaker 2: especially if we're talking about companies that are collaborating, you know,
- 10:47Speaker 2: with lots of remote employees and using software to do that.
- 10:50Speaker 2: There is one third aspect to this, and it's actually
- 10:52Speaker 2: illustrated by the story I told, and that is you've
- 10:54Speaker 2: got to have a good security culture. You've got to
- 10:57Speaker 2: train your people to be wary of social engineering attacks
- 11:01Speaker 2: like phishing and be resistant to those. You know, you
- 11:03Speaker 2: can have technologies to protect against it. But there's a
- 11:06Speaker 2: reason why so many attackers use social engineering is because
- 11:09Speaker 2: it's very very successful, because it's pretty easy to trick
- 11:12Speaker 2: human beings.
- 11:17Speaker 3: If you're leading a gaming company, your entire product is software,
- 11:20Speaker 3: and that product is constantly being accessed, tested and updated
- 11:23Speaker 3: by your teams. The same goes for your IP designs, assets, code,
- 11:29Speaker 3: marketing trailers showing new characters, new content, and it all
- 11:33Speaker 3: lives online. So how do you keep your own accounts
- 11:36Speaker 3: from being used against you?
- 11:37Speaker 4: So, if I'm a CSO or I'm in charge of
- 11:40Speaker 4: security an organization. The number one thing that I would
- 11:43Speaker 4: be focusing on is deploying strong, unfishable authentication to all
- 11:48Speaker 4: of my employees.
- 11:49Speaker 3: That's David Adrian, a security product manager for Chrome.
- 11:52Speaker 4: I focus mostly on network security, but I help everything
- 11:56Speaker 4: up and down the stack to make sure that we're
- 11:58Speaker 4: building Chrome to be as secure as possible, from the
- 12:00Speaker 4: application through the network to the cloud.
- 12:03Speaker 3: When I brought up ransomware attacks and gaming, he picked
- 12:06Speaker 3: up on account security and how important it is to
- 12:09Speaker 3: plan for what happens when an employee account is compromised.
- 12:13Speaker 4: Game assets or designs are I think the crown jewels
- 12:17Speaker 4: that gaming companies are trying to protect, and so I
- 12:20Speaker 4: feel for them in the situation and that they need
- 12:22Speaker 4: to figure out like how do we make this run fast,
- 12:24Speaker 4: how do we get access to everyone that needs it?
- 12:26Speaker 4: But also how do we, you know, make sure that
- 12:29Speaker 4: if someone bad gets in, they don't get everything. When
- 12:33Speaker 4: things go wrong, they go wrong bad and you risk
- 12:36Speaker 4: all of you your game assets getting encrypted and ransomwared.
- 12:40Speaker 4: And in many industries, the high value accounts are sort
- 12:44Speaker 4: of the administrators of the organization who might have access
- 12:47Speaker 4: to create new users in the gaming industry, there might
- 12:52Speaker 4: be a broader set of targets because any developer who
- 12:55Speaker 4: can build the game likely has access to all of
- 12:57Speaker 4: the assets for the game and able to get in
- 13:01Speaker 4: and they get access, let's say, as anybody who has
- 13:05Speaker 4: access to the underlying game assets, there might not even
- 13:08Speaker 4: need to be a lot of escalation of privileges. Sure,
- 13:11Speaker 4: if they get an administrator, they could create their own account,
- 13:13Speaker 4: but if they get a game developer, they might just
- 13:16Speaker 4: be able to walk away with all of the assets
- 13:18Speaker 4: for the game by default, because the developers already have
- 13:20Speaker 4: access to it.
- 13:21Speaker 3: And so we zeroed in on the moment when an
- 13:24Speaker 3: attacker breaks into a company account through a phishing link.
- 13:27Speaker 4: The most common sort of attack factor is still phishing.
- 13:32Speaker 4: It's not too hard to find who's working for some
- 13:37Speaker 4: company and then try and figure out what their email is,
- 13:39Speaker 4: and once you know their email, you can try and
- 13:41Speaker 4: start phishing them.
- 13:43Speaker 3: I think I had somebody tell me once that teaching
- 13:45Speaker 3: people to not get fish is like teaching them not
- 13:48Speaker 3: to fall in love. It's never going to happen.
