The Year In Review – So Much to Cover, So Little Time! – CISO Talk EP 43

Well, welcome everybody. We are here for a year end review, CSO talk, special episode, looking at 2023 and maybe the interesting and maybe the wild and wacky, you know, things that really kinda struck us. Hmm.

Didn't like that. Love that, et cetera. We'll, we'll find out.

This is just gonna go where it goes. This is not scripted. We're just gonna have kind of a freewheeling, uh, road trip looking back in the rear view mirror.

So, JJ always good to be doing this with you. Um, yes, It's fantastic. Sorry.

Uh, we're you guys, we have so much fun when we record stuff and we, we try to be serious before we come on, but it doesn't actually work that way. So, hi. Welcome.

So introduce our guest, if you will, Jj. All right. Um, sitting in the blue corner, we have Mr.

Dan Glass and opposite. Now that makes it sound like you two are fighting. It's definitely not a fight here, but it, but it is fun to watch you two in action together.

It's been several years. Alison Miller, of course. Welcome to you both.

Thank you. Welcome to You both. Thank you.

Thanks. Great to have you. Oh, so, so Dan, I know you're charged with a few things you want to talk about.

So let's, let's have you kick things off. 2023. I I have nothing.

I have nothing A blank slate at this point. Jody's gonna shoot me from wherever she is. Um, no.

So, you know, starting off, I think when I think of 2023, um, I think of generative ai, right? It, it started late last year, about a year ago. Um, but really this year is where the businesses start to wrap their arms around it.

Um, and, and starting to push these use cases. Um, the way I see it from a security perspective is if crypto and cloud had a baby, it would be generative ai. 'cause you got the, uh, you, you've got the hype of crypto, uh, but you've also got some of the utility of cloud.

And I see it ending up about the same as cloud is, is sort of a deante, like from a a cloud perspective, yes, we've, we've gotten rid of data centers, but we've replaced all that cost with cloud costs. 'cause cloud ain't cheap. Um, whether it's SaaS, uh, paths or ias.

Uh, so I'll, I'll pause to, to let Allison, uh, correct me how, how wrong I am on everything. No, Not at all. I think that's a good take.

It's just that you forgot, like the soap opera level drama of, um, social media sort of in that mix along with the hype of crypto and the, the promise of cloud. Um, I, it really did crowd out all other conversations that I feel like folks wanted to have. You know?

Um, we're making advancements from the technology perspective on a number of fronts, a lot of things happening with the economy. But every single conversation either started or ended talking about generative ai. For me this year, Just being a perfect example, starting with generative ai.

You know, the another word that that kind of goes with that for me, Dan, is copilot. Everybody's got a copilot now. We've got, you know, it isn't just bots or what chat bots or whatever.

It's, every product is introducing gen AI and gen AI as a co-pilot kind of assistant to their product. So I'm not sure what the next evolution is, but pretty soon I'll have my co-pilot talk to, yeah. I don't know, Copilot immediately solve it.

You said that word, um, um, You made Dan twitchy. Yeah. Oh, That's a nerve there.

Pilot. Well, so, so, and, and, uh, probably gonna get in trouble for this, uh, but I'm gonna do it anyway. All right.

So, uh, the, the way, so, so copilot is an interesting thing that Microsoft has put together. I I think they're, you know, they're all in approach is bold. I'll, I'll say that.

Um, but, but what, what I'm amused by is, is that they're still in the, they, they've sort of launched it and they, they, but they launched it without really understanding, I think, how to A, sell it and b, how to market it, because they've already changed the name like a few times on, at least on US corporate guys. Uh, you know, so we're chasing, uh, at first, you know, being enterprise and now it's co-pilot for, I'm so, so confused by their SKUs and, and what they're trying to actually do. So I think, uh, Microsoft, first of all needs to pick a name and stick with it.

It seems like it's co-pilot. I hope it is. Um, but then also, uh, understand why guys like me get nervous when they say things like, oh, yeah, no, no problem.

We'll just use SharePoint as your enterprise knowledge repository. And oh, well, there's a lot of stuff in there. Um, so, so that, you know, that can bring up another like thing that'll probably be what we talk about in 2024, which is data hygiene.

