Third-Party Vulnerabilities, Breaches and the Future of AI in Cybersecurity – CISO Talk Ep 39

Hey, everybody, thank you for joining us. You've joined us for another episode of CISO Talk, jj, Jennifer Manila. How are you today?

Good to be co-hosting with you as always. Yeah, Mitch. I'm doing great.

Good, good. You're like, I feel like I'm busy, and then I see how busy you are, so I don't feel so bad for Sure. You know, I don't, I don't see busy as a good thing.

I, I think usually if, if you're overly busy, you uh, you planned poorly or overcommitted, so, um, but I do shuffle my schedule quite a bit. Yes. No judgment.

I was not saying that, but Okay. For sure. Hey, we're joined by a couple of really great guests today.

Really excited to have, uh, Eve Mailer, who is C t o with ForgeRock. Hi Eve. Good to have you, Juan.

Hi, it's a pleasure to be here. Good, good. And all the way from Belfast, we do have an international show today.

We have Steve Benton, who's VP of Threat Research with Anomaly. Welcome, Steve Wise to be here. Fantastic.

Good to have you both. Jj, if it's okay, I'll kind of set up the conversation and we'd, uh, love to have you commented and then we kind of jump into it. Uh, I don't think there's any surprise to any of us that we are dependent upon, not just our own infrastructure, applications, services, security, architecture, all of those good things, but we more and more depend on third party services, SaaS, applications, uh, data sources, you name it, right.

Security services for that matter. And of course, our, their security is our security or lack of whatever the case may be. And that just seems to be, at least, you know, the data shows that's increasing, right?

We're not pulling it all back in. We tend to use more and more, and it's this complex landscape. And of course we have breaches happen, things that happen on the scene.

And, uh, Eve's gonna share with us a little bit of research and, and Steve will talk about one of the recent vulnerabilities kind of scenarios, but I know, I know this is a topic you talk with your, your customers, the people that you advise with a lot, I'm sure jj I do. And I think, you know, third party risk management, supply chain, risk management, all of the different manifestations of what it means to increase or bolster your security program that involves all of the other people, um, in that chain is kind of exploded in the past, I don't know, 12 to 18 months or so in it's various forms of risk analysis and SBOs and VECs and everything else we're dealing with. So it's certainly, it's not going away.

It's growing exponentially and it is one of the, one of the growing, uh, requests we get, for sure. Absolutely. Eve, I, I, I mentioned you first about some of the research that, um, you've, you've all released in, and I think it's an annual report that you do love to hear some more about kind of what you're seeing currently.

Yeah, absolutely. So, um, we publish an identity breach report, um, focuses on, you know, identity data being compromised, exfiltrated, uh, used to perpetrate worse harms. And, um, this was our fifth annual breach report this year.

And we only started reporting on, uh, third party supplier and partner, uh, derived attacks, uh, a couple of years ago. And what we saw this year was that fully more than half of the breaches being reported, which we know is there's under-reporting going on, so it might be even worse. Um, we're perpetrated through a third party supplier or partner, and sometimes the implications are, are huge.

I, I know Steve has some, some good data on, you know, talking about move it. Um, I wanted to bring in an example from the healthcare world. Um, there was one third party breach that we, we saw in February, 2022, and it was around accounts receivable management.

So something pretty, you know, you'd think anodyne, but of course not. And it affected 657 healthcare organizations. So this is an example of the kind of blast radius that you see.

It's not just moving laterally within one organization anymore. You have to assume, you know, when we say assume breach, you know, you have to kind of assume breach of everybody you talk to. Uh, so that, that, that's some examples that we put together in this report this year.

Love to hear your thoughts on this, Steve, too. I know you'd, uh, one of the things you talked about was moving, and of course so many people affected by that. Well, we all know why there's so much more supply chain involved is because of what happened over covid.

So digital, uh, you know, interaction accelerated hugely workforces became remote applications need to be able to be reachable by those employees and by the other people you're doing business with. So that attack surface just, just grew hugely. And what the bad guys realized, of course, was that instead of needing to go and attack an individual organization, they could probably sweep up, you know, a large proportion of organizations if they could just get into some common piece of infrastructure, some common piece of application that they're all sharing and using.