- 13:50Speaker 4: I would flip it around a little bit and say
- 13:52Speaker 4: that trying to solve phishing with like phishing training fake
- 13:56Speaker 4: phishing emails. That type of thing. Even if it works
- 13:58Speaker 4: ninety nine point nine nine percent of the time, the
- 14:01Speaker 4: point zero one percent that it doesn't is enough for
- 14:03Speaker 4: everything to go wrong. Right, We've seen one phishing attempt
- 14:07Speaker 4: that succeed have impacts on everything ranging from gaming companies
- 14:11Speaker 4: to elections, and so, sure, you can try and like
- 14:14Speaker 4: get your employees to hide their emails, you can append
- 14:17Speaker 4: random digits to their emails, but at the end of
- 14:20Speaker 4: the day, eventually something's going to leak and someone's going
- 14:22Speaker 4: to get fished.
- 14:23Speaker 3: So let's talk about phishing protection. Obviously, these people are
- 14:27Speaker 3: going to get spearfished. It will happen, So what are
- 14:30Speaker 3: some of the protections available to them.
- 14:32Speaker 4: So the good news is that we have effective solutions
- 14:35Speaker 4: against fishing. I think if I were a CSO or
- 14:39Speaker 4: a CIO, like, the number one thing that I would
- 14:42Speaker 4: be doing is deploying strong, unfishable authentication. And while that
- 14:47Speaker 4: seems kind of straightforward, like let's just authenticate the people
- 14:50Speaker 4: that work for me and make sure they work for me,
- 14:52Speaker 4: that is probably most of the challenge for a lot
- 14:55Speaker 4: of security engineering teams is making sure that that can happen.
- 14:58Speaker 4: The easiest context to deploy them is web browsers for
- 15:02Speaker 4: enterprise users, where you have this source of truth where
- 15:06Speaker 4: you can say, hey, I know what all my employees are.
- 15:08Speaker 4: I'm going to ship them all some sort of token
- 15:11Speaker 4: to plug into their computers, making sure that every work
- 15:13Speaker 4: application that every employee goes through has to use one
- 15:16Speaker 4: of these authentication methods and does it from a managed browser.
- 15:20Speaker 4: And so if you can deploy those authentication methods and
- 15:23Speaker 4: you can make all logins only go through a web
- 15:26Speaker 4: browser and only use those authentication methods, you solve phishing.
- 15:30Speaker 4: With Chrome, enterprise premium organizations can access a centralized enforcement
- 15:34Speaker 4: point for all of their endpoint security in controls. This
- 15:37Speaker 4: allows for endpoint visibility across the entire enterprise network. IT
- 15:41Speaker 4: and security teams can deploy advanced security capabilities like advanced DLP,
- 15:46Speaker 4: like context A wear access controls, and then you can
- 15:50Speaker 4: get in depth reporting for all of those features and
- 15:53Speaker 4: so deploying stronger authentication that can actually be more user
- 15:58Speaker 4: friendly when done right, in the sense that it lets
- 16:00Speaker 4: people act how they would naturally and not have to
- 16:03Speaker 4: try to treat every email adversarially like it might be
- 16:06Speaker 4: a phishing email. Because with the right authentication, they'll actually
- 16:09Speaker 4: be protected by default, so if you send them a
- 16:11Speaker 4: fishing link and they get tricked by it, it doesn't
- 16:14Speaker 4: matter and the login won't work for the attacker.
- 16:19Speaker 3: To learn more about how the most trusted enterprise browser
- 16:21Speaker 3: can help protect your organization, visit Chrome Enterprise dot Google.
- 16:27Speaker 3: Next time on Security Bookmarked, i'll talk strategy with jf Lego,
- 16:32Speaker 3: Deputy Chief Information Security Officer at JP Morgan Chase.
- 16:36Speaker 1: So it's really how do you think through the awareness
- 16:40Speaker 1: for people with the most common types of attacks, but
- 16:44Speaker 1: also how do you turn your entire workforce into early
- 16:48Speaker 1: detection sensors.
- 16:50Speaker 3: Security Bookmark is a podcast from Bloomberg Media Studios and
- 16:54Speaker 3: Chrome Enterprise. Subscribe in your podcast app so you don't
- 16:57Speaker 3: miss our newest episode. Kate Fazzini, thanks for listening.