Hmm. Hey, Dan, can we, can, can I jump in? Can we bump down the requirement for naming from a and replace that with something that works?

Because the little bit of, um, EC data I've seen from friends using copilot in, uh, larger organizations that are piloting is that it like completely destroys the file that you're operating in to the point that you can't even save the file, save as the file, manipulate the file, or even copy pieces of the file sometimes out into another file that it's, it is not baked and it is what's be what's before bleeding edge. Like, there's gotta be something that's just like a complete mingled mess is, that's what it feels like still Absolutely. Robot On a rampage.

I think it's chaos theory, Texas, you know, AI Chainsaw Massacre. Yeah. I've not heard that about co-pilot, And I do, but I, but in all seriousness, I mean, I think there is some risk here because generative AI is not perfect and hallucinations are real.

Um, adversarial prompting is real, uh, prompt injection is real. And I'm not saying Microsoft hasn't thought about these things, but I don't think there's good answers for any of it. Bias is real.

And, you know, and, and the technology hasn't caught up yet, right? I need, I am going to need, I believe, a generative AI tool or an AI backed tool to counter the risks posed by AI and generative ai. Mm-Hmm.

And those tools don't really exist yet. Um, not in a way, shape or form that I want to invest in, right? Um, because that, if I just use it as the native tool, like how does that even work?

And, and do I gotta go now, hire a bunch of prompt engineers and security? Is, is that money well spent? I, I don't even know at this point.

So yeah, I, I think Microsoft isn't really doing enterprises a lot of favors, uh, at pushing this out as quickly as they are. Well, Dan, you're kind of giving me a flashback back to 20 22, 20 20, 20 22. That sounds really weird to say.

But anyway, I sort of forgotten what I had been thinking about a lot in, in 2022, and that was data governance. Um, and IAM and I feel like these are things that are like all that's old is new again, it's an evergreen problem. No one actually ever nails it down.

And with cloud and with some of the cool data technologies that have been introduced in the past five to 10 years, folks are sort of rewriting the rules and the complexity of folks data stacks and their, um, need to like, manage access across all of these systems and stacks is just ever increasing. And so in a lot of ways, um, what the, the problem set that we're seeing with generative ai, it might have been a little more tolerable if we'd had things already solved on what seems like a simpler problem, which is like basic data governance. Um, so it was really kind of like adding fire to some, a slow burn, a slow burn, IAM and data governance.

Those are slow burn problems, but they're problems that, um, you know, desperately need attention in most enterprises. And just trying to add in something, you know, sparkling, a new like gen AI on top of, that's definitely, most folks aren't in a position to be successful there. I'm thinking about data governance and management in the context of training data going into LLMs, right?

Mm-Hmm. This is a whole new Yes. Use, and your IP is in that, and you or hacker's better off stealing your LLM instead of your database, right?

Because maybe it's trained in unique, interesting ways has information that you can't get anywhere else. But how do you also, how do you manage the flow of how those AI systems get updated as part of, or in synchronous or not with your software cycle as your security plans? All of that.

A lot more questions than answers, I think introduced by, by 2023. Ironic. The year of the More questions, please.

Yeah. I think Allison nailed it though. Um, you know, it's, we're, we're, we haven't finished blocking and tackling from a security or most enterprises.

I'm sure there's people out there that'll raise their hand and say, we absolutely have all that nailed. And, um, and, and some companies may, um, you know, and some companies are doing zero trust well, and, um, good for them. But, but I think, you know, if you, if you're gonna pull the market, I, I think most Mark most companies are probably very immature.

Security is usually running to catch up. It's a lot of bolt on stuff. And that's expensive when, as Allison was alluding to, it's a lot, it, it would be time consuming and a little cost prohibitive in the beginning to do some of that data governance and data cleanup and, and maintenance and, and get that rhythm going.

But in the long term, you're probably gonna save money on security, especially because you, you're reducing your risk, right? If the data doesn't exist anymore. 'cause you cleaned it up and, and you're sure about who has access to it.

Um, you know, you've gotten, you've plugged a lot of holes just by doing some boring stuff, but unfortunately it is boring. It doesn't drive revenue for the, uh, for our friends in, in vendor land. Uh, you know, and so that's kind of a cheap shot, I guess.