We saw it with SolarWinds and I was seeing it with, with, with movement. And it's kind of like the guys that used to Rob Banks, you know, back in the, back in the wild west, they robbed banks for a while and they realized that, you know, the money was being transported and collected through trains and other mechanisms. So they attack the trains instead.

And we saw that, you know, with, with cash transactions, the guys would follow the cash collection ban around, uh, around the town. And then when it made its last call, that's when they hit it. So, you know, they're recognizing the biggest opportunity for payout.

The biggest opportunity for getting, uh, the data that we can then utilize and sell on and everything else, uh, is by looking to these third parties because it is an accepted and known blind spot for all of the originating organizations that that, that are using it. So it's, it's, it's ideal for attackers because one, it's a blind spot and may not be as well monitored. Um, it's not in the control of the organizations that are putting their trust into that supplier organization.

And if they do find the flaw, they will get a lot out of it before the flaw is discovered and closed. And that's what's happens with, with MoveIt. And it's interesting about this kind of ex, what used to be called the extended enterprise.

And you know, we saw with the, the work that Google did around Beyond Corp that the models for actually building out that kind of digital transformation in the supply chain. They've gotten really good, you know, companies have been getting good at forging these connections. Um, as often happens, you know, the security posture of that, um, is, is sort of left as a little bit of an afterthought.

And there's, there's perfectly good technology and best practices that can be applied. Um, and it's, it's, it, it is still not being applied as fully as it might be. We see the same thing in iot actually.

Um, they could, they could learn from some of the web security kind of stacks, um, which, which have some of the stuff figured out if it would only be applied. Yeah, you're absolutely right. You've that kind of supply chain mapping, understand what is you're transacting, what data's involved, um, how is it protected emotional at rest.

This is kind of the security 1 0 1 stuff, you know, the stuff you study when you do your CYS examination and so on. And yet, often when these relationships are put together, it's more about the performance, it's more about the availability end of things, and not necessarily as much about the confidentiality and integrity. Uh, Jennifer, I'm, I'm curious, you know, you mentioned how often you're talking about supply chain security and risk management.

How do you, how do, how do you have that cus that conversation with customers? Is it usually we don't have a handle on it, we're trying to figure out what to do? Or is it it's gotten so much more broad, deeper and more sophisticated, how do we take what we do to the next level?

Or probably a little bit of both. Yeah, I try not to have that conversation if I can pawn that one off on somebody else. Um, that's my risk mitigation strategy.

Um, no, all joking aside, it's, it's, um, it is unwieldy and, and a lot of the work that I do is, you know, focused even more centrally than that and just trying to, you know, Eve mentioned beyond, uh, the Beyond corp. So this whole implementation of zero trust architectures throughout the organization. And a lot of the work I've been doing is around that type of strategy from building a program to, you know, implementing it and executing against it.

And it's unwieldy even in the context of what's in the walls that they do know about. Um, and those first, you know, those first kind of steps we talk through. And I'm curious what Steve and Eve think about this.

So in the zero trust journey, we talk about the first step in a five step roadmap, being defining the protect surface, which is of course all of the asset inventory and just figuring out where, what and where. And then the sec second piece is mapping the transaction flows, which is understanding what's going where. And, uh, you know, know I'm watching organizations struggle with this just internally, so I'm kind of curious some of the hurdles that you guys have seen as that relates to external entities and what, what some of the work is related to that.

Because I think, Mitch, you know, to answer your question, that's, that's a lot of the struggle is we have these checklists, you know, everybody's got their vendor supply checklist and I do a lot of stuff with D O D contractors, uh, cmm, M c, nist, um, 801 71 assessment. I'm in the middle of one of those right now. Um, so, you know, we have our checklist, we have, we have these forms, we have this stuff.

But how do you really extend this zero trust principle or even just get through those first couple of steps of understanding who's got what and where? Well, I think, um, you know, from my experience, um, you've got to go deeper than it's absolutely right what you say, right? All of these sort of the, the, the paper based assessments, all of the assurances you can get with standards compliance and everything, they are really, really good and they are your friend.

Um, you know, if you do end up with a breach and you know, the regulators come in or investigators come in to look at, you know, what, what was your level of diligence, that's really, really important, right? Because that's where you could get fined for not having done, uh, at least your due diligence. Nobody thinks there's a hundred percent security.

No one thinks you're not eventually gonna get some form of breach. But if you haven't done enough preparation and diligence around how you're looking after this information and, and this data, especially if it's customer, uh, data or employee data, uh, you know, the penalties are harsh. So you need to take it seriously with the vendor, understand what happens after, what happens when you haven't, where does it go, where does it get accumulated?

Um, have you done the risk assessments around that? You kind of have to be curious and build that relationship of, you know, curiosity and asking good questions and getting good answers. 'cause not all of it will come through in an audit, right?

Not all of it's gonna come through in a standards compliance. I think, you know, when you realize what's at stake, you've gotta start getting super curious about the important stuff and where is it when it's in the vendor's hands, when it's in their control, when it's in their supply chain. Um, and then high, high it comes back to you.

Yeah, I that totally true. And, and I love this notion of building the relationships. I see, I see a blind spot that we're starting to become a little clearer about looking at like the zero trust architecture, like long-term Identitarian looked at the, the zero trust architecture and went, boy is that familiar.

You've got, you know, kind of externalized policy decision points and then really responsive agile policy enforcement points. And the blind spot that I'm referring to is actually mapping the identities and the relationships between identities that can drive access rules. I mean, that's like an essential part I think of zero trust architecture because I love the protect surface concept.

The who part, you know, the, the subjects that you're gonna apply policy to is, you know, I think people are still thinking of identity as a login box and we like to say like, never log in again. The goal should be that it's part of the fabric. And in fact, in this kind of extended ecosystem view, identity starts becoming the golden thread that can actually connect all of the disparate, um, sort of centers of, of activity.

So, you know, even crossing domains, and the problem we have with these partners these days is it's too coarse grained what we're able to apply to protection over their access. And so if the, I if, if one of the key ideas behind zero trust is to make things fine-grained and dynamic and adaptive and contextual, then you have to have a bead on the identities and the relationships and therefore the flows of access requests. And that's what, you know, that architecture picture starts to give us, um, the ability to do.

And it requires kind of like seeing identity as a much more holistic thing and particularly holistic across, um, your workers, the workers of companies where you're not the boss. That's the problem here. And then oftentimes the consumer identities, the consumer data that becomes, you know, really quite vulnerable from, you know, potentially the breach of just one of those kind of B two, e B two B side identities.

Yeah. And, and you know, you're right, you know, identity is not about a login box and that still hangs around so, so much. But we do want identity to be tied to a real person and one identity per person.

But their identity is not just who they are, it's where they are. It's what time of day is it? Um, it, it's what their, uh, privileges are.

It's a whole wrap around them, which is the normality that we want to see. And anything that strays from that clearly is something to be very suspicious of. You know, you're bringing up a good reason for me to bring in those two little letters, A and I because somebody had to do it.

Okay, us, I'll go there. Right. You know, um, it, it's like this is what AI is so good at.

'cause you, you know, it starts to be a big data problem and you know, we actually, you know, apply AI to this exact kind of risk decisioning. Mm-hmm. So you can get contextual and adaptive and finer grained about like, you wanna improve the security and oftentimes you're in the position of not being able to compromise the experience, which is what happened through all of the sort of consumer facing digital transformations in the sort of pandemic era is like, you know, that I think Passwordless has actually gotten more of a hold Fido as a standard is more successful today because we went through that and everything went so, so digital.

I remote onboarding of employees went digital. So we were forced into these solutions. I remember, uh, a I used to get challenged in my, my previous role when we were trying to do the right level of security and resilience that the people that were have, that were designing that customer interface and that customer experience were saying, security cannot get in the way.

Right. Yikes. Do So how do you do that?

'cause end up with, we end up with abandoned sales journeys or stuff on social media saying, don't get service from this organization. It's horrendous. You can't log in.

Right. You have to give your insight measurement measurement and what you have for breakfast. Oh, like caps, I mean, honestly, anything that's better than CAPS that can do a better job of doing that.