But at the same time, those are, but those are real problems that, you know, they always say, what problems are CISOs facing? And, and we're like, yeah, well, well, we're still having trouble, like getting it to patch and you're, and you're coming here with this, you know, this this great way of doing this, you know, really corner case security issue, right? For, you know, to reduce risk.

And it's like, yeah, but I, I got this other thing. Help me there. Um, so Great a Allison.

So anything you wanna throw on the know, the log on the fire of 2023 as we're looking back and warming up going to 2024? Um, well, I'll just sort of, uh, so my work has taken me, uh, I've still work on enterprise cybersecurity issues, um, like, you know, like CISOs do. But I have also been spending a lot of time recently looking at what I would call sort of advanced product security issues, things that are happening in the product, um, that folks are offering.

Um, and sometimes that shows up as like anti-fraud, anti-spam, um, anti-abuse. Um, and, uh, I, I think what's really interesting is, so having kind of worked in that space for a while, most platforms and like these are things that affect pretty much any consumer facing platforms. Like if you have a login button or a checkout flow, you're dealing with some of these products, or sorry, some of these issues in your product, even if the product is working as intended.

These, these problems tend to show up on your doorstep. And, um, it's interesting to see cybersecurity vendors who have classically been focused on selling into the enterprise now, sort of picking up some material or trying to help out in the product. It's really just kind of interesting watching some of that convergence.

So one of the things that has been a problem for many years for anyone with a login button is account hijacking, right? Like, phishing happens in what happens, someone's credentials get stolen in their account gets hijacked. So we've known about account hijacking for a long time, um, and a lot of, uh, companies have built their own tools, they've added things into authentication.

They have their own sort of detection technologies. And if you're a consumer of any technology, you sort of experienced with the, what two FA looks like and, um, recovery codes and all of those things. But now we see enterprise cybersecurity vendors who are experts in authentication leaning into, well, I can help you not just with getting your employees to log into your internal systems, but also help your customers logging in to your platform.

And we've seen, um, some detection vendors that, uh, maybe they were selling device ID for some reason, sort of shifting over into, well, maybe you could use this in your product to, to notice that bad actors are coming back or bots are coming at you or what have you. And so it's been really interesting for me to sort of see the entry into a niche, I guess, of, uh, of vendors who'd been typically sort of selling into, uh, corporate. It, It's just fun too because, uh, it's where, it's where this side where those consumers live or where things like scams and ePrime live.

So it's kind of a fun place to hang out. And it's interesting to then see those names that we know and love, um, who are, we're working with to secure enterprises also show up and, and offer to help out in these, um, more fun places. I'm trying to, I'm wrapping my head around this, um, and, and, and trying to, uh, regurgitate this back to you without using any vendor names.

'cause I don't, I don't even know who's doing this in this space. Right? Um, but let me, let me ask this.

Uh, would these types of solutions, if this is successful and, and goes down a good path, um, would they help protect against some of the consumer facing issues We've had, like, like recently 23 and me had had an issue, but it was credential stuffing by users who had poor password hygiene, not something that, you know, 23 and me had control over. Right? Is that where you see this kind of playing and using those analytics and intelligence on the consumer?

Yeah, I mean even the like, uh, so I feel like credential stuffing those, that's like an authentication sort of expert kind of way of describing the problem. The result is an account hijacking or a compromised account. And so, um, there are, you know, there are folks who are looking to, Hey, notice that and that there are bots coming to your API, maybe they're coming to your API 'cause they wanna bid on Taylor Swift tickets.

Um, or like stuff jam the cues so that no one else can get Taylor Swift tickets. Or maybe they are trying to take over your accounts, um, and in order to pull information out. So yes, it, what what we're talking about is vendors who have been working on other use cases now working on use cases that are consumer facing, consumer or customer facing.

It could be a business, doesn't have to be consumer, but customer facing. Customer affecting, yeah. Okay.

And sometimes those use cases, sometimes those use cases are like owned by the, the security team, but sometimes they're owned by a product team, right? Mm-Hmm. That, that has their own way of thinking about business objectives and such.

So it's a really interesting bridge set of use cases for getting these teams talking to each other too. That's interesting. 'cause I did, when I saw that, you know, and, and it's, it's easy to go, okay, well that wasn't their fault, um, user pa, but wouldn't you notice that many user accounts being accessed at the same time?