Honestly, real world identity verification. K y C the biggest uptake I've seen so far, just as a normal human being in the outside world is actually with retailers that have embedded finance and you know, good on them. Yeah, yeah, you're absolutely right.

And AI is very interesting because we know it's going to make, uh, spotting social engineering much mu much more difficult. Some of the, the, the, the giveaways aren't gonna be there. It's interesting now they're developing AI models so that AI can identify ai, um, as part of your security, which which I think is deep on I love that.

I love that. Turn it around. It takes an AI to catch an ai.

Yeah. And one of the one things we haven't talked about, but you've kind of, uh, and may maybe said, but just not as directly, is that so many of the third party services and whether it be SaaS or data sources or other things, it's accessed over APIs and our applications are becoming much more a p i centric a p i first in some cases. Um, so the whole identity and access privileges and data usage all applies to an identity of what an application is doing or a user's doing through an application.

So there's overlap also, right? Well, it depends on who the user is that is requesting this data to come from that service. So, and, and it isn't one or two, it's like all the services we're integrating things together.

It's not just having people log onto a SaaS product, right? There is that, but it seems to me that a p i escalation or growth is, is increasing rapidly. This a p i security is one of these other kind of blind spots.

Like there's definitely solutions, there's definitely best practices. And so often you see, you know, an a p i key being used, which is basically a password, it's a static shared secret, and I, it's just, it's horrific. Um, and there's better ways to do this.

And one of the like sort of dirty little secrets, um, about a lot of the ways that people are accessing these APIs, you know, from another company, um, is that you've got a lot of impersonation by the a p I of the person that's doing the action. And if you really want transparency, auditability of what's going on, again, we have solutions for this. This is, you know, the OAuth stack, which is not new.

I mean, it's ridiculously not new at this point. Um, and it actually has, like, I think of the magic of, of OAuth one, of one of the magic pieces of OAuth in addition to the fact that it, it sconces consent as a thing people do, um, is that it actually enables you to identify the client application distinctly from the person wielding that application. And that simple idea, which took a lot of, you know, tweaking and doing and designing and a lot of water under the bridge to get some good design patterns.

It's super powerful for controlling, um, your, your exposure. That's one of the things I've, I've seen just in the last, I'd say year, is SaaS vendors switching over a token based or an a p i key based to an OAuth based platform. Yep.

And then your application is treated as an app with different access privileges across the different functions you might do. Exactly. Well, since we're talking about applications, there's another area here, which is what are the supply chains that surround application development?

Mm-hmm. Good one. So That's a, that's a huge one.

So if we get the applications right, you know, and all those elements, but where's the security around all of the third parties that typically get involved in developing applications, the habits of these young developers and how they operate, how they set up convenient areas to hold onto accesses for stuff, or they dump code somewhere so they can work it up an evening or whatever. And, you know, these supply chains are socially engineered, uh, the weaknesses in the development environments are also engineered. The weaknesses in the test environments are also engineered because the live environments are the ones that are secured.

So again, why go toe to toe with something that's pretty heavily looked after, go for the weakest instantiation you can find at this stuff? And often that's in development. That's a great point.

And you know, I think somebody might've said SBO m earlier and I'm, I'm wondering, I think this is a JJ specialty, you know, how you think this comes into the picture? 'cause I, I have high hopes all of a sudden for the transparency, it may, like, I know so many companies and research institutions that are doing a lot of, you know, kind of SBO m analytics and I'm encouraged by that. I think it's a good sign.

But is it, is it working? We've Had a lot of conversations, well, not a lot. We've had a few conversations here Mitch and I have with, with some people working on different programs in that area.

Definitely not my area of expertise. It's, it's something I look at and I'm, I'm hopeful for the intent of SBOs, but again, it's one of those cases where I, we, we collectively in the industry don't do a great job with any form of asset inventory beyond what's in a, the, the primary, you know, source of truth for identities like in a, in, in a domain, in a directory structure. So as soon as you start layering on, on other pieces, whether it's APIs or other nps or third parties or right, like, or things that aren't managed even as endpoints that aren't people or identities, things that aren't managed like the other things that are managed.

We have such a poor grasp of that. I feel like, I feel like, you know, a lot of the work I do is very foundational with organizations regardless of the industry of like, let's 1 0 1 level figure out what you have because you obviously don't have any clue. Like you've got 20, 22% of the clue here.

And so when we start talking about then LA that's, we're basically talking about layers and layers of asset inventory and the interdependencies of those. And I like some of the work, uh, some of our guests on here have talked about with the vulnerability exchanges and vexes where you're talking about instead of just what are all the pieces parts in here, what are the vulnerabilities attached to the pieces, parts that have context within how we're using it. And I think there's, there's a lot of hope.

I have a lot of hope for that, that type of a program for sure. You know, one, one of the assets that I think we forget to manage properly is actually the entitlements and you know mm-hmm. An enterprise or large enterprise might have 3, 4, 5 different solutions in play where all these ENT entitlements are managed.

And um, this is a place where we actually apply AI as well to get insights over like, you know, where things have been overprivileged, um, and how you can just cut down that overprivileged access really fast and get like, you know, hygiene fast by seeing what looks like what looks anomalous. So it's another case of using ai. I think that that is clever And I think that's not a one-off exercise either because things change.

So privileges can just accrete over time and you end up with something that just has got far too much was never intended. It's just been a, a natural course of system changes and, and bringing together a systems and so on. So I think it's a great exercise, but it should be something you repeat over and over.

It's part of your monitoring, I think, isn't it? My, my colleague, our, our chief product officer likes to say your org chart anymore is really an organism. It's like sort of pulsating and growing and all the joiners movers, leavers, like yeah, you definitely have to keep applying it.

Yeah, no, you're absolutely right. We live in a dynamic environment. We talk about having dynamic businesses, so security naturally is going to be a dynamic, the threat environment is dynamic.

I think we need to get more used to that. I love that idea of the chart being an organism that's fantastic. Are Used to use quite a, Be a little gross Analogy.

I used to use the analogy of, uh, our systems, our security are not solids, they're fluids and they're in constant. Ooh. And so it never, you know, it may have a state at one point in time.

It's kind of like quantum physics, right? You change the state observing it, you know, so we had biology And we State S And, and then when and when your organization sublimates, you've got real problems. 'cause now it's everywhere.

Oh, that's a whole nother transfer problem. Got an Oppenheim Oppenheimer reference in there and we just get a Barbie, then we'll have a bar Barer. Barb Heimer, you went there too.

Yeah. Okay. I went totally pop culture on us, so sorry about that.

Um, well let's do this. This has been a great conversation. Um, I'd love to get your thoughts sort of a step back from what we've talked about today.

And if, if you have one or two suggestions of next steps from where you are in your program, understanding that some people are gonna be, as JJ was talking about, we're we, may, we think we got an answer, we got 22% of it, you know, what's the, what's the undiscovered country you don't know about yet that we see because of how you work with customers, um, that's just off the horizon, but maybe not visible yet as you start to work on security and all the aspects we talked about with third party services and SaaS and things like that. Steve, do you wanna, you wanna jump? Yeah, I think, um, I remember the days when big data sort of kicked off.

Um, big data was very much about understanding customers and markets and behaviors and all that kind of stuff. And then you get to security big data, which is even bigger. Uh, there is so much information that that, that that, that you need to bring together.

So most security teams have got far more data than they could ever possibly, uh, understand or monitor. And I do think that we are on the cusp with, um, artificial intelligence coming in and better technologies that we can, like another film reference. I think we can turn more of our, uh, security operations people into more like an Ironman uh, situation where they've got that Jarvis suit wrapped around them that's helping them to get through a lot of analytics.

It's presenting a lot of information that's decision ready. And we know at the end of the day, security and businesses run on risk, but they run on the decisions that they make about those risks. Whether you're looking at your security posture as you're going forwards in terms of planning and just improving it, or whether you're up against, you know, an accident threat that is actualized on your environment, you're still running a decision making cycle.

And so the ability of, you know, that AI wrap to get to that, those precise decisions that are well analyzed with a good set of decision options going forward that can actually have an impact in eliminating or reducing the harm and getting the, the business back on its feet. I think that's where, you know, the next battleground is. Uh, and I look forward to it.