And some pattern, right? There's some pattern that's off of baseline from that. I saw Dan raising his hand, so I don't know if that was a, I'm trying to buy Taylor Swift tickets, or I have something to say.

I, Allison Has a line on how to get, uh, Taylor Swift tickets. Then she, to me, a a note. Yes.

Well, I think, yeah, there's So, uh, but no, from an enterprise perspective, jj, you're touching on something that, so we depend on our, our vendors, our partners, uh, for a lot of our security apparatus. Um, and so yes, we absolutely, uh, have set some stuff up. Like I know that I have my team set things up so to monitor for, you know, too many logins from the same IP or too many of the sa or, or more than, you know, more than one IP logging in as a person, right?

You know, the both use cases, impossible travel, things like that. Um, but we also rely on, let's say you're a Microsoft partner, um, you don't get, you don't get insight a lot of the times or you have to pay for a advanced logging and things like that in order to get access to the fact that that, you know, maybe you, maybe you're being password sprayed where they'll, you know, which is sort of the inverse of credential stuffing, right? Where, you know, they'll, they'll send a password with a bunch of user IDs instead of a user ID with a bunch of passwords, right?

It, um, but, but we need to be alerted about that, right? And, and in some cases, because of that, that separation between the pro, if the product people don't think enterprise and they just build the product. Now there's that lagging indicator, right?

And this, this goes beyond just AAA for enterprise security, buying a security product. This would go for almost any triple, you know, any platform where you don't have SSO in place where it's not an SSO um, uh, login. It may be just a standalone login for, you know, something that maybe you're doing some sort of LDAP push or whatever.

Um, same, same idea, right? We, we need to know. And, and sometimes the enterprise security just isn't, you know, on top of it, Right?

And jj, someone definitely will notice if someone's looking, if someone's looking, and when they pushed the change into production, they made a decision to log certain types of information. And so there's the, there, there's sort of a, um, uh, I, I think, I'm not sure I'm not, when Dan says the product folks need to be thinking enterprise, um, I, I think that that is true. Um, but there's a, there's a mindset thing there that doesn't necessarily come naturally.

It, it needs to be something that is sort of developed in an organization. And, you know, I think we're past the point where every product was an MVP, you know, where like now we have apps that have been around for 10 years. They've had folks who've been working on their security and such, but there was a time when, you know, there was an app for everything and everyone was just putting their information in.

And a lot of these folks, they didn't have time to develop some of the, um, well, ac I shouldn't say they didn't have time. They, they did not take the time to develop past the, this app works. Yeah.

Into this app works is effective, safe, I can troubleshoot it. It doesn't even have to be a security issue. A lot of things.

Um, you know, you need to log that data and be looking at it to keep the app or the system up. Yeah. Um, to keep it on.

So I think that, um, we're, we're moving to a point where that's becoming clearer. And, um, you know, we have a lot of great platforms that have been investing in this stuff for years, um, and have security best practices wired into how they develop, um, you know, products. Not just from an application security perspective, but like how the products work and what the user experiences with the security issues.

Um, and that's kind of new. I, I, and I love to hear it. So, I mean, you know, hearing you makes me hopeful for the future.

Um, Aw. Because it true. I mean, it needs to be table stakes for, for some of these apps, right?

Um, and not just for enterprise. I'm, you know, I use apps personally, and I would like not like my stuff stolen there either. Um, so yeah, I, I think, I think better security, just making it, making security more of a functional requirement and less of a non-functional requirement.

'cause non-functional requirements, I think, uh, Allison you were getting at is they sort of fall to the floor, right? You know, ship the feature. Ship the feature, Right?

Right, right. So, uh, is that an intention that we're gonna set for 2024, we're gonna manifest this better product security for consumers, better security experiences. It's like, just like Security becomes a feature.

I'm visualizing it in my head. So hopefully we can, we can make it so in 2024, we should get back together at the end of 2024. Put It on your vision board, everybody just put it on there.

There You go. On your vision. Put it on the vision board for sure.