Yeah, it's, I love the idea of maybe asking security leaders to ask themselves the question, what would Tony Stark do? That's like a really good way. There you go.

To Think about it. Um, what I would say is that the kind of the last invisible thing maybe I haven't mentioned yet is that it only takes one breach of like one identity and it's probably a workforce identity and it might not be an identity in your workforce, but your partner workforces that can lead to a whole bunch of mayhem. And so we're seeing some signs, we saw some signs in the data for this year's breach report that we published that there are some industries that are getting a bead on just probably strong authentication is the first in.

And there's been progress on this front in, for example, financial services, which is quite encouraging versus healthcare where we're seeing a rise in breaches. And so, you know, it behooves organizations to, you have to do an awful lot of inventorying of your identities actually to do like an M f A program, right? Um, so it's a great place to start actually.

And Passwordless, as I mentioned earlier, it's becoming viable and I'm gonna pair that to the AI conversation because if you're gonna get rid of something, you know, you're leaning he more heavily on the other two macronutrients, you know, something you are and something you have. And biometrics suddenly in the modern era of the last seven, eight months are starting to be more suspect because that sort of people risk of gen AI is coming to the, for its compromising biometrics through deep fakes video and, and, and voice deep fakes. And we're seeing more phishing techniques having, having people be fooled.

So the way that you do kind of like an M F A or PASSWORDLESS program has to, um, place a higher priority on high assurance of those new authentication methods. And AI actually really helps here to combat ai. Um, and, and I think all of these things can be applied in a kind of point program to improve things immediately and then you can deepen the benefits that you see there from, um, with, with every succeeding quarter in the Future.

Yeah, Eva was seeing an interesting, um, study, uh, I think it was on C Nnn in fact, um, about AI identifying deep fakes. Um, and the interesting thing was that ai AI seemed to be quite good at identifying the fake but couldn't confirm the real one, which Was yeah, it's fraud detection. Interesting.

It's kind of, AI can recognize itself but can't recognize, can't recognize its master. I think it has commit, it has commitment issues, I think is, And you honestly, voice recognition has been used for a long time for, for fraud detection. It's not, it's never been as good for unique identification.

Authentication. And so the fact that a whole bunch of financial services firms seems to have put in voice biometric authentication now, like they're probably sorry and that's gonna have to get more sophisticated and liveness detection. It's definitely gonna have to take an upswing.

These are approaches when you go through an M F A kind of program, you're well positioned to start, you know, with the right orchestration of journeys, of authentication journeys that that's a great way to be able to be responsive to whatever isn't being sort of compromised. Next, JJ closing thought. I two things I guess.

First I'm, uh, I'm gonna be excited in the future to have another conversation around biometrics because it was more than 10 years ago, I think I gave a talk when there was a big stir around, you know, iris and retinal scans, um, in Austria or somewhere on Ate and Authenticy, which was looking at the sort of the mess of, of biometrics identities and um, we're coming back around to it. You know, there's a lot of other risks associated with that in terms of disclosing health conditions and health information. So I'm really curious in addition to the, the AI side of thing, the other risk, uh, the perception of the risk in, in the industry and the market now for that.

And then, you know, you guys are talking about Steve, you're talking about Iron Man and uh, and Eve or Mitch said, you know, what would Tony Stark do? And all I'm thinking is I just think of him drinking all the time. So Can we do a while drinking?

I mean, you know, I have a totally, Totally different perception of Iron Man I guess than I'm supposed to. Interesting. What we each pay attention to during the, those movies, not just kidding, at some Point he hunters down and does a lot of great work.

Yeah. Well thank you. Thank you both for joining us today.

Yeah. On behalf of JJ and myself, but these are fun, fun and engaging conversations that we covered a lot of territory today and I think folks will walk away with some really good thoughts and ideas and, uh, Steve Benton with Anomaly and Eve Mailer with ForgeRock. Thank you both.

And JJ, it is always a pleasure. Glad it could pull you away from your CSO whispering job and kinda get your, get you you in the conversation too. So it's always good my friend.

Yeah. Alright, thanks everybody for joining us. We look forward to you, uh, being here again for our next CISO talk episode.