So speaking, kinda changing, shifting topics a little bit, jj, something we've talked over and over different times is the evolving role of the ciso, you know, what, what folks on our panel are doing. And, uh, you know, I think there was a great disturbance in the force when Tim Brown got charged by the SEC for the things happening at SolarWind. And you can examine all the reasons why, but you know, Dan have heard from you, probably Allison, same for you.

What, what, jj I'd love you first to comment on what you think the impact of that potential risk or outcome for CISOs, like going to jail kind of thing, or being heavily fined. What's that gonna do? Is anybody gonna wanna be a CISO anymore?

Well, it's funny and timely, I guess, to have the conversation. I mean, uh, I think also people, like anybody listening, um, if you haven't taken the time to understand that the nuances and the difference between this and some of the stuff that happened before where people were abusing bug bounty programs, uh, intentionally hiding, um, breaches and, and, and doing some, some shady stuff, right? Um, that other stuff is not, not appropriate.

Uh, and, and we're not saying that's okay, but this, this, um, this happening with the SEC where they're basically punishing the CISO who has no authority on execution at a, at a certain level up the organization. Um, it's timely. I mean, I hate it, but it's timely because we just had this conversation with Andy Ellis, um, before this happened when we were kind of talking about the con, you know, the conversation of the ciso, who's in the room, who's invited to the boardroom, what does that, uh, composition look like of those executive leaderships?

Um, and I think he was pretty blunt about, you know, the, the role of the ciso, um, and how they are treated by those stakeholders, and that they're not always invited to the table. And then sometimes if you, if you are invited in, you still might get told what you are and are not reporting, and your report might be filtered before it gets up up the chain. And so, I mean, it's a pretty s****y place to be as a ciso.

It's one of the, you know, it's one of the many reasons looking, looking into that life that I don't do that work as a CISO full-time. 'cause there's pieces of CISO e stuff that I like. So I like advising CISOs and doing the parts that I do well, and then leaving the crap of the things that I don't do well.

Well, and this stuff to other people. But I think that, I think the fallout from this is there are a lot of professionals who are doing a great job that, you know, don't get paid enough to deal with this kind of risk. They're not protected by the corporate policies.

If they don't have that type of cover from that, those stakeholders and leadership, they're just screwed. So we're gonna lose good people. You're gonna get the wrong people into the, into those roles.

And I don't mean like a blanket statement 100%, but it's gonna be hard to recruit into these when the CISO's not given, given the authority that's in alignment with the responsibility that they have. No, I think, I mean, I think, um, obviously some of the recent cases, and we've, we have a couple now where, uh, CISO is called out. It's definitely making a little people, uh, folks, um, jumpy because what's the up, what's the, what's the, what's your risk tolerance?

And I think that a lot of folks who end up in a CISO seat, um, they're, they're great at security. They're not necessarily, um, prepared to for how their role changes when they get the C. So, um, and the thing is, is that there is nothing magical or protective about the c You can be a CSO that can be your official title, and you could still be not part of the c-suite.

Um, you could not be covered by d and o insurance. Um, and these are things that we as professionals don't necessarily have practice when we are, you know, I'll speak for myself when I land a job that I'm really excited about. I'm just so excited.

I'm so excited that we picked each other, you know? And so then when it comes to negotiating, you know, now I feel like I need to have an attorney run things through. I need to make sure that there's appropriate insurance in place.

And if I was, if I was VP of product, um, I don't need to, I don't need to like pony up that level. It's just a sort of more of a compensation and scope negotiation. These elements aren't part of that negotiation.

And if you're a VP of security and you're sort of considered the exec and you're, the buck's gonna stop with you, then you do need to be thinking about those things. And most of us just simply haven't been prepared by our careers for that. Um, the other thing that I think is a shock to most people is folks who become CSOs are very effective doers.

They may have a strategic mindset, vision, the communication skills and all of that, but we got where we got, and a lot of us sort of get personal esteem out of our ability to execute and our sort of our tech chops, right? Like, whatever your expertise is. And some folks are like the risk nerds, and some of us are, you know, the networking gurus, et cetera.

But like, the role really changes when you are an executive. That's your primary job to be an executive, to advocate for your budget and to like work with legal and work with HR in a very different way than, you know, what, how we, what was, what's the phrase? Like how, um, the way that you got here isn't where, how you're gonna get where you're going, kind of a thing.

Mm-Hmm. How, how you, how you got here won't get you there. Yes.

And so I just, um, I feel like, um, uh, the, the individual situations that we have of as examples, there's some lessons to be learned, do this, don't do that. But I think, um, especially as what I'm seeing is that the role of the CISO is actually becoming more fluid, not less like a CISO who also runs it, you know, or a CISO who also runs fraud or trust and safety. Like the, it's, it's not a predictable scope.

And yet I feel like some of the expectations coming onto us are a little bit fixed and rigid. And so I, I just, um, I hope for us as a community that we can kind of, um, start to figure out amongst ourselves what the reasonable expectations are and figure out how to advocate for ourselves to get the, the scope, the budget, the, the legal protection that we need. So for example, all of you folks who are about to be offered a CISO gig, like you may need your own independent professional liability insurance.

Um, you cannot depend on the company to even know what to do as far as getting you covered with the and o insurance. 50 cents. All right, baby face, what you got?

She got nothing. She's, she, she covered all my points, dammit. Um, no, but no, it's true.

Like if you're, if you are an existing, um, chief information security officer or thereabouts, right? From a title perspective, and you don't have DNO insurance, get it, um, go, you know, and, and, and go to your board. If, if your like leadership says no, then let the board know that you're not covered.

And if the board says no, then go look for a new job, go find another company because, uh, you're exactly the type of person that they're probably going to try to throw under a bus. Um, you know, we are, I think, so I'm of a split mind here. On one hand, I do understand what the SEC is tempting to do by, by doing this, right?

They're, they're trying to, uh, say that the CISO is, is a director and officer, right? We are a material, uh, person in the company. You know what, our decisions should matter.

Um, but I think they're going out it the wrong way by, by going after the person who was in a position of having to make those hard choices as A-C-I-S-O about, you know, your leader tells you, I don't wanna hear that. And it's like, well, okay, but I, I need to go to the board. No, you're absolutely not gonna take that to the board.

And I'm just, I'm not saying that happened in this case. I'm just saying that it can happen. Um, and then the pressure that you're under, right?

Because you want to keep your job, your professional integrity. And now do you want to be subject to a, a potential, uh, indictment, right? Or, or, uh, or be sued?

So I, I think not just the Dino insurance, but, but I think this is going to be a maturity point for the CISO as, as, as Allison was, uh, getting out before, you know, we're, we have gone through maturity cycles where the CISO was usually the smart geek in the room that just knew how to run the firewall and some antivirus. And so, you know, they, they got the hat. Um, and then it transformed into, uh, you know, the, a pseudo risk leader, but still kept at a managerial type level and not a true executive.

And, um, you know, so no real decision making authority, but they, you know, they, they got a cool title. Um, and now I think what the SEC is attempting to do is lift the, lift this position up to being a direct of the CEO in almost every co you know, thi this needs to be sitting as a peer to the CIO. If the CISO is reporting to the CIO, now you have a conflict of interest inherent into the position, and your insurance carrier may not want to cover you because of, of that position, right?

Those, those are things I'm gonna start challenging insurance carriers when I meet with underwriters, uh, about like, how are, you know, how are you guys thinking about this? Because I know that if I were covering the CISO, I would want that person to have the loudest voice with the most direct line to the board as possible. Otherwise, you know, SolarWinds is gonna keep happening.

Um, and, and I, you know, and I, I'm not knocking what happened there. Like I said, I could completely put myself in the, in those shoes, like we've all been there. Anybody who sat in the chair knows the pressure that you're under, not just from the bad guys.

In fact, I often joke saying, I prefer that I enjoy when things are hitting the fan from a security perspective. That's my ne like Allison said, that's my natural operating environment, right? The more chaotic and messy, the, the more I'm, I'm digging in and, and, and geeking out and, and, you know, thriving on the adrenaline, but yeah, the, the, the managerial pressure, the leadership pressure, um, and the pressure from the other executives to just get out of the way, right?

Why are you stopping this? Um, it, it's intense and, and it takes a, an iron backbone. It really does.

It's Hard. So maybe there is a, there is an upside to this, which is it will help. And I, you know, frankly hadn't even thought about that, that it will help restructure and elevate that, that role a little bit.

I'm so mesmerized by the spinny things behind you, Dan. It's, sorry if you, you, if you guys wash my eyes gla gloss over here. I'm just, I've got sucked into the portal.

We're Open, die now. Okay, last topic. I think you have gj, we have just a few minutes left.

Oh, if you wanna bring up, um, I think we were talking about, um, some bad guys getting better. Oh, me? Yeah.

You bring, yeah. You wanna bring that topic to, to the front here? Yeah, I, I mean, I'm, I'm curious and I'll, I'll, um, start with Dan on this one, but I think we've, you know, for, I don't know, forever, you know, we're still doing the one-on-one level stuff poorly, um, from a hygiene and security perspective.

But it does seem that looking back throughout this year, we've had a lot of more sophisticated attacks where it wasn't just now there were opportunities for us to thwart, but we would've had to, we, we had to, you know, do that thing where we got a bunch of stuff, right? Um, and the attacker, you know, instead of only getting right, once they, they actually got, had to jump through and get several things, right? So it feels more sophisticated.

So I'm curious your thoughts on, on that from where you sit. Absolutely. Um, and so, so the bad guys, and we're gonna, I'm gonna use that term generically, but you know, organized criminal actor groups, um, you know, if you're, if if you go listen to the FBI, or I can't even remember what they call it, Organized criminal actor groups.

Yeah, I just made that up, isn't it? Isn't that cool? Hold on.

I need to trademark that one too. I got a lot of stuff, Um, oags oags. So they, yeah, they are.

Um, I think that what we're seeing now is convergence of technical expertise, um, and the profit motive sort of mixing, whereas before it was, you know, you throw, you throw a fish out and you get lucky once in a while, and then we got better fish protection, and then we got be, you know, and the firewalls and next gen and, and you know, we, we, we have satisfied most of the low level stuff, right? So all that was left is a PT level attacks for a large enterprise that's investing in security, obviously. Um, and so now what we've seen is that the, some of these criminal groups that are just purely motivated by profit, um, taking a PT like, uh, capability, right?

So they know how your infrastructure works, they know how to manage a firewall or a proxy. They know how to manipulate active directory. They know the thing, they know your infrastructure may be better than you do.

Uh, you know, and, and that is a scary thought, right? And, and they're also not afraid to use non-traditional attack methods, right? The getting back to, you know, they're calling people up on the phone and impersonating somebody or just threatening them, right?

Saying, you know, and ransomware, right? Don't, let's not forget ransomware. Um, and just purely for profit.

Um, I know nothing about this situation from the inside. I know nothing about their security capabilities, but I look at Ballys and I feel horrible for, for whoever was in seed on that, on on those days, then I'm sure they're still cleaning up, right? Because I'm sure that they had a good program, and it's Ballys, right?

I'm, I'm assuming that they had some investment there, right? Casinos take security pretty seriously. Um, and still the bad things that can happen, right?

And it, it, that that, that was a warning shot for, you know, once again, that, that perked me up when I saw that. And how devastating because they didn't care. They, they just went after them and they set a ransom and they didn't pay the ransom.

And, you know, I, you know, like I said, I, I feel horrible. Like, it, it, it, it's like one of those nightmare scenarios. It's like, you know, we did the right thing, we didn't pay the ransom, and now I just, you know, our, our company is offline for three months and we have no way of recouping some of the data because the backups failed or, or they timed out or whatever.

And the bad guys are getting that good now. And it's, uh, once again, you know, getting back to that last one about d and o and all the rest of it, right? Even though we do everything right, sometimes bad things happen.

And will the SCC care, I don't know, maybe now I'm depressed. So I think that's, that's that and the, the, the example you used was interesting because I think, um, so I, I've spent a lot of my career dealing with actors who are primarily financially motivated. Like there's apps out there too, state sponsored, all of that.

But like, yeah, they're a little bit predictable. They're going after the money and they'll, they'll take the easiest route to go there. And so part of what, like, I'm kind of rolling around in my head is these folks have always had, like, they've been very clever and have supply chains.

I'm thinking back to the days of call shops, which probably doesn't resonate in the us but in like Europe and Latin America, when long distance calling was very expensive. There were folks who would figure out how to, um, hack phone systems and get free time on the phone. And then like, there would be a line, um, you know, be like Brooklyn and there would be a line at a payphone with people waiting to, you know, pay cheap rates to call, um, internationally and or like, uh, out the door of a tabak in some, like in France or something.

And, and, and so there, and there were deep supply chains associated with these. And I kind of wonder if, um, sort of a combination of the success of ransomware plus, um, the pandemic because the sort of crime involved, crime evolved in really interesting ways during the pandemic. Um, both because everybody is at home and remote, and also, um, you know, jobs were scarce.

So, uh, I think in the, in the US and maybe Canada, I'm not sure where else check fraud is exploding, but part of what, um, you know, folks are sort of blaming that on is, it was, was a just, it was just a great way to commit fraud. And all it required was like hacking US postal or what have you, like pulling things out of people's mailboxes, which is very old school. But like now, like figuring out how to break into mailboxes that had multiple tenants associated with it is, it feels like very low level crime.

But the impact has been really, um, big and difficult to get arms around. And so I just, 'cause you're talking about ransomware, and one of the things I was thinking is one of the things I loved about crypto is that there, there were ways to trace people through the cryptocurrencies and, and, um, and, and take action. And, uh, but I, I think that folks are really the, the, there's innovators who are highly financially motivated and they're, they're gonna figure out how to get their money out.

So I, I think we'll continue to see that because, um, it's kind of a shame that, um, checks being stolen out of the mail is like a, you know, a lowest common denominator. But in other situations, hacking a, hacking a hospitality firm might be the easiest way to get to all of that money. So it's just interesting 'cause they will go wherever it's easiest for them to go.

I, I think that actually you're touching on exactly the point I was making, you know, so they used to go after a company, you know, you work for a company that had a lot of money sitting in virtual currency and that they would go after. And I worked for a company that had a lot of virtual currency as well. And, and, and so we were obviously very tuned to those things.

What I'm, what, I guess what I'm getting at is like the Bally's thing, yeah, they have a ton of money, but that's not what they went after. They just went after the infrastructure, right? They didn't go after the credit cards.

That data might be tokenized at this point, useless to them. So what did they go after? Extortion?

So my, my question for you guys, because I don't think it, I'm calling this the, uh, year view mirror session, but I don't think we can look back at this year and not talk about zero trust. So in the quick, uh, one word, zero trust in the past year, is it hot or hype? Allison, start with you.

I'm sorry, I know you want a one word answer, but like, I decline to respond if forced to one word. I just, I honestly have to say like, uh, I, I haven't heard that many discussions about Zero Trust this year in, in the sense that I think the hipness of Zero Trust is maybe two or three years old, right? Like, it was very hypey a few years ago, but now I think it's just folks are, they, they're on their roadmap.

They're adopting the principles. They can, they, they can at the pace that they can. And so the, they're still shooting for the Promise of Zero Trust.

But I think, um, you know, in their implementations, they are wherever they are. So I think it's, it's not so hot. It's, it's not hot or hype, it's just happening.

Oh, I got another word For you That's about 101 word answers. So that was really good. So, so I, I'll follow the rules And say, And say hot, um, only, but, but in reality, I agree with, uh, a lot, um, because it, we, it's a journey A but b it's an architecture, right?

So, so getting those zero trust principles in place as an architecture and then putting tooling behind it is really what Zero trust should have been about the whole time. But it turned into just, you know, hey, we're selling zero trust. It's like, no, it's like saying, you know, I'll, I'll use DLP as another example of yet another term that was an architecture, uh, but turned into a product that then didn't work the way anybody thought it did, because of course it can't.

So anyway, Thanks for that. All right guys, well thank you so much, uh, Mitch, I know we were right at time there, but, um, let's see what happens in, uh, 2024. We could have taken the rest of 2023 wrapping it up.

But thanks to all of you, Allison and Dan, of course, jj, it's been a pleasure working with you in 2023 on CISO talk. So thanks to everybody who joined us. Thanks to all of our panel and, and my partner jj, and we look forward to seeing you in 2024.

Let's hope some of these things we're gonna like deal with or maybe not, and work on the next thing that's more important. So we'll see what happens. Thanks for joining us on CISO Talk.

We'll look forward to, uh, seeing you again in 2024 on the next episode. Bye everybody.